2

Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?

  • There doesn't seem to be a consensus in the answers - who does GDPR actually apply to? – user29357 May 9 '18 at 21:21
  • Notice that Greendrake's answer has been completely rewritten and now agrees with mine. – phoog May 10 '18 at 5:55
  • @phoog, you're right. I've accepted Greendrake's answer as IMHO it's a better, more complete answer - thanks for clarifying what the correct answer is. – user29357 May 10 '18 at 6:02
2

Whether or not you are protected by GDPR depends on the location of both yourself and the party processing your data. Citizenship and residence statuses are completely irrelevant (Recital 14(1)):

The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence

If the party processing your data is established in the EU, then you are protected no matter who you are or where you are (Art. 3(1)):

This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

If the party processing your data is not established in the EU, then you are only protected if you are in the EU (Art. 3(2)):

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union

  • That is their interpretation, and not what the actual regulations say. I think you should say on what basis you might come to that conclusion. They do also say "you would be correct to assume that the GDPR only applies to citizens of the EU" – user6726 May 9 '18 at 12:52
  • 1
    Article 3 paragraph 1 is quite clear that EU data processors are bound by the regulation, period. It makes no mention of the location of the data subject. – phoog May 9 '18 at 13:07
  • @user6726 fair comment. I no longer reference them in the answer. – Greendrake May 9 '18 at 23:51
  • @phoog agreed — answer updated. – Greendrake May 9 '18 at 23:53
  • 2
    @d3vid That is true. Pretty much like EU laws would not apply if he gets robbed in Australia — he will be treated according to Australian laws. – Greendrake May 10 '18 at 12:40
-1

Your digital ID card may only be used in an electronic environment, and is not a valid form of identification outside of the internet. Although e-residents receive government-issued digi- ID’s similar to those of citizens, e-residency does not confer citizenship, tax residency, residence, or right of entry to Estonia or to the European Union. Your e-Residency digi-ID card cannot be used as physical identification or as a travel document.

From What Can I Do as an e-Resident? (emphasis mine)

So no, the e-residency doesn't make you a citizen and you do not gain any rights under the European Union by being a member. The program itself is basically just a financial services membership, and the ID they give you is your membership card.

  • How is this answer relevant to GDPR? – Greendrake May 9 '18 at 5:34
  • @Greendrake Good point, but the question does still explicitly ask about citizenship too, so perhaps this information should be combined with your answer for completeness? (E.g. no you're not a citizen plus that doesn't matter for GDPR anyways.) – animuson May 9 '18 at 12:18
-1

Are people who gain an Estonian e-Residency treated as a European citizen under upcoming GDPR regulations?

Yes, because all people are protected by GDPR regardless of citizenship. The string "citizen" does not appear in the regulation. Its territorial applicability is defined (in Article 3) with reference to the location of the data processor and data subject, not their citizenship. If you reside outside the EU, you enjoy the same protection as an EU citizen who resides outside the EU.

  • "If you reside outside the EU, you enjoy the same protection" GDPR does not protect people outside the EU no matter who they are. – Greendrake May 9 '18 at 5:33
  • @Greendrake That is incorrect. People who are outside the EU are protected when their data are processed by a data processor in the EU. See article 3(1), which applies only by virtue of the data processor's location. – phoog May 9 '18 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.