Which of the following would MOST likely trigger the extraterritorial effect of the GDPR, as specified by Article 3?

Question

Options

• AThe behavior of suspected terrorists being monitored by EU law enforcement bodies.
• BPersonal data of EU citizens being processed by a controller or processor based outside the EU.
• CThe behavior of EU citizens outside the EU being monitored by non-EU law enforcement bodies.
• DPersonal data of EU residents being processed by a non-EU business that targets EU customers.

• A
  11% (6)
• B
  84% (48)
• C
  4% (2)
• D
  2% (1)

Explanation

According to Article 3(1) of the GDPR1, personal data shall be processed in any member state only on the basis of a decision taken at a Union level that is binding for that member state, unless it is derogated from by national law. This means that the GDPR applies to any processing of personal data within the EU, regardless of where the controller or processor is located, as long as it is based on a decision made at a Union level that is binding for that member state. Therefore, option B would most likely trigger the extraterritorial effect of the GDPR, as it involves personal data of EU citizens being processed by a controller or processor based outside the EU, which may be subject to a decision made at a Union level that is binding for that member state. Option A would not trigger the extraterritorial effect of the GDPR, as it involves monitoring suspected terrorists, which is not considered processing under Article 4(1) and (2) of the GDPR. Monitoring may fall under other legal frameworks, such as national security or counter-terrorism laws. Option C would not trigger the extraterritorial effect of the GDPR, as it involves monitoring EU citizens outside the EU by non-EU law enforcement bodies, which may not be subject to any decision made at a Union level that is binding for that member state. Option D would not trigger the extraterritorial effect of the GDPR, as it involves processing personal data of EU residents by a non-EU business that targets EU customers, which may not be subject to any decision made at a Union level that is binding for that member state.

No community discussion yet for this question.