CIPP/E Study Guide
Ch 5.2.3-5.2.4 - Article 3(3) and UK

Public international law, EU representatives and Brexit

Last reviewed:

Article 3(3) applies the GDPR where a controller not established in the Union processes in a place where member state law applies by virtue of public international law - for example, EU member state embassies/consulates, or ships and aircraft registered to a member state. It has little practical commercial significance. Separately, the EU representative (Article 27) is a contact point for non-EU controllers/processors caught by Article 3(2) - but appointing one does not make the organisation 'established'. Post-Brexit, the UK has enacted identical provisions, swapping 'member state' for 'United Kingdom', so an organisation can be caught by both EU and UK regimes at once.

Article 3(3) covers, for example, embassies and consulates of EU member states, and aircraft and ships to which the GDPR applies by treaty - e.g. a ship registered to a member state when in international waters. The text notes it has little practical significance in commercial/business contexts.

Representative ≠ establishment

Appointing an Article 27 EU representative does NOT make a controller or processor 'established' in the EU under Article 3(1). Likewise, appointing an EU processor does not make a non-EU controller subject to the GDPR. These are classic exam traps.

Brexit. The UK enacted identical provisions, replacing 'member state' with 'United Kingdom'. So an organisation with establishments in both an EU member state and the UK, or one targeting/monitoring people in both, will be subject to both EU and UK data protection law.

Post-Brexit dual application
SituationLaws that apply
Establishments in both an EU member state and the UK, processing in the context of eachBoth EU and UK data protection law
EU-established organisation that targets/monitors individuals in the UKBoth EU and UK law (and the mirror is true for a UK-established organisation targeting/monitoring people in the EU)

Key terms - quick answers

What is “Article 3(3)”?
Applies the GDPR where a non-EU-established controller processes in a place where member state law applies by virtue of public international law (e.g. embassies, member-state-registered ships).
What is “Public international law”?
The body of law (treaties etc.) under which a member state's law can apply in places like embassies, consulates, ships and aircraft.
What is “EU representative”?
The Article 27 representative a non-EU organisation caught by Article 3(2) must appoint; appointing one does not by itself make the organisation 'established' in the EU.

Keep going - free

Every study note on this site is free. So are these: