CNPD (Luxembourg) - Délibération n° 3018
Luxembourg's CNPD refuses to investigate Rocketreach for GDPR violations due to its foreign establishment.
The Luxembourg National Data Protection Commission (CNPD) has refused to open an investigation into Rocketreach, a company accused of selling personal data of EU subjects without a legal basis. The CNPD cited Rocketreach's foreign establishment and lack of an EU representative as reasons for not proceeding, despite acknowledging potential GDPR breaches. This decision has drawn criticism for potentially allowing companies to evade accountability by operating outside the EU.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Rocketreach?
Get an email when a new story names Rocketreach, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRocketreach, a foreign company selling personal data of EU residents without a legal basis, escaped regulatory scrutiny because it lacked an EU establishment and a designated EU representative — both requirements under GDPR Articles 3 and 27. The Luxembourg CNPD acknowledged potential GDPR violations but declined to investigate due to these jurisdictional gaps. This case highlights a critical enforcement loophole: non-EU companies can process and monetize EU personal data while remaining practically unaccountable if they ignore GDPR establishment requirements. The decision undermines data subject rights and erodes trust in GDPR as a globally enforceable framework.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://blog.zoller.lu/2020/05/how-to-effectively-evade-gdpr-and-reach.html
- url — https://blog.zoller.lu/2020/10/how-to-effectively-evade-gdpr-and-reach.html