1

Situation: Parent company is registered in the EU member state but does not do b2c business in the EU and does not process personal data of Europeans. Subsidiaries are not EU companies and does not do b2c business in the EU and does not process personal data of europeans. Is it true that the parent company must comply with the GDPR just because it is registred in the EU (even if does not really do business in the EU)?

6
  • No, it only has to do with personal data of EU citizens, regardless where the company is registered. However, you say you have no EU consumers but be advised that an EU employee is also a person which has personal data under GDPR jurisdiction. – Per Digre May 23 '18 at 7:57
  • @PerDigre correction: it has to do with personal data of EU residents. An EU citizen who is not in the EU has no more protection than a non-EU citizen who is not in the EU, and a non-EU citizen who is in the EU is fully protected. – phoog Sep 21 '18 at 15:13
  • @phoog, I tend to disagree, GDPR protects EU citizens regardless where they live. See the discussion in this article medium.com/@thomasyohannan/… – Per Digre Sep 22 '18 at 19:11
  • @PerDigre a person in the EU can claim GDPR protection against a company with no EU presence, although the EU's ability to enforce anything in such a case is limited. A person outside the EU has no claim to GDPR protection against such a company, regardless of citizenship. The discussion you link to cites a text with no legal force in support of its claim that all EU citizens are protected. The text of the GDPR makes no such claim. – phoog Sep 22 '18 at 22:57
  • @phoog, you are right. GDPR itself just states persons in the EU, which is sort of open to interpretation, but you will see EU citizens mentioned occasionally. On the point of enforcement, I am still waiting to see EU try to enforce companies outside of EU, which is techically possible if they make money from europe. I am thinking of the chinese companies like Alibaba, Tencents etc which surely ignores GDPR. – Per Digre Sep 23 '18 at 7:45
1

Yes the parent company does need to comply with GDPR

To quote the UK information commissioner:

The GDPR applies to processing carried out by organisations operating within the EU. It also applies to organisations outside the EU that offer goods or services to individuals in the EU.

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/key-definitions/

And from the regulation itself:

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union

http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN

(Point 22)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.