The Long-arm of the GDPR and its Inherent Weakness: The EDPB’s Guidelines 05/2021 on the Interplay of Article 3 and Chapter V of the GDPR

The European Data Protection Board’s Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR continue the maximalist territorial approach the EU has taken at least since Google Spain and its insistence on ‘effective and complete protection of datasubjects’. Yet, they speak particularly to the recognition in Schrems II that the simple extension of a protective law to another country does not necessarily translate into equivalent protection if the wider legal landscape in that country distorts it in the law's actual operation. This recognition almost necessarily entails that being subject to the GDPR (by virtue of Art 3) should not displace the transfers rules in Chapter V if the processing occurs in a third country, given that only the transfer rules are specifically directed towards the actual reception of GDPR duties and rights in the third country. Consistently but not easily reconcilable with the rules' inherent design, the Guidelines take a cumulative - rather than a complementary or compensatory - approach tothe interplay of Art 3 and Chapter V of the GDPR. Implicitly, the approach acknowledges that giving the GDPR a wide territorial scope hardly delivers a panacea of effectiveness and control over data controllers or processors on faraway shores in fundamentally different legal and political orders. Yet, whetherthis cumulative approach will deliver on the promise of increased protection isequally doubtful