3 ms·

How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level a

How do GDPR rights work for non citizens? (Ex: in America even non-citizens have constitutional rights while visiting. (This had to be decided at the SC level after some Italian immigrants were roughed up in the 20s and it was argued that's ok since they weren't citizens) Can I book a vacation to Amsterdam, then demand deletion while on EU soil?

pgeorgi 8y ago
GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.
stordoff 8y ago
Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...

pgeorgi 8y ago

GDPR is in effect as soon as one party is within the boundaries of the EU. GDPR covers everybody while in the EU, but doesn't cover EU citizens while abroad and everybody all the time when dealing with a EU company.

stordoff 8y ago

Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or > (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. As I understand it, because 23andMe also provides its service within the EU, the GDPR applies. If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]: > A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR. BUT: > An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes. > In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28. [1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...