EU: Location of data subjects

The EU General Data Protection Regulation (GDPR) uses the factor of the physical location or residency of the data subject to determine its applicability. Specifically, the GDPR applies to the processing of personal data of individuals who are physically present in the EU, regardless of their citizenship or residency status.

Applicability Based on Physical Location

Article 3(2) of the GDPR states:

\"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

• (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
• (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.\"

This provision clearly indicates that the GDPR's applicability is triggered by the physical presence of the data subject within the EU at the time of the relevant processing activity, such as the offering of goods or services or the monitoring of behavior.

Supporting Recitals

Recital 14 further clarifies:

\"The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data.\"

Recital 23 elaborates:

\"In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should be subject to this Regulation where the processing activities are related to the offering of goods or services to such data subjects in the Union or to the monitoring of their behaviour.\"

Conclusion

The GDPR explicitly uses the physical location of the data subject within the EU as a determining factor for its applicability. This ensures that the regulation protects all individuals within the EU, regardless of their nationality or residency status, whenever their personal data is processed in connection with the offering of goods or services or the monitoring of their behavior.