Extraterritorial enforcement of the European Union General Regulation on Data Protection (GDPR): consequences for Mexico

On May the 25th, 2018 came into force the EU General Data Protection Regulation (GDPR), relating to the Protection of Personal Data of Persons and the Free Movement of Data. This European Union Regulation has implications beyond the borders of the very same EU. The aim of this paper is to analyze the effect of the extraterritorial application of the new Regulation of the EU, in the Mexican legal space of data protection. The recitals and articles of the GDPR related to the extraterritorial application of this regulation are of special interest as they help to blur the juridical borders that, until recently, hindered the effective protection of personal data in the state legislations. There are three aspects of main relevance that this regulation provides for in terms of data protection: concerning the data processing activities related to the supply of goods or services to interested parties in the EU, the activities of processing personal data by a controller or a processor not established in the EU and the processing of personal data made by controllers not settled in the EU and to whom the Law of a Member State is applicable due to International Public Law. The analyzed Regulation here sets new interesting parameters in terms of territorial application, involving companies and individuals that previously would not be affected by it.