0

Imagine a website which requires users to register in order to use all its features. In order to avoid exposure to GDPR complains, would any of the following tactics work?

  • Ask the user for their country of residence, and offer a list with EU countries not in it

  • Ask the user for their country of residence, and display an error message if an EU country is selected

Practically, suppose a certain John Smith from Germany registers as John Smith from Arizona, US, and then requests a copy of their personal data under GDPR right of access, or complains about the collected data being excessive. Could his request/complain be dismissed on the ground that the website doesn't have any data concerning John Smith from Germany?

Improve this question

1 Answer 1

Reset to default
3

Whether GDPR applies does not depend on the country of residence. Instead, GDPR applies to a non-EU site or service if the data controller offers products or services to people in the EU (see Art 3(2) GDPR). This depends solely on the behaviour and intent of the data controller / the provider of the website – compare also the discussion of the “targeting criterion” in EDPB guidelines 3/2018 on the territorial scope of the GDPR.

While your proposed measures might not be entirely ineffective (in that they document an intent to not serve people in the EU), they are both unnecessarily restrictive and overly lax. For example, they would unnecessarily prevent EU tourists in the US from registering but would nevertheless allow US tourists in the EU. For the targeting criterion, it matters whether the data subject is in the EU at the time of the offer, not at all what their residency is. Even if a person who is currently in the EU registers with your service, that doesn't necessarily mean that you are targeting people in the EU.

Instead of implementing signup restrictions, a better strategy might be to clarify in the copy on your website that you are only targeting the domestic US market, not the European market with your services. I have discussed this in more detail in an answer to “How can you block GDPR users from US based sites?”

If you have a site where GDPR doesn't apply, and you receive a GDPR data subject request, you shouldn't deny it on the basis that the user must have lied – instead you can deny it on the basis that GDPR just doesn't apply to you.

Improve this answer
2
  • Your linked answer seems to say that simply claiming the website only targets US market isn't enough. For instance, "activity of international interest" can be interpreted very broadly: essentially any forum on sports/kids/cooking/cars/whatever could be of interest to anyone, even if it's in English only.
    – Dmitry Grigoryev
    Dec 28, 2020 at 11:12
  • 1
    @Dmitry I had incorrectly summarized the EDPB guidance, it should say “international nature” instead of “international interest”. The EDPB guidance is in turn based on the Pammer and Alpenhof cases, an important ruling in EU consumer protection law that discussed when a website targets consumers in other countries. In any case, this list of factors is merely indicative, and whether GDPR might apply would depend on the specific factors of the case.
    – amon
    Dec 28, 2020 at 12:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .