Is the local presence of a foreign non-GDPR state a data controller subject to the provisions of the Data Protection Act 2018?

Question

Consider that state X is not subject to the gdpr, however, it has a diplomatic presence in the UK.

If the state were a tech company that operated in or even simply offered services to people in, the UK, then they would be data controllers and bound by the DPA2018.

Now what of a sovereign state?

And if having a diplomatic mission in the UK which serves British-resident own-citizens does create data protection duties, what actually is the data controller and how far does it extend? For example, would the diplomatic mission in the UK render the department of the represented state responsible for international relations (eg its foreign ministry) a data controller? Or the entire represented sovereign state itself?

Further, if it were to be considered a data controller, what particular exemptions would be applicable to its data protection obligations?

For example, data can be exempt from subject access rights if it is held for law enforcement reasons, but are there special exemptions for data processing for the purpose of diplomatic functions as well?

Are there requirements under the GDPR for the diplomatic mission to tell you what they may and may not share about you with their hosting state?

Answer 1

No

Article 2 sets out the scope of the GDPR. Relevantly:

2. This Regulation does not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law;

Processing by a foreign government under foreign law is outside the scope of Union law.

Answer 2

local presence of a company or Data Controller

It doesn't matter if your company (or other data controller) is in the UK or EU. It matters if the data subject is in it, and that you offer any service in the EU - even if it is your website. Now it can matter what kind of service you offer, but in general, the moment you control data from the area and offer service to it, you made yourself subject to GDPR by controlling their data.

The GDPR applies to:

2. a company established outside the EU and is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU.

Now, we have a local branch office... and that makes it guaranteed applicable:

The GDPR applies to:

1. a company or entity which processes personal data as part of the activities of one of its branches established in the EU, regardless of where the data is processed;

Countries can only be sued if they allow it

Now it gets wonky: nowhere in the GDPR or UK-GDPR there is any mention of countries. Why? Because countries can't legislate other countries. If Datatistan offers a service to EU citizens, it can't be prosecuted by a GDPR country if they mess with the data in noncompliant ways, as states can't prosecute other states in their own justice system. That's not diplomatic immunity, it's part of the customary Sovereign Immunity. In other words: nobody can sue or prosecute a foreign state unless they agree to it.

The consulate or embassy is an arm of the state. Its officers, the consul, the ambassador, and many employees are covered by Diplomatic Immunity and can't be effectively prosecuted either. And then there's the problem that on the grounds of the embassy (but not the consulate) the host state can't enforce its own laws without the ambassador allowing it.

It's incredibly hard to sue states - and so far the only political institution sued under GDPR is the European Commission itself in July of 2022 - though that case isn't even out of the preliminary phase that establishes it can even be sued under GDPR, and it's not a country in its own. Against a non-GDPR country... what venue do you want to use? The EUCJ can't adjudicate a foreign non-GDPR state because it is out of the jurisdiction to be sued there. The Country that is non-GDPR doesn't have the GDPR that would allow you to sue the country.

Many uses for PII of a country are exempt anyway

§2 This Regulation does not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law;

(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

A foreign country doing foreign intelligence or even any other use of PII under its own laws is wholly encompassed under (a) and using it for crime prevention is under (d) anyway. Which includes for example handling and issuing of travel documents for public security grounds.