A news website based m (he United Slates reports primarily on North American events The website is accessible to any user regardless of location, as…

The GDPR applies to the processing of personal data in the context of the activities of an

establishment of a controller or a processor in the Union, regardless of whether the processing takes

place in the Union or not1. This means that the GDPR applies to any controller or processor that has

a branch, office, subsidiary, or other stable arrangement in the EU, even if the data processing occurs

outside the EU. However, the GDPR also applies to the processing of personal data of data subjects

who are in the Union by a controller or processor not established in the Union, where the processing

activities are related to: (a) the offering of goods or services, irrespective of whether a payment of

the data subject is required, to such data subjects in the Union; or (b) the monitoring of their

behaviour as far as their behaviour takes place within the Union1. This means that the GDPR applies

to any controller or processor that targets or tracks EU data subjects, even if they do not have a

presence in the EU. In this case, the website operator is not required to comply with the GDPR

because it does not have an establishment in the EU (option B), and it does not offer goods or

services or monitor the behaviour of EU data subjects. The website operator reports primarily on

North American events, does not block connections from outside the U.S., and only accepts

payments in U.S. dollars, which indicate that it does not intend to target or track EU data subjects.

Therefore, option B is the correct answer. Reference: Art. 3 GDPR – Territorial scope, Guidelines

3/2018 on the territorial scope of the GDPR (Article 3), [What does territorial scope mean under the

GDPR?]