4 ms·
Citizenship and residency (of data subjects) doesn't come in to the GDPR at all. If the data controller/processor is in the EU, the GDPR applies. If the data
by M2Ys4U 6y ago
Citizenship and residency (of data subjects) doesn't come in to the GDPR at all.
If the data controller/processor is in the EU, the GDPR applies.
If the data subject is physically located in the EU (even if not a citizen or resident) then the GDPR applies.
- tremon 6y agoOne minor correction: If the data subject is physically located in the EU (even if not a citizen or resident) and the data controller purposefully targets data subjects in the union, the GDPR applies. As per [0]: the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention [0] https://gdpr.eu/Recital-23-Applicable-to-processors-not-established-in-the-Union-if-data-subjects-within-the-Union-are-targeted/ https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta...
- M2Ys4U 6y agoThat's right, although Recital 23 continues on to say "factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."
- jnxx 6y agoThe legal text: https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX:02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746... Article 3.