Annoyingly it's hard for me to find a citation that says "yes, obviously 'in the union' means the EEA as well", but there's no "most likely" about it. It seems

Annoyingly it's hard for me to find a citation that says "yes, obviously 'in the union' means the EEA as well", but there's no "most likely" about it. It seems it has for some time been a foregone conclusion that GDPR will be part of the EEA agreement and the relevant nations are already working to integrate it into their national code of laws. It's hard to find out whether that process is complete in Iceland because I don't speak Icelandic and the parliament doesn't translate everything they produce, but the EU has already started telling people that GDPR protects everyone in the EEA: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-sme-obligations_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... (Page 15, yellow box) More links on the subject: https://www.personuvernd.is/ny-personuverndarloggjof-2018/ https://www.personuvernd.is/ny-personuverndarloggjof-2018/ https://chaucer.com/rights-and-scope-of-gdpr-for-non-eu-residents/ https://chaucer.com/rights-and-scope-of-gdpr-for-non-eu-resi... https://planit.legal/blog/en/the-applicability-of-the-gdpr-within-the-eea/ https://planit.legal/blog/en/the-applicability-of-the-gdpr-w...