If a controller is established in the Union, then the processing of any personal data by that controller, no matter where it occurs and no matter whose, must be in accordance with GDPR. Article 3(1) refers, and Article 3(2) is, in this context, not relevant.

Jon Baines, 
Chair,
nadpo.co.uk

On 5 Jan 2018, at 12:28, Cartwright, Christine <[log in to unmask]> wrote:

Hi all

 

I’ve been asked a question about data sharing with application agents (not based in the EU) with whom we work with at university recruitment fairs around the world, specifically with relation to potential students who have a dual nationality.

 

If, for example, we were at a fair in Brazil and took the details of a potential student who holds a dual citizenship with Portugal but resides in Brazil would we, and by extension the application agent, be required to process their personal data in accordance with GDPR? Thinking about Article 3, which is the closest I can find to guidance on this, does ‘in the Union’ mean they must be physically located in the Union for GDPR to apply or is there a wider scope of interpretation which would mean that anyone of the Union is considered to be in it?

 

Taking this further, if we take their personal data and so are processing the data of a non-resident EU citizen in the EU, does GDPR apply? Para 14 of the preamble, ‘The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data’ would suggest that this is the case.

 

Thoughts on this would be much appreciated as I’ve managed to tie my own in a big knot!

 

With thanks,

Christine

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner [log in to unmask]

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)

All archives of messages are stored permanently and are available to the world wide web community at large at http://www.jiscmail.ac.uk/lists/data-protection.html

Selected commands (the command has been filled in below in the body of the email if you are receiving emails in HTML format):

All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html and are sent in the body of an otherwise blank email to [log in to unmask]

Any queries about sending or receiving messages please send to the list owner [log in to unmask]

(Please send all commands to [log in to unmask] not the list or the moderators, and all requests for technical help to [log in to unmask], the general office helpline)