privacy european-union gdpr
GDPR: Citizens with Dual Nationality?
<p>Do the GDPR Regulations apply to processing data of a citizen who has dual nationality? </p>

<p>I don't see any indication that <a href="http://www.eugdpr.org/" rel="nofollow noreferrer">GDPR regulations</a> take citizenship into account in any way, so it seems unlikely that the number of citizenships is relevant.</p>

<p>GDPR Recital 14 (p.3) states:</p>

<blockquote>
  <p>"The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data..."</p>
</blockquote>

<p>and GDPR Article 3(2) ("Territorial Scope", p.33) states:</p>

<blockquote>
  <p>"This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union..."</p>
</blockquote>

<p>It is not immediately clear from reading the above Article 3(2) whether <strong>'in the Union'</strong> refers to only one, a subset or all of the following scenarios:</p>

<ul>
<li><p>located in the Union: geographically currently located within the Union, whatever their nationality/citizenship (e.g. including tourists and temporary residents such as students);</p></li>
<li><p>resident in the Union: normally resident within the Union, whatever their nationality/citizenship (e.g. would include if they were to visit a website hosted outside of the E.U.);</p></li>
<li><p>citizen in the Union: European citizen, whatever their current geographic location (e.g. would include if they were travelling outside of the E.U. for holiday/work etc.).</p></li>
</ul>

<p>While some privacy professionals have concluded that the first two are included in scope but that the third is probably not on the basis that they think 'in the Union' is limited by geographical boundaries rather than by way of membership in a political and economical union, at the present time there is no case law yet that we can rely upon to be certain. If anyone discovers anything that clarifies the GDPR intent on this please add to the comments and I'll update the answer if appropriate.</p>
