Answer:
Yes. Your community bank could be required to comply with the GDPR.
According to Bank BCLP:
U.S. banks should take a broad view of their overseas business – including where U.S. customers temporarily work or travel – in order to stay ahead of GDPR compliance issues.
For U.S.-based small businesses, including community banks, the conventional wisdom has focused on whether the institution solicits or services EU customers. Unfortunately this approach may cause banks or other businesses to underestimate their potential exposure.
For purposes of the GDPR, compliance obligations for companies without a physical presence in the EU are generally only implicated if the company (1) offers goods and services in the EU or (2) monitors the behavior of EU customers (referred to affectionately as “data subjects” in the regulation).
Of particular concern for community banks is whether tourists, foreign work assignments, or overseas service members could cause the bank to become subject to GDPR obligations.
Among many aspects of the application of the GDPR that are unclear at this point, whether a bank’s website or marketing practices constitute the offering of goods and services or monitoring behavior in the EU is anything but a bright-line test. When a U.S. citizen travels to the EU, access to a bank’s online banking systems is likely a technical trigger for GDPR compliance. Similarly, although a U.S. military installation in the EU is unlikely to be within the reach of the GDPR, servicemembers and their families may live and work off of their duty stations.
Attend this webinar to discover stopgap measures your bank can implement to avoid being subject to the GDPR.
Source: Barry Hester, GDPR Considerations for Community Banks, Bank BCLP (May 9, 2018), https://bankbclp.com/2018/05/gdpr-considerations-for-community-banks/
-----------------------------
Learn more about Carly Souther and Elba Manzanilla webinar Data Protection and Privacy for Community Bankers
print
share