5

If a Californian resident is travelling within the EU, it seems both European GDPR and Californian CCPA privacy laws will apply.

Sometimes businesses have single privacy emails, so if a deleting request is sent how is it responded to? As a CCPA request or GDPR request?

CCPA has some differences with GDPR; probably records kept for CCPA requests will be different from those of GDPR. So which law will be applied?

(Though not a part of the question, what if this person has dual citizenship of a third country that has different privacy laws? It would be helpful if someone could answer this last question too; it is not required but will be helpful.)

This is in response to a comment seeking differences:
Firstly a difference would be records for accountability . Obviously records to be maintained for ccpa should be separate given the format and laws . Secondly for gdpr there is an obligation tell about E.U. authorities that in my non lawyer knowledge is not required for ccpa .

3
  • GDPR and CCPA are quite large and contain many provisions, so it may help others to give a focussed answer if you identify and cite the apparent differences that concern you.
    – user35069
    Feb 7, 2021 at 14:49
  • Regarding dual citizenship, if the hypothetical were different (California and Ontario, for example) and the "third country" were an EU member state, GDPR would not apply, because the citizenship of the data subject is irrelevant to the GDPR. I am not aware of any country whose privacy laws would apply in an analogous situation, but I wouldn't necessarily be.
    – phoog
    Feb 7, 2021 at 15:41
  • There seem to be more differences than I state in my non lawyer knowledge . Feb 7, 2021 at 17:15

1 Answer 1

13

It is not an either–or. You may have certain rights under both CCPA and GDPR, but they have rather different mechanisms for determining their scope.

When does the CCPA apply?

CCPA applies to certain businesses and consumers. It covers any business (regardless of legal structure) that that does business in the State of California and has a certain scale. A consumer means a natural person who is a California resident.

These aspects are not influenced by your current location. When you as a California resident travel to the EU, you still have all your CCPA rights against businesses that do business in California. You do not have any CCPA rights against businesses that don't do business in California, for example a national rail company in the EU you've bought a train ticket for.

When does the GDPR apply?

Whereas the location of the user/data subject can be a factor in the GDPR context, their residency or nationality does not.

The GDPR applies to all processing activities by data controllers who are established in the EU, including any businesses, non-profits, and individuals. This includes processing activities in the context of an EU establishment of a non-EU company. For example, GDPR would apply with respect to processing of personal data by a hotel you're staying at in the EU.

The GDPR also applies to non-EU data controllers in the context of (a) offering goods or services to people who are in the EU, or (b) monitoring behaviour of people who are in the EU. Here, “offering” does not mean “doing business”, but “targeting or marketing”. For example, you might have installed a smartphone app that assists with sightseeing while in Paris. If this app monitors your behaviour while you are in the EU (such as by tracking your GPS position to alert you to nearby points of interest), that would fall under the GDPR while you are in the EU. The app may also fall under the GDPR per case (a) if it is marketed to / targeted at people who are currently in Paris.

That the GDPR applies in such cases comes from the offering/monitoring while you are in the EU, not from your continued presence in the EU. You would be able to exercise your GDPR rights relating to this processing even after leaving the EU.

Note that some service or processing activity can fall under CCPA and GDPR simultaneously. For example, this app would also fall under CCPA if the company also does business in California, e.g. if it also provides sightseeing information for Los Angeles or San Francisco. And both CCPA and GDPR could apply when an EU company does business in California.

Under which privacy law would a deletion request be dealt with?

In practice, most companies don't have this sorted out properly and results are unpredictable. Ideally, a company would just comply with both laws simultaneously, thus making it unnecessary to determine which law applies. Information that is only required under on law can be provided with conditional statements, e.g. “If this processing activity is covered by GDPR, you have the right to lodge a complaint with the supervisory authority in your country”.

As mentioned above, both laws can apply simultaneously. Whether GDPR applies and whether CCPA applies are independent questions. However, the answer to neither of these depends on your current location at the time of making the request.

In this answer, any statement about the EU applies equivalently to the UK.

2
  • If request is sent to DPO specially appointed for GDPR can it be assumed it is a GDPR request ? Feb 8, 2021 at 3:30
  • @scientist Not quite. Under GDPR: the data controller should facilitate exercise of GDPR rights. What this means is subject to interpretation, but regulators generally think: (1) If a data subject sends a request to the wrong place, staff should be able to recognize this and forward it internally to the right place. (2) It is not necessary to mention GDPR in the request. Under CCPA: the business must make available two or more designated methods for making requests. I don't think other methods have to be respected.
    – amon
    Feb 8, 2021 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .