General Data Protection Regulation

INTRODUCTION REGULATION

carried out in accordance with this Regulation, regardless of whether

the processing itself takes placewithin theUnion. Establishment implies

the effective and real exercise of activity through stable arrangements.

The legal form of such arrangements, whether through a branch or a

subsidiary with a legal personality, is not the determining factor in that

respect.

(23) In order to ensure that natural persons are not deprived of the

protection to which they are entitled under this Regulation, the

processing of personal data of data subjects who are in the Union

by a controller or a processor not established in the Union should be

subject to this Regulation where the processing activities are related

to offering goods or services to such data subjects irrespective of

whether connected to a payment. In order to determine whether such

a controller or processor is offering goods or services to data subjects

who are in the Union, it should be ascertained whether it is apparent

that the controller or processor envisages offering services to data

subjects in one or more Member States in the Union. Whereas the mere

accessibility of the controller’s, processor’s or an intermediary’s website

in the Union, of an email address or of other contact details, or the use

of a language generally used in the third country where the controller

is established, is insufficient to ascertain such intention, factors such

as the use of a language or a currency generally used in one or more

Member States with the possibility of ordering goods and services in

that other language, or the mentioning of customers or users who

are in the Union, may make it apparent that the controller envisages

offering goods or services to data subjects in the Union.

(24) The processing of personal data of data subjects who are in the Union

by a controller or processor not established in the Union should also be

subject to this Regulation when it is related to the monitoring of the

behaviour of such data subjects in so far as their behaviour takes place

within the Union. In order to determine whether a processing activity

can be considered to monitor the behaviour of data subjects, it should

be ascertained whether natural persons are tracked on the internet

including potential subsequent use of personal data processing

techniques which consist of profiling a natural person, particularly

in order to take decisions concerning her or him or for analysing or

predicting her or his personal preferences, behaviours and attitudes.

(25) Where Member State law applies by virtue of public international law,

this Regulation should also apply to a controller not established in the

Union, such as in a Member State’s diplomatic mission or consular post.

(26) The principles of data protection should apply to any information

concerning an identified or identifiable natural person. Personal data

which have undergone pseudonymisation, which could be attributed

to a natural person by the use of additional information should be

considered to be information on an identifiable natural person. To

determine whether a natural person is identifiable, account should be

taken of all the means reasonably likely to be used, such as singling

out, either by the controller or by another person to identify the

natural person directly or indirectly. To ascertain whether means are

reasonably likely to be used to identify the natural person, account

should be taken of all objective factors, such as the costs of and the