0

If I have a database with EU citizens on it, but they provide their American data (American address, phone number, email, etc.), am I bound to GDPR?

  • Why would you be? More importantly, how would you be? You'd have to be able to know whether you're breaking a law before you can reasonably get in trouble for breaking it. – cHao Jun 22 '18 at 16:05
  • @cHao, if you don't know the answer, you're not helping. I don't need more speculation. I need an actual answer. Am I bound under GDPR to be GDPR compliant with an EU citizen's American data or not? – jacobhobson Jun 22 '18 at 16:12
  • This is a legitimate problem I'm having, so I find it interesting that someone would downvote my just as legitimate question. I guess some people don't like questions they don't think I should have to deal with. Guess you're not me! And guess you're not good at helping people! This is why the law stackexchange will never take off. – jacobhobson Jun 22 '18 at 16:14
  • I didn't downvote. I can, if you like. But either way, the question stands. What info that you have access to would tell you that these American addresses, phone numbers, etc belong to EU residents? (I personally believe that the GDPR is unenforceable for this precise reason among others. But either way, it's only enforceable if you could know you're dealing with an EU resident's data.) – cHao Jun 22 '18 at 16:24
  • "it's only enforceable if you could know you're dealing with an EU resident's data." That'd be the answer if you could prove that's true lawfully. That's my first guess, but I've found no evidence that I can stand on that. – jacobhobson Jun 22 '18 at 16:37
0

This is Art. 3(2) GDPR:

  1. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

    (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

So whether someone is an EU citizen, is not relevant. If an EU citizen is in America, the GDPR does not apply.

However, it does apply to American citizens who are visiting the EU, when (a) or (b) above applies. But it only applies for all data processing performed during that visit.

So if someone has an US address and phone number is not enough to determine whether the GDPR does apply. But recital 23 clarifies (a) a bit;

[...] In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. Whereas the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

  • I am not sure if this answers your question, please clarify if not. – wimh Jun 23 '18 at 21:04
  • 1
    very helpful. I'll mark as the answer. I'm too noob to upvote ;) – jacobhobson Jun 25 '18 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.