2

Situation:

Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up forms. You are based in the US and most of the members of your email list are in the US, but a significant plurality are from abroad and a substantial number of those individuals reside in the EU. The GDPR is thus triggered for you (meaning you must comply).

Question:

Does this situation trigger the GDPR obligations (for example, the rights afforded to data subjects, the steps taken to protect their data, etc.) for every member of your email list regardless of where they live/reside/are or just for those individuals on your email list who are in/live in/were in EU at the time they signed up?

Improve this question

1 Answer 1

Reset to default
3

Yes, it triggers the GDPR obligations

Considerations:

  1. Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that.

  2. Did they previously give consent and you can document it? If so, then you can argue that you have the required consent.

  3. Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine.

  4. What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task.

Improve this answer
6
  • Useful info, thank you! It consists of Mailchimp lists, so that's how that info is available. So segmenting those folks from that list and asking them to re-subscribe is probably the best bet in the situation described then? If I may, I'd also like to underscore the italicized part of my question. Would any other specific obligations arise with regard to the non-EU subscribers? So, does a name or discrete number of names on a list trigger GDPR for the entire list or just for those specific names? Thank you again for your thoughtful answer.
    – A.fm.
    Commented May 22, 2018 at 23:00
  • It only applies to EU subscribers on the list, more correct Schengen countries plus Great Britain. In fact it does not apply to non-EU countries like Monaco and Switzerland, thus Mailchimp is not that accurate.
    – Per Digre
    Commented May 23, 2018 at 7:10
  • Thanks for the answer and the clarification. That's new info to me that it's limited to Schengen + GB. I hadn't heard that. So it does not apply to Croatia, then? Very interesting!
    – A.fm.
    Commented May 23, 2018 at 11:46
  • It applies to Croatia. Here's a fairly updated list hipaajournal.com/what-countries-are-affected-by-the-gdpr Also adding to the confusion is the fact that for EU it starts 25 of May, but for EEC countries such as Norway it is delayed to July.
    – Per Digre
    Commented May 24, 2018 at 12:52
  • My bad, I meant for EFTA countries such as Norway it is delayed to July 1 because of Liechtenstein.
    – Per Digre
    Commented May 24, 2018 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .