5

This grows out of a comment in the question Who Has the Right to Access State Voter Records and How May That Right be Expediently Exercised?

If a US citizen is currently resident in the EU, can that person use a GDPR request to the proper government agency (state board or elections or a similar agency) to obtain that person's own voter record and whatever other information about that person the agency may have in its files?

2
  • What about the converse, with a US/EU dual citizen living in America?
    – nick012000
    Dec 25 '20 at 10:28
  • 1
    @nick012000 5 The GDPR doesn't care about citizenship. t applies to people preset in the EU, citizen or not. It does not apply, by its own terms to people not currently in the EU, whatever their nationality. A person not in the EU requesting info from a controller and processor not in the EU cannot use the GDPR. Dec 25 '20 at 15:48
7

I suspect that US voting records would fall under Article 2(2)(a):

Article 2

Material Scope

...

  1. This Regulation does not apply to the processing of personal data:

    (a) in the course of an activity which falls outside the scope of Union law;

I doubt it would be possible to argue successfully that a foreign election is anything other than "an activity which falls outside the scope of Union law."

Even the territorial scope could be questioned. This is set forth in the next article, on "territorial scope," the second item of which says:

  1. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

    (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

    (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

It is probably arguable whether processing absentee ballots from EU residents constitutes "offering services to data subjects in the Union," but in this case it's likely to be more difficult to resolve that question than to determine whether the activity falls outside the scope of Union law.

2

In most US states, information on one's own voter information, including registration details and voting record, is available from the state without any need to invoke the GDPR, for any registered voter. For example, in Maryland one can visit this web page to request from the state Board of Elections one's voter registration record, and various other information. Most US states also have a state Freedom of Information law, and it can be used to request information which is a matter of public record, which voter registration information and voting history is. The exact procedures and costs will vary from state to state.

3
  • 2
    But GDPR imposes other obligations on the data processor and controller, in addition to the obligation to grant the data subject access to the data, so the question of whether the GDPR applies is not rendered irrelevant even where state law gives voters access to their records.
    – phoog
    Dec 23 '20 at 18:47
  • @phoog Quite true. I suspect no US state would honor a "right to be forgotten" request to erase a voter registration record, for example. Indeed it is probably illegal to erase such a record. Dec 23 '20 at 18:52
  • I was thinking more about administrative requirements, for example concerning the data protection officer.
    – phoog
    Dec 24 '20 at 23:40
1

The Eleventh Amendment to the US Constitution has been interpreted (by the Supreme Court) as conferring a significant degree of sovereign immunity on the states. US courts will generally not award money damages or injunctive relief against US states unless they have waived immunity by state law. By itself, this already takes most of the teeth out of GDPR, since its remedies are basically all fines. While the European court system might refuse to recognize such immunity, and purport to issue judgments against individual states, such judgments would have no practical effect unless the US court system were willing to recognize the fines as valid.

Under Ex parte Young, the Supreme Court held that state officials may be enjoined from enforcing unconstitutional state laws, under the legal fiction that such enforcement is not an official act when the underlying policy is unconstitutional. One might therefore imagine trying to obtain injunctive relief indirectly. I doubt this would be successful. The US has no federal equivalent to GDPR and has not signed any sort of treaty or agreement with the EU regarding its applicability to the states. As a result, the Supremacy Clause is inapplicable, and there's no obvious line in the Constitution saying that states are required to respect extraterritorial foreign laws.

Such enforcement also raises significant separation of powers concerns. The US President enjoys more or less plenary power over diplomacy and foreign relations, with the sole exception of treaty ratification. If a US court were to apply a foreign law to a US state, this would interfere with the ability of the executive to negotiate a treaty to that effect. As a result, the state would likely argue that applicability of foreign laws is a political question to be resolved by treaty or federal law, and not by the court system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.