united-states european-union gdpr
GDPR, email lists, a few email subscribers in the EU
<p><strong>Situation:</strong></p>

<p>Say you are an organization that regularly sends out e-newsletter updates to an email list that has been curated over the years by people signing up at events and/or through online sign-up forms. You are based in the US and most of the members of your email list are in the US, but a significant plurality are from abroad and a substantial number of those individuals reside in the EU. The GDPR is thus triggered for you (meaning you must comply). </p>

<p><strong>Question:</strong></p>

<p>Does this situation trigger the GDPR obligations (for example, the rights afforded to data subjects, the steps taken to protect their data, etc.) for <em>every member of your email list regardless of where they live/reside/are</em> or just for those individuals on your email list who are in/live in/were in EU at the time they signed up?  </p>

<h1>Yes, it triggers the GDPR obligations</h1>

<p>Considerations:</p>

<ol>
<li><p>Can you surely identify those residing in Europe? In that case you should ask them to sign up again and confirm the consent. A lot of mailing lists are doing just that.</p></li>
<li><p>Did they previously give consent and you can document it? If so, then you can argue that you have the required consent.</p></li>
<li><p>Do you have business in Europe? If not then I don't think they would bother to go after you. You could just walk away from the fine.</p></li>
<li><p>What other personal informastion are you storing? If you know who reside in Europe then you already have more info than just the email. The email address itself wouldn't be much of a documentation issue, SAR or Portability task. </p></li>
</ol>
