This Question pertains to the user privacy notice and practices of Ebay, in particular reference to its compliance with the European Data Protection Regulation 2016.
According to Article 27 (Representatives of Controllers or Processors not established in the union), section 3 states that;
The representatives shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behavior is monitored, are.
In layman's terms, this means that any data processor (so someone who will handle any PII data of EU Citizens), must have a representative physically located within the EU. This means that as a Data Controller, Ebay must ensure that any third party companies they pass information to MUST have a representative within the EU, or they are failing their compliance with GDPR.
My Query stems from the Ebay user privacy notice, which seems to attempt to subvert this ruling within its terms and conditions by attempting to convert the Data Subject into a Data Controller at the point of purchase, renegotiating the conditions of any contract and removing Ebay from the position of Data Controller, despite their clear function as such.
When you transact with another user, we enable you to obtain or we may provide you with the personal information of the other user (such as their name, account ID, email address, contact details, delivery and billing addresses) to complete the transaction. Independent from us, you are the controller of such data and we encourage you to inform the other user about your privacy practices and respect their privacy. In all cases, you must comply with the applicable privacy laws, and must give the other user a chance to remove them from your database and them a chance to review what information you have collected about them.
If Ebay is functioning as the Data Controller (after all, they pass your information along to third parties and shipping companies, outside of the EU), how can they legally transfer the role of Data Controller to a Data Subject? It seems as though trying to pass responsibility onto the Buyer is an attempt to transfer liability that the third parties are themselves compliant...?