CIPP-E · Question #155
Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as…
The correct answer is D. It monitors the behavior of data subjects in the European Union. According to the GDPR, the territorial scope of the regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods…
Question
Bioface is a company based in the United States. It has no servers, personnel or assets in the European Union. By collecting photographs from social media and other web-based services, such as newspapers and blogs, it uses machine learning to develop a facial recognition algorithm. The algorithm identifies individuals in photographs who are not in its data set based the algorithm and its existing data. The service collects photographs of data subjects in the European Union and will identify them if presented with their photographs. Bioface offers its service to government agencies and companies in the United States and Canada, but not to those in the European Union. Bioface does not offer the service to individuals. Why is Bioface subject to the territorial scope of the General Data Protection Regulation?
Options
- AIt collects data from European Union websites, which constitutes an establishment in the
- BIt offers services in the European Union by identifying data subjects in the European Union.
- CIt collects data from subjects and uses it for automated processing.
- DIt monitors the behavior of data subjects in the European Union.
How the community answered
(52 responses)- A23% (12)
- B15% (8)
- C8% (4)
- D54% (28)
Explanation
According to the GDPR, the territorial scope of the regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behavior as far as their behavior takes place within the Union. In this scenario, Bioface is not established in the Union, but it is collecting photographs of data subjects in the Union and using a facial recognition algorithm to identify them. This constitutes monitoring of their behavior within the Union, and therefore triggers the application of the GDPR.
Topics
Community Discussion
No community discussion yet for this question.