GDPR Guidelines for Canadian Business

• Author: David Canton
• Date: December 05, 2018

The new EU GDPR privacy rules can apply to businesses outside of the EU that provide goods and services to EU data subjects. It is important for businesses outside of the EU to know when they are subject to the GDPR, as penalties for non-compliance are significant. An occasional sale to someone in the EU probably won’t be an issue – but what will?

The European Data Protection Board just released for public consultation draft guidelines on when the GDPR applies to those without a presence in the EU.

Article 3(2) of the GDPR says it applies to businesses without an EU presence with activities relating to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

The guideline’s examples under the targeting criteria in (a) include:

• Having a website with an EU based TLD (such as .eu)
• Mentioning EU countries by name
• Having marketing aimed at an EU audience
• Using EU currency
• Offering delivery to the EU

The guideline’s examples under the behavioural monitoring criteria in (b) include:

• Behavioural advertisements
• Geo-localisation activities, in particular for marketing purposes
• Online tracking through the use of cookies or other...