The May 25, 2018, compliance effective date of the EU’s General Data Protection Regulation (GDPR) is just weeks away, and many U.S.-based companies have at least by now taken stock of their EU customer base and operations, and developed a baseline set of compliance plans. For many, that might only entail a data inventory and controls that would ensure that changes to the company’s business plan, advertising strategies, and physical footprint would be assessed for GDPR compliance in advance, just as with any other area of compliance. However, for companies whose business relies upon the gathering and use of consumer data, the GDPR implementation process has been onerous.
In particular, as recent American Banker coverage has described, this compliance effort is hitting financial institutions of all sizes hard. While the exact nature and magnitude of enforcement exposure is still unclear, U.S. banks should take a broad view of their overseas business – including where U.S. customers temporarily work or travel – in order to stay ahead of GDPR compliance issues.
For U.S.-based small businesses, including community banks, the conventional wisdom has focused on whether the institution solicits or services EU customers. Unfortunately this approach may cause banks or other businesses to underestimate their potential exposure.
For purposes of the GDPR, compliance obligations for companies without a physical presence in the EU are generally only implicated if the company (1) offers goods and services in the EU or (2) monitors the behavior of EU customers (referred to affectionately as “data subjects” in the regulation).
Of particular concern for community banks is whether tourists, foreign work assignments, or overseas service members could cause the bank to become subject to GDPR obligations.
A company “offers goods and services” in the EU if a company “envisages offering services to data subjects in one or more Member States in the Union.” The regulation stipulates that the “mere accessibility” of a company’s or an intermediary’s website in the EU, of an email address or of other contact details, or the use of a language generally used in the company’s home country “is insufficient” to establish a company’s intention to offer services in the EU.
On the other hand, factors “such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the [provider] envisages offering goods or services to data subjects in the Union.” A company “monitors the behavior” of persons in the EU if the persons are “tracked on the internet” for the purposes of “profiling” them — where “profiling” means “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.”
Among many aspects of the application of the GDPR that are unclear at this point, whether a bank’s website or marketing practices constitute the offering of goods and services or monitoring behavior in the EU is anything but a bright-line test. When a U.S. citizen travels to the EU, access to a bank’s online banking systems is likely a technical trigger for GDPR compliance. Similarly, although a U.S. military installation in the EU is unlikely to be within the reach of the GDPR, servicemembers and their families may live and work off of their duty stations.
As a stopgap measure, community banks who are already monitoring IP address and other geo-location analytics for fraud or other risks may have the tools necessary to limit or at least monitor GDPR exposure for EU travelers.
We are aware of institutions that are limiting or disallowing services where customer log-ins are known to be from the EU until they can achieve GDPR compliance – this seems like an extreme result and possibly one that creates bigger problems under U.S. laws – but this speaks to concerns over a regulation that some are saying will change or has already changed the web.