Jurisdiction

• Author: David Zetoony
• Profession: Is a partner in the Boulder, Colorado office of Bryan Cave Leighton Paisner, LLP, an international law firm
• Pages: 5-11

5

JURIsDIctIon

Q.7 WHAt Does It MeAn to Be “estABLIsHeD”

In tHe eURopeAn UnIon?

As is discussed in Q 15, the GDPR applies to companies that process data

“in the context of the activities of an establishment . . . in the Union.” 11

Although the regulation does not offer a precise denition of what it

means to be an “establishment,” it offers the following hints:

• Stable Arrangement. According to the GDPR establishment

“implies the effective and real exercise of activity through stable

arrangements.”12

• Legal Form May Be Relevant, But Is Not Determinative. The

GDPR states that if an entity is active in the European Union the

legal form of those activities “whether through a branch or a sub-

sidiary with a legal personality, is not the determining factor” when

deciding whether the entity is “established.”13 Put differently, the

fact that a company is not incorporated in the European Union

does not necessarily mean that it does not have an “establishment”

in the European Union.

• Location of Infrastructure May Be Relevant, But Is Not Determi-

native. The GDPR states that “presence and use of technical means

and technologies for processing” within the European Union is not

the “determining criteria” of whether a company’s “main establish-

ment” is in the European Union, but it implies that it may be one

factor of whether an establishment exists.14

11. GDPR, Article 3(1) (emphasis added).

12. GDPR, Recital 22 (emphasis added).

13. GDPR, Recital 22; See also Article 29 Working Party, WP 56: Working Document

on determining the international application of EU data protection law to personal data

processing on the Internet by non-EU based websites at 8 (May 30, 2002); Verein fur

Konsumenteninformation v. Amazon, ECJ Case C-191/15 at ¶ 75 (July 28, 2016).

14. GDPR, Recital 36 (emphasis added).