Do the GDPR Regulations apply to processing data of a citizen who has dual nationality?

  • Do you mean dual citizenship? For example, My sister was born on a US military base in Germany and enjoys citizenship both in Germany and America. I am thinking that perhaps you wish to inquire if someone with dual citizenship, like my sister, may invoke the GDPR privilege, like the "right to erasure". – Enjoli Jan 23 '18 at 17:53

I don't see any indication that GDPR regulations take citizenship into account in any way, so it seems unlikely that the number of citizenships is relevant.

| improve this answer | |

GDPR Recital 14 (p.3) states:

"The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data..."

and GDPR Article 3(2) ("Territorial Scope", p.33) states:

"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union..."

It is not immediately clear from reading the above Article 3(2) whether 'in the Union' refers to only one, a subset or all of the following scenarios:

  • located in the Union: geographically currently located within the Union, whatever their nationality/citizenship (e.g. including tourists and temporary residents such as students);

  • resident in the Union: normally resident within the Union, whatever their nationality/citizenship (e.g. would include if they were to visit a website hosted outside of the E.U.);

  • citizen in the Union: European citizen, whatever their current geographic location (e.g. would include if they were travelling outside of the E.U. for holiday/work etc.).

While some privacy professionals have concluded that the first two are included in scope but that the third is probably not on the basis that they think 'in the Union' is limited by geographical boundaries rather than by way of membership in a political and economical union, at the present time there is no case law yet that we can rely upon to be certain. If anyone discovers anything that clarifies the GDPR intent on this please add to the comments and I'll update the answer if appropriate.

| improve this answer | |

"The aim of the GDPR is to protect all EU citizens from privacy and data breaches..." The decision to uphold 'rights of erasure' based on jus sanguinis (right of blood) or jus soli (right of soil) are sovereign to the EU councils final decisions as they occur.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.