I’ve long questioned the extraterritorial scope of the EU General Data Protection Regulation and if non-EU based organizations that engage solely in business-to-business activities fall under the GDPR.
The GDPR is at best ambiguous on this issue, and the guidance published to date from the regulators is unhelpful.
This issue has been brought into focus because of Brexit and the numerous inquiries I’ve received about whether U.K. B2B companies (with no physical presence in the EU) need to appoint an EU representative (and comply with the GDPR more generally in the EU).
The point has been raised by the privacy activist organization founded by Max Schrems (NOYB – European Center for Digital Rights), which stated in its submission in December 2020 on the European Commission’s proposed new standard contractual clauses that further guidance is needed to clarify the scope of the requirement to appoint an EU representative.
What is the issue in a nutshell?
Article 3(2)(a) of the GDPR states controllers and processors not based in the EU are subject to the GDPR where they process personal data of individuals in the EU in the course of offering goods or services to those individuals.
So, a U.K.-based clothing retailer selling items to an individual in France needs to comply with the GDPR. Makes sense as the retailer could be collecting a fair amount of information about the individual, including name, address, payment information and possibly some profile data.
But what happens if the U.K.-based retailer is selling to a company and only collecting business contact details in that context? It is not offering goods to an individual but a company. Does that mean the GDPR does not apply?
Interpretation of Article 3(2)(a)
On a literal reading of Article 3(2)(a), the answer must be yes. The B2B retailer is not offering goods to an individual. The European Data Protection Board has published guidance to help clarify the scope of Article 3(2)(a) and all of the examples relate to business to consumer scenarios. Not helpful at all.
The EDPB could have taken the opportunity to make clear that Article 3(2)(a) also applies to B2B scenarios, and individuals should be read as individuals acting on behalf of companies. It did not do this, and I’m not sure why.
Is that an implicit recognition that Article 3(2)(a) may not apply to B2B scenarios? It would be somewhat of an anomaly that personal information collected in the context of B2B transaction is subject to the GDPR if you have an establishment in the EU but out of scope where you are not in the EU. And what about protecting the privacy rights of individuals at companies that are clearly entitled to protection?
Unfair advantage
It would create somewhat of an unfair advantage where you sell into the EU but are based outside of it. The GDPR and the extraterritoriality provisions were intended to level the playing field to ensure non-EU based technology businesses were also subject to the GDPR when active in the EU. Recognizing this, it is hard to justify an interpretation that excludes B2B transactions for non-EU based businesses.
There is no getting away from the fact that Article 3(2)(a) only refers to individuals and the EDPB guidance highlights B2C transactions.
While it seems odd to distinguish between B2B and B2C in this way, this distinction is well established (even if controversial) in the U.K. where B2B (e.g., corporate email accounts) communications are excluded from the scope of Privacy and Electronic Communications Act 2002. Only B2C (e.g., private email accounts) communications require opt-in consent. There are then forms for having different standards depending on whether the processing of personal data is in the context of B2B or B2C transactions.
Purposive and pragmatic interpretation
For my part, while Article 3(2)(a) is ambiguous, I’ve always worked on the basis that non-EU based organizations that engage solely in B2B activities are within the scope of the GDPR, although I have often had clients query this and highlight the fact that they are not selling to individuals.
With Brexit having occurred, clarity is important as U.K. businesses need to know as a matter of urgency the scope of their obligations as there is a real cost to having to appoint an EU representative.
The U.K. Information Commissioner’s Office has no clear official position on this issue and there are mixed messages on whether an EU representative is needed when the activities are pure B2B.
Scope for a UK approach
In September, the U.K. government published a consultation document on a new National Data Strategy with laudable goals to “build a world-leading data economy” with laws that are “not too burdensome” and “a data regime that is neither unnecessarily complex nor vague.”
In this context, is there scope for the U.K. to develop a different and more business-friendly interpretation of the GDPR? The U.K. courts and lawyers have historically taken a more literal approach to interpretation as compared to the EU courts and lawyers. Hence, my EU peers do not necessarily see the same issue with Article 3(2)(a). If the U.K. developed a more literal interpretation to Article 3(2)(a), that may reduce some regulatory friction to trade with the U.K. It would mean non-U.K.-based B2B businesses would not need to have a U.K. representative.
That, though, does not help the many U.K.-based businesses that are asking whether they now need to appoint an EU representative. Clarity from regulators would be extremely welcome.
Photo by Patrick Tomasso on Unsplash
