Editorial · February 26, 2018
GDPR for US Businesses: Does It Apply to You?
GDPR for US businesses is a fair question to ask now, because the rule starts on May 25, 2018. The short answer is yes, it can apply to a US firm. It applies if you sell to people in the European Union, or if you track what they do online. Where your office sits does not decide it.
What the GDPR is
The General Data Protection Regulation is a law of the European Union. The EU adopted it in April 2016. It replaces an older privacy directive from 1995. Unlike a directive, it is binding in full and applies directly in every member state. There is a two-year gap between adoption and start, so firms have time to get ready. That time ends on May 25, 2018.
The law covers personal data. That means any information about a person who can be identified, such as a name, an ID number, location data or an online identifier. It covers almost anything you do with that data, from collecting and storing it to sending it on.
Sources: Regulation (EU) 2016/679, Articles 4 and 99, on EUR-Lex.
How a US firm can fall under it
Article 3 sets the reach of the law. The first test is simple. The law applies when your company keeps an office or branch inside the EU and that site takes part in handling personal data. It does not matter whether the data is handled in the EU or in the United States.
The second test is the one most US firms ask about. It covers a company with no EU base at all. The law still applies to the data of people who are in the EU when your processing is tied to one of two things:
- offering goods or services to those people, whether or not they pay; or
- monitoring their behavior, as far as that behavior takes place in the EU.
Note the wording. The test looks at where the person is, not what passport they hold. A French customer ordering from your US online shop is in scope. A US citizen who is living in Paris counts the same way, because what matters is that the person is in the Union.
Sources: Regulation (EU) 2016/679, Article 3, on EUR-Lex.
Selling to people in Europe
Having a website that people in Europe can open is not enough by itself. The recitals to the regulation say so. They also say that an email address, or a language common in your own country, is not enough proof of intent.
What counts is whether it is clear that you plan to sell to people in the EU. The recitals list signs of that plan. They include using the language or the currency of one or more EU states, and letting people order in that language. Naming customers in the EU is another sign. So a US shop that prices in euros and ships to Germany looks like it is targeting the EU. A US plumber with a plain English site does not.
Sources: Regulation (EU) 2016/679, Recital 23, on EUR-Lex.
Tracking people in Europe
The second trigger is monitoring. The recitals say this includes tracking people on the internet. It also includes later uses of that data to build a profile of a person, for example to predict their tastes, habits or attitudes.
That matters for firms that run ad tracking, analytics tools that follow visitors across pages, or services that score user behavior. If those tools follow people who are in the EU, the law can reach you even if you sell nothing to them.
Sources: Regulation (EU) 2016/679, Article 3(2)(b), Recital 24 and Article 4(4), on EUR-Lex.
What it asks of you, and what is at stake
A US firm that falls under Article 3(2) must name a representative in the EU, in writing. There are exceptions. One covers processing that is only occasional, does not involve large-scale sensitive data, and is unlikely to put people's rights at risk.
The law also expects a firm to tell the supervisory authority about a personal data breach without undue delay. Where it can, that should be within 72 hours of finding out, unless the breach is unlikely to put people at risk.
The penalties are large. For the most serious breaches, a fine can reach 20 million euros, or 4 percent of total worldwide annual turnover for a company, whichever is higher. How regulators will enforce this against firms outside the EU is not yet clear, and no one should plan around that gap.
Sources: Regulation (EU) 2016/679, Articles 27, 33 and 83, on EUR-Lex.
Where to start
You have until May 25, 2018. These first steps are cheap and useful whatever the answer turns out to be:
- List where your customers and site visitors live. Note any who are in the EU.
- List the personal data you hold on them and where it goes, including tools run by other companies.
- Check your sales pages for euro prices, EU languages or EU shipping. Those are signs of targeting.
- Check your analytics and ad tools for tracking of EU visitors.
- Ask a lawyer who knows EU privacy law to confirm whether Article 3 reaches you.
This article is general information, not legal advice. The final answer depends on your facts.
Sources: Regulation (EU) 2016/679, Articles 3 and 99, on EUR-Lex.
Sources
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), EUR-Lex, eur-lex.europa.eu, CELEX 32016R0679.