GDPR rights of person who moves into the EU

Question

Suppose that a person not resident (nor present) in the EU, say in Mexico, obtains services from a provider located in the US, and provides personal information in connection with those services, including filling out a "public profile" giving permission to list specified personal information publicly. Let us further suppose that there was no continuing exchange of information and no continuing provision of services. There was no continuing monitoring of the Data Subject by the provider. Consent was freely given by the person at the time of the original transaction. The only continuing processing of this person's data is to store it, and to make the items previously consented to as public available on the relevant web page.

The provider specifies policies and purposes, and also stores an manipulates the information, and thus it would be both a Controller and a Processor in GDPR terms. The provider does provide services to EU residents, although it is primarily targeted on the US market.

Several years later, the person moves to the EU, say to Spain. Subsequently, the person sends either a data access request fort all information that the provider has on the person, or a "right to be forgotten" request to have all personal information deleted from the provider's records. The person has clearly established that s/he is the same person who provided PI from Mexico years before.

No services have been requested by, or provided to, this person for some years, since before the person was an EU resident. The provider may be providing services to other people who are present in the EU.

Under these circumstances, does the GDPR require the provider to provide the requested information, or to delete information from its records, given that the information was not collected from a person present in the EU at the time of collection?

Answer 1

This is a very interesting question about the territorial scope of the GDPR. As previously discussed on this site and as supported by Art 3(2) GDPR and EPDB guidelines 3/2018, the GDPR only applies to non-EU data controllers for processing activities relating to the offering of goods or services to data subjects in the EU.

Here, the controller offered services to a person not in the EU, who then moved to the EU. The controller is continuing to process personal data of the person who is now in the EU.

But processing data for a service is not the same as offering it. An offer would imply that the controller actively targets persons in the EU, and intends for people in the EU to use their service. The mere availability of a service such as a website is not a targeted offer.

It is not entirely clear whether the data controller is offering services to people in the EU, so let's quickly look at both alternatives.

If the controller isn't targeting people in the EU with their services, the GDPR does not apply, and the right to access or erasure doesn't apply. The controller can reject any such requests.

If the controller is targeting people in the EU, the GDPR does now apply to any processing of personal data relating to this offer of services. Clearly, the GDPR will not retroactively cover processing activities back when the data subject was not in the EU. However, the GDPR might apply to continued processing activities (including continued storage of previously collected personal data), now that the data subject is in the EU. Which processing activities are related to the offering of services would need individual analysis, and it's likely that a court would come to different conclusions than I would.

In practice, a data controller would likely avoid the difficulty of trying to untangle which processing activities are subject to GDPR, and either clearly avoid GDPR obligations for all their processing activities, or fully comply with GDPR for all processing activities relating to an EU data subject. E.g. one data controller might terminate or suspend the service when the data subject has permanently moved to the EU, whereas another might migrate user data to an EU data centre when the user updates their location.