CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ90

European Data Protection: Scope and Accountability

MagicClean is a web-based service based in the United States that connects home-cleaning services with customers. It provides its services only within the United States. It uses a processor based in France to optimize its data.

Is MagicClean subject to the GDPR?

  • A Yes, because MagicClean is processing data in the EU.
  • B Yes, because MagicClean's data processing agreement with the French processor is an establishment in the EU.
  • C No, because MagicClean is located in the United States only.
  • D No, because MagicClean is not offering services to EU data subjects.
Explanation

GDPR territorial scope under Article 3 extends to non-EU controllers only when processing occurs in the context of the controller's own establishment in the Union, or when the controller targets goods or services to, or monitors, data subjects located in the EU. Engaging a data processor located in France does not, by itself, constitute an establishment of the US controller in the EU - it is the processor, not the controller, whose EU presence is relevant to the processor's own obligations. Because the company confines its home-cleaning marketplace service exclusively to the United States and does not offer services to individuals in the EU, GDPR does not apply to it.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!