Someone used my e-mail address to create an account at one on-line service in a country that is not in EU. I told the company about that and they responded with that they have undone that.
But now, I still receive their marketing messages. That means that they still must have my e-mail address. Can I use my right to erasure when I am EU citizen but the company is located outside of it?
Per Art 3(2), GDPR only applies to non-European companies when their processing activities relate to the offering of goods or services to people in Europe, or when the processing activities relate to monitoring people in Europe. However, the word “offer” of this targeting criterion requires some level of intent. It is not enough for GDPR to apply that they're marketing to someone who happens to be in Europe, but GDPR would apply if they are intentionally marketing to people who are in Europe. I don't know what they are marketing, so I don't know if that would be the case here.
Even if GDPR were to apply, it would not be the most appropriate law. Yes, there's the GDPR right to erasure, which applies under some conditions (though there's a pretty absolute right to opt-out from marketing). The EU's ePrivacy Directive provides more specific rules though, in particular that every such marketing email must offer a way to unsubscribe.
Other countries have comparable anti-spam laws, potentially also the home country for this online service.
