TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Perspectives | Do B2B companies not based in the EU need to comply with the GDPR? Related reading: Government leaders discuss state of play for UK adequacy, data transfers

rss_feed

I’ve long questioned the extraterritorial scope of the EU General Data Protection Regulation and if non-EU based organizations that engage solely in business-to-business activities fall under the GDPR.

The GDPR is at best ambiguous on this issue, and the guidance published to date from the regulators is unhelpful.

This issue has been brought into focus because of Brexit and the numerous inquiries I’ve received about whether U.K. B2B companies (with no physical presence in the EU) need to appoint an EU representative (and comply with the GDPR more generally in the EU).  

The point has been raised by the privacy activist organization founded by Max Schrems (NOYB – European Center for Digital Rights), which stated in its submission in December 2020 on the European Commission’s proposed new standard contractual clauses that further guidance is needed to clarify the scope of the requirement to appoint an EU representative. 

What is the issue in a nutshell?

Article 3(2)(a) of the GDPR states controllers and processors not based in the EU are subject to the GDPR where they process personal data of individuals in the EU in the course of offering goods or services to those individuals.

So, a U.K.-based clothing retailer selling items to an individual in France needs to comply with the GDPR. Makes sense as the retailer could be collecting a fair amount of information about the individual, including name, address, payment information and possibly some profile data. 

But what happens if the U.K.-based retailer is selling to a company and only collecting business contact details in that context? It is not offering goods to an individual but a company. Does that mean the GDPR does not apply?

Interpretation of Article 3(2)(a)

On a literal reading of Article 3(2)(a), the answer must be yes. The B2B retailer is not offering goods to an individual.  The European Data Protection Board has published guidance to help clarify the scope of Article 3(2)(a) and all of the examples relate to business to consumer scenarios. Not helpful at all.

The EDPB could have taken the opportunity to make clear that Article 3(2)(a) also applies to B2B scenarios, and individuals should be read as individuals acting on behalf of companies. It did not do this, and I’m not sure why.

Is that an implicit recognition that Article 3(2)(a) may not apply to B2B scenarios? It would be somewhat of an anomaly that personal information collected in the context of B2B transaction is subject to the GDPR if you have an establishment in the EU but out of scope where you are not in the EU. And what about protecting the privacy rights of individuals at companies that are clearly entitled to protection?

Unfair advantage

It would create somewhat of an unfair advantage where you sell into the EU but are based outside of it. The GDPR and the extraterritoriality provisions were intended to level the playing field to ensure non-EU based technology businesses were also subject to the GDPR when active in the EU. Recognizing this, it is hard to justify an interpretation that excludes B2B transactions for non-EU based businesses. 

There is no getting away from the fact that Article 3(2)(a) only refers to individuals and the EDPB guidance highlights B2C transactions.  

While it seems odd to distinguish between B2B and B2C in this way, this distinction is well established (even if controversial) in the U.K. where B2B (e.g., corporate email accounts) communications are excluded from the scope of Privacy and Electronic Communications Act 2002. Only B2C (e.g., private email accounts) communications require opt-in consent. There are then forms for having different standards depending on whether the processing of personal data is in the context of B2B or B2C transactions.     

Purposive and pragmatic interpretation

For my part, while Article 3(2)(a) is ambiguous, I’ve always worked on the basis that non-EU based organizations that engage solely in B2B activities are within the scope of the GDPR, although I have often had clients query this and highlight the fact that they are not selling to individuals.

With Brexit having occurred, clarity is important as U.K. businesses need to know as a matter of urgency the scope of their obligations as there is a real cost to having to appoint an EU representative. 

The U.K. Information Commissioner’s Office has no clear official position on this issue and there are mixed messages on whether an EU representative is needed when the activities are pure B2B.

Scope for a UK approach

In September, the U.K. government published a consultation document on a new National Data Strategy with laudable goals to “build a world-leading data economy” with laws that are “not too burdensome” and “a data regime that is neither unnecessarily complex nor vague.”

In this context, is there scope for the U.K. to develop a different and more business-friendly interpretation of the GDPR? The U.K. courts and lawyers have historically taken a more literal approach to interpretation as compared to the EU courts and lawyers. Hence, my EU peers do not necessarily see the same issue with Article 3(2)(a). If the U.K. developed a more literal interpretation to Article 3(2)(a), that may reduce some regulatory friction to trade with the U.K. It would mean non-U.K.-based B2B businesses would not need to have a U.K. representative.

That, though, does not help the many U.K.-based businesses that are asking whether they now need to appoint an EU representative. Clarity from regulators would be extremely welcome.    

Photo by Patrick Tomasso on Unsplash


Approved
CIPM, CIPP/A, CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPT
Credits: 1

Submit for CPEs

8 Comments

If you want to comment on this post, you need to login.

  • comment Eduardo Ustaran • Jan 29, 2021
    A very interesting and well presented piece. In my view it is beyond doubt that the GDPR applies to non-EU based controllers targeting the B2B market because ultimately the business targets will be managed and run by people (i.e. data subjects). It also unlikely that the UK will diverge on this fundamental point of modern data protection law.
  • comment Tim Bell • Jan 30, 2021
    Thanks for this article, raising awareness on an issue which remains curiously unclear. I agree with Eduardo's comments below that GDPR must apply to B2B personal data, as it is still personal data. There's also the potential that those non-EU companies may be monitoring their contact individuals at business clients (in line with Article 3(2)(b)), as they will have details of when/where they work, and potentially other monitoring information (e.g. if they receive an 'out of office' response informing when that individual is enjoying a holiday).
  • comment Lyn Boxall • Jan 30, 2021
    I too find this article very interesting, including because it's useful to know as I sit at my desk in Singapore that I'm not the only person who has been cracking their head over this point.
    
    I may well be accused of sitting on the fence, but I think that the article should be interpreted in light of private international law and validly of extra-territorial jurisdiction, rather than what makes sense in a broader GDPR landscape.  That leads me to thinking that only B2C is caught, but I admit that I've taken a more cautious approach in practice and have advised B2B clients in Singapore to appoint an EU rep.  It has, in any event, been a moot point because we typically find that their customers in the EU expect to see that they have made such an appointment.
    
    In addition, in some cases where a client in Singapore has an establishment in the EU they have nevertheless appointed an EU rep.  This has happened where the establishment in the EU is a sales and marketing operation, literally with sales people who spend their time (COVID permitting) on the road.  The last thing they need is for some request or other to be sent to their sales and marketing address in the EU by a regulator and for it to be overlooked and not sent to HQ in Singapore for a proper response.
  • comment Wim Nauwelaerts • Jan 31, 2021
    I agree that this is not clearly spelled out in the regulatory guidance that is available at this point.  However, perhaps the reason why the EDPB decided that there was no need to focus on B2B scenarios in its November 2019 guidance, is that in a B2B context where a non-EU business sells goods or services to a business in the EU, the business in the EU is legally required to ensure that any data sharing in connection with the business transaction complies with the data transfer rules in Chapter V of the GDPR.  That requirement also applies to personal data (such as contact details) relating to staff members of the business in the EU that are shared with the non-EU business.  Therefore, if the EU business ensures that appropriate safeguards are in place before sharing its staff members’ data with non-EU business partners, there is really no reason to assume that the individuals in question are denied the protection that they are entitled to under the GDPR.
  • comment Kolvin Stone • Feb 1, 2021
    Thanks for the comments everyone.  I too have have interpreted Art 3 GDPR as applying to individuals at corporates not least as it makes sense from a risk management perspective.   But it is not necessarily obvious from a plain English interpretation and the regulatory guidance.  
    
    I think Wim makes a good point that employees at corporates are protected by virtue of the data transfer rules in Chapter V of the GDPR which could support more of a literal and plain English reading of Art 3.  In B2C transactions, that is not the case so there is more reason to have B2C organisations directly subject to the GDPR.
    
    I think this needs to be clarified and would like there to more discussion around the issue.  
    
    I had a couple of clients press the ICO on this point and they indicated that they might not need an EU rep where their activities  (UK- EU) are solely B2B (i.e. their activities were outside the scope the GDPR).  There are mixed messages and divergent views.
  • comment David Berney • Feb 2, 2021
    I agree with Eduardo that it is beyond doubt that the GDPR applies here. One reason for this is the nature of a sole trader. They are a business but at the same time an individual. The EDPB make a point about whether the business is targeting individuals in the EU to distinguish if a representative is necessary and I think if you are in a B2B relationship you must be. I expect to see more clarity around this as the UK's withdrawal from the EU progresses as there are many businesses in  the UK who will need to know if they require representatives in the EU to continue trading without breaching this particular piece of legislation.
  • comment Kolvin Stone • Feb 4, 2021
    To be clear, sole traders are individuals so agree that they are absolutely in scope.  I was really highlighting the issue in the context of B2B transactions between corporations.    It is really the same distinction we have under PECR in the UK between individual subscribers (which includes sole traders) and corporate subscribers where there are different privacy standards depending on whether you are acting as an individual or on behalf of a corporation.  I think we would all welcome some clarity!
  • comment Magdalena Klinger • Feb 18, 2021
    An interesting article indeed. In my opinion, what needs to be clarified is to what extend the GDPR apply to the B2B. Example: are companies that exchange only necessary business contact details entering into controller - processor relationship (with an obligation to comply with all or only with some of the C-P obligations), or rather into controller-controller relationship? There is very little consistency on this subject and many companies might be understandably reluctant to appoint an EU representative if is just for exchanging few compulsory business contact details.