The Article 29 Working Party issued its Opinion on applicable law, providing guidance on the scope of EU data protection law and the practical implications of Article 4 of the EU Data Protection Directive (95/46/EC, the “Directive”). The purpose of the Working Party’s Opinion 8/2010 (the “Opinion”) is twofold. First, it intends to clarify the current scope of EU data protection law with regard to the processing of personal data within and outside the European Economic Area (the “EEA”). The clarifications by the Working Party are aimed at enhancing legal certainty for data controllers, providing a clearer framework for individuals and stakeholders and avoiding legal loopholes and potential conflicts between overlapping national data protection laws. Throughout the Opinion, practical examples are used to demonstrate the clarifications, such as in the context of centralized HR databases, geolocation services, cloud computing and online social networks.
The Working Party’s main suggestion for the improvement of Article 4(1)a is to shift back to the country of origin principle. This would mean that only the laws of the Member State in which the main establishment of the controller is located would apply. For Article 4(1)c, in situations where the controller is established outside the EEA, the Working Party suggests that additional criteria be developed to ensure that a sufficient connection with the EEA territory exists.
As a final recommendation, the Working Party calls for greater harmonization and clarification regarding the requirement that data controllers located outside the EEA appoint a representative within the EEA.