The law of each Member State applies according to the “territorial criterion”: in the sense that the law of the State in whose territory the Controller has the establishment carrying out those activities in which personal data is processed (principle of establishment).

The principle of territoriality of the applicable law, substantially transposed in the Directive (Article 4.1, Directive 95/46/EC), has highlighted serious shortcomings in the system of protection of personal data in those circumstances characterized by a global approach: in particular, with regard to Internet and cloud computing.

Directive 95/46/EC could cause a serious lack of confidence in these contexts and for these limits.