Re: [projectvrm] GUARDIAN: Facebook moves 15 billion users out of reach of GDPR

[Rob van Eijk < >]

I agree that the question about material scope is not an easy question
to answer. There are edge cases. The material scope of the GDPR is
addressed in Article 3 and Recitals 22, 23, 24, and 25. Below I included
the GDPR-text because it contains some interesting details that may be
relevant for the discussion.

Rob


Article 3 sub 1 ("Location of the company"):
This Regulation applies to the processing of personal data in the
context of the activities of an establishment of a controller or a
processor in the Union, regardless of whether the processing takes place
in the Union or not.

Article 3 sub 2 ("Location of the data subject"):
This Regulation applies to the processing of personal data of data
subjects who are in the Union by a controller or processor not
established in the Union, where the processing activities are related to:
    (a) the offering of goods or services, irrespective of whether a
payment of the data subject is required, to such data subjects in the
Union; or
    (b) the monitoring of their behaviour as far as their behaviour
takes place within the Union.

Article 3 sub 3 ("Member state law, even outside of the EU"):
This Regulation applies to the processing of personal data by a
controller not established in the Union, but in a place where Member
State law applies by virtue of public international law.

Recital 22:
Any processing of personal data in the context of the activities of an
establishment of a controller or a processor in the Union should be
carried out in accordance with this Regulation, regardless of whether
the processing itself takes place within the Union. Establishment
implies the effective and real exercise of activity through stable
arrangements. The legal form of such arrangements, whether through a
branch or a subsidiary with a legal personality, is not the determining
factor in that respect.

Recital 23:
In order to ensure that natural persons are not deprived of the
protection to which they are entitled under this Regulation, the
processing of personal data of data subjects who are in the Union by a
controller or a processor not established in the Union should be subject
to this Regulation where the processing activities are related to
offering goods or services to such data subjects irrespective of whether
connected to a payment. In order to determine whether such a controller
or processor is offering goods or services to data subjects who are in
the Union, it should be ascertained whether it is apparent that the
controller or processor envisages offering services to data subjects in
one or more Member States in the Union. Whereas the mere accessibility
of the controller's, processor's or an intermediary's website in the
Union, of an email address or of other contact details, or the use of a
language generally used in the third country where the controller is
established, is insufficient to ascertain such intention, factors such
as the use of a language or a currency generally used in one or more
Member States with the possibility of ordering goods and services in
that other language, or the mentioning of customers or users who are in
the Union, may make it apparent that the controller envisages offering
goods or services to data subjects in the Union.

Recital 24:
The processing of personal data of data subjects who are in the Union by
a controller or processor not established in the Union should also be
subject to this Regulation when it is related to the monitoring of the
behaviour of such data subjects in so far as their behaviour takes place
within the Union.

Recital 25:
Where Member State law applies by virtue of public international law,
this Regulation should also apply to a controller not established in the
Union, such as in a Member State's diplomatic mission or consular post.
In order to determine whether a processing activity can be considered to
monitor the behaviour of data subjects, it should be ascertained whether
natural persons are tracked on the internet including potential
subsequent use of personal data processing techniques which consist of
profiling a natural person, particularly in order to take decisions
concerning her or him or for analysing or predicting her or his personal
preferences, behaviours and attitudes.


Op 19-4-2018 om 17:38 schreef elliot noss:
> Hi Tim,
>
> I took a quick look at your linkedin and did not see a legal background. 
> You may be right. But, that is not the view of our inhouse counsel, our 
> external counsel, two separate legal positions that have been provided 
> (publicly) to ICANN, nor the view of DPAs who have come to successive ICANN 
> meetings.
>
> I would also distinguish (in the example in your article) between an EU 
> citizen passing through the US and an EU citizen living there. If you were 
> responding here to the EU citizen traveling through the airport than I 
> agree and my reference was confusing.
>
> Most importantly, the general approach is that questions like this (and 
> there are MANY) will not be answered dispositively until something is 
> challenged and takes the five years or so that it will take to get to the 
> highest European court. This really requires companies to take a 
> conservative view.
>
> EN
>
>> On Apr 19, 2018, at 10:05 AM, Tim Walters 
>> <
 >
>>  wrote:
>>
>> Sorry, Elliot, that's not correct. The GDPR does not apply to EU citizens 
>> (living outside of the EU). I wrote about it here: 
>> https://www.linkedin.com/pulse/three-biggest-lies-gdpr-tim-walters-ph-d-/
>>
>> tw
>>
>> On Thu, Apr 19, 2018 at 3:48 PM, elliot noss 
>> <
 >
>>  wrote:
>> I cannot imagine how they can do this without massive tax implications. I 
>> also think they cannot avoid the “ex-pat European problem” (an eu citizen 
>> living in the us is covered). 
>>
>> Sent from my iPhone
>>
>>> On Apr 19, 2018, at 9:43 AM, Doc Searls 
>>> <
 >
>>>  wrote:
>>>
>>> 1.5, but yeah. That’s pretty much the whole thing, after you subtract out 
>>> the fake accounts.
>>>
>>> This, of course, is one gigantic hunk of evidence that Facebook gives the 
>>> opposite of a shit about privacy. Linkedin too. Also the U.S. government, 
>>> whose oversight of all this resembles something between sleep and death.
>>>
>>> Doc
>>>
>>>> On Apr 19, 2018, at 9:28 AM, Joyce Searls 
>>>> <
 >
>>>>  wrote:
>>>>
>>>> https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law
>>

Attachment: signature.asc
Description: OpenPGP digital signature