The May 25, 2018, compliance effective date of the EU’s General Data Protection Regulation (GDPR) is just weeks away, and many U.S.-based companies have at least by now taken stock of their EU customer base and operations, and developed a baseline set of compliance plans. For many, that might only entail a data inventory and controls that would ensure that changes to the company’s business plan, advertising strategies, and physical footprint would be assessed for GDPR compliance in advance, just as with any other area of compliance. However, for companies whose business relies upon the gathering and use of consumer data, the GDPR implementation process has been onerous.
In particular, as recent American Banker coverage has described, this compliance effort is hitting financial institutions of all sizes hard. While the exact nature and magnitude of enforcement exposure is still unclear, U.S. banks should take a broad view of their overseas business – including where U.S. customers temporarily work or travel – in order to stay ahead of GDPR compliance issues.
For U.S.-based small businesses, including community banks, the conventional wisdom has focused on whether the institution solicits or services EU customers. Unfortunately this approach may cause banks or other businesses to underestimate their potential exposure.
For purposes of the GDPR, compliance obligations for companies without a physical presence in the EU are generally only implicated if the company (1) offers goods and services in the EU or (2) monitors the behavior of EU customers (referred to affectionately as “data subjects” in the regulation).
Of particular concern for community banks is whether tourists, foreign work assignments, or overseas service members could cause the bank to become subject to GDPR obligations.