white_paper_on_data_protection_in_india_171127_final_v2

protecting the privacy of EU residents against cross border action. 185 The exact extent of the
new rules of jurisdiction under the EU GDPR are not yet clear, particularly the clause on
tracking the behaviour of EU residents. For instance, use of persistent cookies or IP address
logs (along with some other data) could result in the monitoring of online behaviour of
residents. 186
The territorial principle in clause (1), on its own, has a significantly wide reach. In the case of
Google Spain, 187 the argument that processing of data by Google Inc (based in the US) for
operating Google Search was not subject to EU law was rejected by the European Court of
Justice. The Court held that this processing was in the context of the activities of Google
Spain, an establishment in the EU despite the fact that it was only operating in the area of
advertising.
Australia
Australia adopts a different approach by prescribing two tests to determine whether the
Privacy Act applies to an organisation. 188 First, the Privacy Act applies to all Australian
organisations, such as companies or trusts incorporated in Australia irrespective of where
personal data is collected by such organisations. Second, in respect of organisations and
operators not constituted in Australia, they are subject to the jurisdiction of Australian courts
if they have an Australian link. An organisation has an Australian link if it carries on business
in Australia and the personal data has been collected or held in Australia. The phrase ―carries
on business in Australia‖ has not been defined and the Office of the Australian Information
Commission (OAIC) has suggested that the application of the Act is to be guided by judicial
interpretation in this regard. 189 Consistent and regular activity in Australia with the aim of
profit has been held to be carrying on business in Australia. 190
Singapore
The data protection legislation of Singapore (the Singapore Personal Data Protection Act,
2012 or the Singapore Act) does not explicitly set out its territorial jurisdiction. However, the
Singapore Act includes any individual, company, association or body of persons, corporate or
unincorporated, whether or not, formed or recognised under the law of Singapore, and
whether or not resident, or having an office or a place of business, in Singapore within the
185 Dan Jerker B. Svantesson, ‗Extraterritoriality in the context of Data Privacy Regulation‘, 7(1) Masaryk
University Journal of Law and Technology 87 (2012).
186 ‗New Rules, Wider Reach: The Extraterritorial Scope of the GDPR‘, Slaughter and May (June 2016),
available at: https://www.slaughterandmay.com/media/2535540/new-rules-wider-reach-the-extraterritorialscope-of-the-gdpr.pdf,
(last accessed 31 October 2017).
187 Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja
González, Case C131/12, (2014), European Court of Justice.
188 Section 5 B, Privacy Act.
189 OAIC, ‗APP Guidelines- Key Concepts‘ (March 2015), available at: https://www.oaic.gov.au/agencies-andorganisations/app-guidelines/chapter-b-key-concepts#australian-link,
(last accessed 1 November 2017).
190 OAIC, ‗APP Guidelines- Key Concepts‘ (March 2015), available at: https://www.oaic.gov.au/agencies-andorganisations/app-guidelines/chapter-b-key-concepts#australian-link,
(last accessed 1 November 2017).
26