This question's explanation and your answers so far.
EU の一般データ保護規則 (GDPR) に関する記述として, 適切なものだけを全て挙げたものはどれか。 a EU 域内に拠点がある事業者が, EU 域内に対してデータやサービスを提供している場合は, 適用の対象となる。 b EU 域内に拠点がある事業者が, アジアや米国など EU 域外に対してデータやサービスを提供している場合は, 適用の対象とならない。 c EU 域内に拠点がない事業者が, アジアや米国など EU 域外に対してだけデータやサービスを提供している場合は, 適用の対象とならない。 d EU 域内に拠点がない事業者が, アジアや米国などから EU 域内に対してデータやサービスを提供している場合は, 適用の対象とならない。
This narrows the correct statements down to only a, but c (no base within the EU × provides only to recipients outside the EU → not subject) is also a correct statement. Because it does not list all of the correct statements, it is inappropriate.
Including b in addition to a and c is wrong. Statement b claims that a business with a base within the EU is not subject when it provides to recipients outside the EU; however, as long as a business has a base (establishment) within the EU, it is subject to GDPR even when the processing involved in its activities is directed outside the EU. Therefore b is an incorrect statement and must not be included in the combination.
正解 The scope of GDPR (the EU General Data Protection Regulation) is determined by two viewpoints: (1) whether the business has a base within the EU, and (2) whether it provides data or services to individuals within the EU. Statement a is the case where a business with a base within the EU provides to recipients within the EU; since both the base and the recipients are within the EU, it is clearly subject to GDPR and is correct. Statement c is the case where the business has no base within the EU and provides only to recipients outside the EU (such as Asia or the United States); since neither the base nor the recipients are within the EU, it falls outside the scope of GDPR and is correct. Therefore, the combination that lists only and all of the correct statements is “a and c,” and ウ is the correct answer.
Including d in addition to a and c is wrong. Statement d claims that a business without a base within the EU is not subject when it provides from places such as Asia or the United States to recipients within the EU; however, GDPR applies extraterritorially even to non-EU businesses when they provide goods or services to individuals within the EU. Therefore d is an incorrect statement and must not be included in the combination.