IPA IP 2023 Question 18

Topic: Legal Affairs

A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問18, translated into English. ITPEC is based on the same exams.

Same question on ITPEC: Oct 2024 Q75

Concerning the EU’s General Data Protection Rules (GDPR), which of the following lists all and only the appropriate descriptions?

A:If a business has an office within the EU region and provides data and services within the EU region, it is subject to the rules.B:If a business has an office within the EU region and provides data and services to Asia, the US, or other such places outside of the EU region, it is not subject to the rules.C:If a business does not have an office within the EU region and provides data and services only to Asia, the US, or other such places outside of the EU region, it is not subject to the rules.D:If a business does not have an office within the EU region and provides data and services from Asia, the US, or other such places to the EU region, it is not subject to the rules.

Explanation

A and C — GDPR applies either through an establishment in the EU, or, without one, through offering goods or services to people in the EU or monitoring them there.

  • •A — an office in the EU providing services in the EU: subject to GDPR. Appropriate
  • •B — an office in the EU serving customers outside the EU: GDPR still applies to processing done in the context of the EU establishment, wherever the data subjects are. Not appropriate
  • •C — no office in the EU and services only outside the EU: neither ground applies, so not subject. Appropriate
  • •D — no office in the EU but services provided to the EU: GDPR applies extraterritorially to businesses offering goods or services to people in the EU. Not appropriate

Answer (c)

Why not others:

  • •(a) A — misses C, which is also a correct statement
  • •(b) A, B, C — includes B, but an EU establishment does not escape GDPR because its customers are outside the EU
  • •(d) A, C, D — includes D, but a non-EU business targeting people in the EU is covered by GDPR's extraterritorial scope

Key rule: GDPR scope follows the EU establishment or the EU-based people being served or monitored, not only where the company is located; non-EU companies selling into the EU must comply.

Legal Affairs · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.