Okay, what does it mean “residency”? In the UK there’s no address registry where you declare your address.

EU citizen works in the UK for 2 years then goes to Turkey for a vacation but likes the place so much, decides to stay for longer when still remote working for the same London company.Also connects through VPN because the Turks love banning websites.

Where this person residence is? Are the UK, USA, EU or Turkish rules apply? How FB would know about it?

That’s not an extreme scenario BTW, it happens all the time.

Countries generally have rules around residency that boil down to "if you spend most of a year within the country you are resident in that country".

Tax residency is separate and the rules are a bit different and again vary by country.

For the UK, basic rules that cover residency for most are listed at <https://www.gov.uk/tax-foreign-income/residence>, with a link to the full rules for those not covered by the basic rules.

> what does it mean “residency”?

Usually residency is self declared or based on where you have spent the majority of the year working in.

This is already handled, by lots of people, when they declare residency already, for where they currently live/work/are covered by taxes under.

This isn't a new thing.

> In the UK there’s no address registry where you declare your address

Can you vote in Glasgow's local elections if you live in Manchester?

It would be more accurate to say there is no single register of addresses.

The electoral register knows I’ve left the U.K.; I had to tell HMRC separately because they don’t share info; likewise the Student Loans Company even though there is a close connection between income and repayments [0]; and when I tried to tell the DVLA, they told me they lacked the capacity to know about non-UK addresses.

[0] the repayment rules means that, for low- and mid-income people, it behaves more like a graduate tax on worldwide income than a loan — it’s a percentage of pay over a threshold, and only high earners can pay it off fully — and if you do a self-assessment tax return there is a box for student loan stuff.

To vote, you need to register to vote, I voted at London Mayor elections in 2016. You vote wherever you register to vote, I don't remember the details but I guess it was me declaring that I live there and I would like to vote.

In UK there's this concept called proof of address and it's usually bill or a document that is sent to your address, there's no central registry of residents.

The point is, you don't need a register, central or otherwise, for the place of residence to be legally relevant. The way this kind of things work is that, should there be a legal challenge, you will provide a proof of residence to the court or whatever relevant body, just like you do when registering to vote.

There are clear rules regulating that, but they may depend on the country.

The rules are anything but clear.

Some countries require at least 6 months + 1 day to be considered a resident, others might have you have a resident even if you aren't there if "the country is the center of your family or economic interests".

The rules for the UK are set out pretty clearly in the statutory residence test [1]. It covers all such cases in more detail than you ever wanted to know :)

What causes difficulties though is that the rules in different countries, even if clearly defined, can contradict each other on the question of tax residency. So you may well be liable to pay taxes in two (or more) countries at the same time.

You may even have to pay taxes in both countries on the same income or gains, unless there is a double taxation agreement that allows you to offset some of those taxes against each other [2]

[1] https://www.gov.uk/hmrc-internal-manuals/residence-domicile-...

[2] https://www.gov.uk/government/collections/tax-treaties

They may also be very unclear or outright missing, depending on the country.

It will depend on the law.

Tax law favours a designated location for residency, for example.

The GDPR doesn't even operate on the level of residency (at least for data subjects). You're covered by the GDPR when you're physically in an EU member state[0] as regards your activity in that member state or if the data controller/processor is established in the EU. The UK GDPR will be the same, mutatis mutandis.

[0] Or somewhere where EU law applies by virtue of international law, like an embassy, an EU-flagged ship, an area of Antarctica claimed by an EU member state etc. etc.

If you get a Turkish residence or work etc visa and make that your primary residence then that's your residence.

If you're there on your 90day tourist visa, it's not your residence.

> How FB would know about it? In a matter of fact GDPR applies to people in EU, and data processed in EU.

It also states that data from people in EU has to be processed and stored in the EU.

It's not a matter of citizenship nor residency. Facebook just geo-locate you IP endpoint (so endpoint of your VPN) and manage your data by doing so. So USA rules will apply.

BUT if you are browsing websites hosted in Europe, EU rules will apply to your data.

The US tax authorities disagree.

For most law sure. But for GDPR the EU explicitly extended it's protection to all EU citizen regardless of residency, and non EU citizen with residency in the EU.

Now there's the practical question of how the EU enforces that protection against companies that have no presence in the EU, but those that do, the EU has made it quite clear they'll take enforcement action.

Citizenship and residency (of data subjects) doesn't come in to the GDPR at all.

If the data controller/processor is in the EU, the GDPR applies.

If the data subject is physically located in the EU (even if not a citizen or resident) then the GDPR applies.

The legal text:

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

Article 3.

One minor correction:

If the data subject is physically located in the EU (even if not a citizen or resident) and the data controller purposefully targets data subjects in the union, the GDPR applies.

As per [0]:

the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention

[0] https://gdpr.eu/Recital-23-Applicable-to-processors-not-esta...

That's right, although Recital 23 continues on to say

"factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union."

In case of GDPR (EU) and securities laws (US), citizenship matters, not location.

For example, almost anywhere in the world if you want to open a bank account they will explicitly ask you now if you’re an american citizen.

My understanding is that GDPR primarily cares about location, not citizenship or residence. There are some subtleties around which location is the relevant one, for example when the delivery address is in a different country from the country the subject is in when they send the order.

> 3.2 This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union,...

(Plus companies in the EU have to comply with GDPR for all subjects)

I believe GDPR applies to EU residents. I believe the complication is that it also applies if they are travelling outside of the EU, but not if they become resident outside of the EU.

Not only residents (in the sense of having a permanent home in the EU):

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

For example, it also applies to people which are traveling and are currently located in EU territory (provided that a service is intended to be used by EU residents).