Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?
Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?
The extraterritorial effect of the GDPR, as specified by Article 3, is triggered by the processing of personal data of data subjects who are in the EU by a controller or processor not established in the EU, where the processing activities are related to either the offering of goods or services to such data subjects in the EU or the monitoring of their behavior as far as their behavior takes place within the EU. The most likely scenario to trigger this effect is when a non-EU business targets EU customers, because it directly involves offering goods or services to individuals in the EU.
If a non EU business processes EU data incidentally and without targeting EU customers, the GDPR does not apply. Therefore B is not a given. If a business specifically targets EU customers, the GDPR *always* applies. Therefore D is the correct answer.
agreed, the correct answer is D
Option D is the most likely to trigger the extraterritorial effect of the GDPR, as specified by Article 3, because it involves a non-EU entity engaging in activities (processing personal data of EU residents) that directly target individuals within the EU.
If a business specifically targets EU customers, the GDPR *always* applies. Therefore D is the correct answer.
B is the right answer because targeting EU 'residents' is n ot the same as 'EU citizens'