(a) of which the controller is established in its territory or is within its jurisdiction; (b) of which the controller is not established in the territory of the Community, where for the purpose of processing personal data he makes use of means, whether or not automatic, which are located in the territory of that Member State. 2 In the circumstances referred to in paragraph 1 (b) the controller . must designate a representative established in the territory of that Member State, who shall be subrogated to the controller's rights “ and obligations. (emphasis added) 41. The EU Draft Directive was subsequently adopted by the European Council on 24 October 1995 ("the EU Directive") and was eventually repealed by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016，on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("the EU GDPR"). The Appellant relied on the following parts thereof: a . Preamble 107: “the Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no lonser ensures an adequate level of data protection. Conseauentlv the transfer 36