1

This is hypothetical and it's only meant to ask about the extent of the law, not ask for a particular legal advice.

Let's say a US merchant's website uses exclusively regional US banks. Because they are regional, the banks can provide all electronic services of any national bank, but do not have any international presence.

If any of the visitors to the site happen to be from outside of the US, a disclosure appears stating that the website elects to NOT COMPLY with GDPR. This may get the operators of the site in legal trouble in the EU, but they are confident that they remain on solid legal ground within the framework of the US law. And they are also confident that, as a result, GDPR is unenforceable against them.

Can the site's payment processors (or any other vendors) be liable if any legal authority in the EU decides to pursue this case in order to establish a legal principle or even to simply make an example of the site's non-compliance?

1

The data controller would be responsible for compliance, not its subcontractors or vendors. But this is theoretical, since GDPR is unlikely to apply in any case.

There are two cases to consider here: either the US merchant is subject to the GDPR, or it isn't.

  • If the merchant is not subject to the GDPR, then they can't violate the GDPR and there is no reason for authorities to pursue anyone else either. Whether some processing of personal data is subject to the GDPR depends solely on the data controller, who determines the purposes and means of processing. This does not depend on where, how, or by whom their processing activities are carried out.

  • But if the merchant (data controller) is subject to the GDPR, they have various responsibilities, for example only outsourcing activities to vendors or “data processors” that contractually guarantee certain data protection aspects. If the data controller fails to enter into such contracts, that's alone the data controller's fault.

    On the other hand, a vendor cannot claim processor status without such a contract. They might otherwise be a data controller of their own. But this is very unlikely to be the case in this scenario, or more precisely: they are quite likely to be out of scope for the GDPR.

To determine whether data controllers (the merchant, and maybe their vendors) are subject to the GDPR, it is not sufficient to look at their disclosures. A controller can't “elect to not comply”, just as you can't “elect” not to pay taxes. Instead, the main question for non-European data controllers is whether they offer goods or services to people in Europe. Here, “offering” means an active intention such as targeting or marketing towards, or at least a reasonable expectation that there will be substantial amounts of users who are in Europe. Unless the merchant starts accepting Euros or advertises their shipping rates for customers in the EU, they are unlikely to fulfill this targeting criterion. Similarly, the regional US banks clearly do not target European customers, even if they process the occasional wire transfer to or from such people.

A vendor or service that wants to protect themselves could proactively require all its customers to enter into a GDPR-style data processing contract, though this is generally unnecessary. It's also unsuitable when the service needs to use the personal data for their own purposes. For example, a payment processor generally won't bind itself as a data processor, and needs to be a controller themselves.

Vendors should still take reasonable care and do due diligence regarding to how they perform their services. If they notice that they have a lot of European data subjects, it might be the time to start asking questions about whether GDPR would apply. I know of at least one company that got in trouble for offering services to people in Europe while claiming that it “did not know” that GDPR applied.

In this answer, “Europe” means EU/EEA/UK as appropriate.

8
  • what do you mean "they can't elect to not comply." Of course, they can. They can't do it without violating GDPR. The question is whether the willful violation of GDPR puts their vendors in jeopardy. And yes, this would be a US merchant deliberately and overtly disregarding EU's laws while servicing customers located in EU. And I didn't mean that regional banks would be used for payment processing. I mean that they would be the only types of banks used for regular business banking. Obviously, the fund processors would be international, but they would deposit the funds in the US banks.
    – grovkin
    Aug 25 at 20:17
  • Can you elaborate by what you mean that a company "got in trouble?" I am asking about a situation in which a US merchant willingly, and flagrantly, accepts a criminal status from the EU view while being in complete compliance with the US laws. Would that put the merchant's vendors in jeopardy?
    – grovkin
    Aug 25 at 20:23
  • @grovkin Under GDPR, data processors are not liable for GDPR violations by their data controllers. But as I discuss in my answer, some vendors might not have data processors status, would then be data controllers of their own, and therefore would be responsible for GDPR compliance.
    – amon
    Aug 25 at 20:38
  • 1
    There's realistically not a lot the EU can do to enforce against a US company without any European presence, though it may be possible to block/garnish some payment flows. The example I mentioned about “getting into trouble” was Disqus, which had enabled a GDPR-compliance mode when accessed from Europe, but forgot to enable this mode for one country (Norway). The fine in that case isn't final and hasn't been paid yet, though I expect that Disqus will eventually pay. No vendors/processors are involved in that example.
    – amon
    Aug 25 at 20:39
  • as a btw, there is a clear distinction between electing to violate GDPR and electing to not pay taxes. I am fairly certain that the US would NOT extradite anyone solely to be prosecuted for violating GDPR. And I would think that the US would extradite someone to stand trial for tax evasion. From what I have learned on this site, extraditions are usually only granted if a similar action is also a crime in the country in which the person is located. GDPR would be unconstitutional and would likely be considered unethical in the US.
    – grovkin
    Sep 12 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.