3 ms·
Article 3 of the GDPR defines territorial scope: > This Regulation applies to the processing of personal data of data subjects who are in the Union by a contro
by stordoff 8y ago
Article 3 of the GDPR defines territorial scope:
> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
> (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
> (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
As I understand it, because 23andMe also provides its service within the EU, the GDPR applies.
If they solely offered their service in the US, it's more tricky. Just being in the EU does not _necessarily_ mean the GDPR applies. Consider the following two examples[1]:
> A U.S. citizen is travelling through Europe during his holidays. While in Europe, he downloads and uses a news app that is offered by a U.S. company. The app is exclusively directed at the U.S. market. The collection of the U.S. tourist's personal data via the app by the U.S. company is not subject to the GDPR.
BUT:
> An app developer established in Canada with no establishment in the Union monitors the behaviour of data subject in the Union and is therefore subject to the GDPR, as per Article 3(2)b. The developer uses a processor established in the US for the app optimisation and maintenance purposes.
> In relation to this processing, the Canadian controller has the duty to only use appropriate processors and to ensure that its obligations under the GDPR are reflected in the contract or legal act governing the relation with its processor in the US, pursuant to Article 28.
[1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_3_2018_territorial_scope_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_gu...