Expanding the European data protection scope beyond territory: Article 3 of the General Data Protection Regulation in its wider context

Jurisdiction based solely on the territoriality principle is becoming less evident in the digital age. 1 Not long ago, processing of personal data seemed easy to understand: a data controller, a data processor, a data subject, and all the means used for data processing operations were usually located in the same country. Processing operations were subject to a single legal regime. The problem of potential conflicts of jurisdiction almost did not exist and application of the territoriality principle was sufficient for the protection of individuals’ personal data. This kind of processing operations constituted the vast majority of personal data processing in the 80s and 90s when the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (hereinafter, ‘Convention 108’) and the European Union (EU) Directive 95/46/EC 2 (hereinafter, ‘Directive’, ‘Data Protection Directive’) were drafted.