[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDgnwDWZ3JsUmW0LXuSTE_gg618-FPOwRWRT1VCfjwiU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"71971e33-39a7-4877-8d1a-a39bf464d96d","cnpd-refuses-to-investigate-rocketreach-over-gdpr-data-sales","c5e5e610-6a5e-44a2-aafa-b6b95a7beb9c","CNPD Refuses to Investigate Rocketreach Over GDPR Data Sales","Rocketreach, a foreign company selling personal data of EU residents without a legal basis, escaped regulatory scrutiny because it lacked an EU establishment and a designated EU representative — both requirements under GDPR Articles 3 and 27. The Luxembourg CNPD acknowledged potential GDPR violations but declined to investigate due to these jurisdictional gaps. This case highlights a critical enforcement loophole: non-EU companies can process and monetize EU personal data while remaining practically unaccountable if they ignore GDPR establishment requirements. The decision undermines data subject rights and erodes trust in GDPR as a globally enforceable framework.","**Immediate actions:**\n- Verify that any third-party data broker or vendor processing EU personal data has a designated EU representative as required by GDPR Article 27.\n- Conduct a data flow audit to identify personal data being shared with or sourced from foreign entities lacking GDPR compliance documentation.\n\n**Regulatory & contractual controls:**\n- Include mandatory GDPR compliance clauses (legal basis, DPA agreements) in all contracts with external data processors or brokers.\n- Report non-compliant foreign data brokers to both the relevant lead supervisory authority and the EDPB to trigger coordinated enforcement action.\n- Avoid purchasing or using data from brokers who cannot demonstrate a lawful basis for processing EU personal data.\n\n**Long-term improvements:**\n- Advocate internally and externally for EDPB guidance that closes the enforcement gap for non-EU-established entities processing EU data.\n- Maintain an up-to-date Records of Processing Activities (RoPA) log identifying all external data sources and their legal bases.\n- Implement periodic third-party risk assessments specifically evaluating GDPR jurisdictional compliance of data suppliers.",[12,13,14,15,16,17,18,19,20],"GDPR Article 3 (Territorial Scope)","GDPR Article 27 (Representatives of Controllers\u002FProcessors Not Established in the EU)","GDPR Article 6 (Lawfulness of Processing)","GDPR Article 46 (Transfers Subject to Appropriate Safeguards)","GDPR Article 58 (Powers of Supervisory Authorities)","NIST Privacy Framework PR.DS-P1 (Data Processing Policies)","NIST SP 800-53 PT-1 (Personally Identifiable Information Processing and Transparency Policy)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27701 (Privacy Information Management)",{},"published","2026-06-23T15:20:39.480106+00:00","2026-06-23T15:20:39.363+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CNPD_(Luxembourg)_-_D%C3%A9lib%C3%A9ration_n%C2%B0_3018&diff=51958&oldid=37289","cnpd-luxembourg-deliberation-n-3018-fd6e73","CNPD (Luxembourg) - Délibération n° 3018",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]