For my non-European readers, here is an excerpt of what the GDPR means: (emphasis mine)

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

A processor of personal data must clearly disclose any data collection, declare the lawful basis and purpose for data processing, how long data is being retained, and if it is being shared with any third-parties or outside of the EU.

I haven't been notified by Santa or his elves that he is collecting data about me. And mind you: my name and surname are my personal data, not to mention whether I have been good or naughty.

Moreover, Santa also needs my full address to deliver my presents, and again, that is also my personal data.

Santa hasn't notified me whether he is updating his Privacy Policy, so I assume that Santa stopped collecting this data, at least for Europeans.

Does it mean that Santa is delivering me nothing this Christmas? If there is any way around this, can you please tell me what it is and how Santa can deliver me presents while still being compliant with the GDPR?

Please assume I haven't been naughty.

  • 215
    $\begingroup$ Santa's naughty list is clearly exempt from the GDPR, which does not apply to data processed "by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties..." $\endgroup$
    – Mike Scott
    Commented Jun 4, 2018 at 14:07
  • 43
    $\begingroup$ @MikeScott, he judges based on morality, not law, being rude to your parents isn't criminal but it does put you on the naughty list, no exemption there. $\endgroup$
    – Separatrix
    Commented Jun 4, 2018 at 14:30
  • 64
    $\begingroup$ Thanks so much to everyone who has contributed to this I really really needed something uplifting today and this has hit the spot beautifully. $\endgroup$
    – Ash
    Commented Jun 4, 2018 at 15:23
  • 100
    $\begingroup$ I think that, if Santa was caught, breaking and entering would be higher up on the list of things he was arrested for than violating GDPR rules. $\endgroup$ Commented Jun 4, 2018 at 17:37
  • 41
    $\begingroup$ You have been warned that "This incident will be reported". xkcd.com/838 The xkcd is considered proper notice and your usage of sudo is clear consent. $\endgroup$
    – Nemo
    Commented Jun 4, 2018 at 20:14

20 Answers 20


Santa's data collection has always been compliant with GDPR, so he has no need to change his ways. The nature of his data collection is more transparent than most companies, and he is open to updating his records if you contact one of his representatives.

For example, he makes it clear that he is operating in your town:

You better watch out

You better not cry

Better not pout

I'm telling you why

Santa Claus is coming to town

The legitimate business purpose of his data collection is to create a list of those who are naughty and nice this year:

He's making a list

And checking it twice;

Gonna find out Who's naughty and nice

Santa Claus is coming to town

He even gives some examples of what data he's collecting:

He sees you when you're sleeping

He knows when you're awake

He knows if you've been bad or good

So be good for goodness sake!

The GDPR has some other requirements to it, such as an EU-based representative being necessary for operating in the EU, allowing users to request data updates, and getting consent for data collected.

Thankfully for Santa, he's been operating compliant representative systems for decades: Just go to any mall during the holiday season to meet with a representative. To ensure open and accurate records, the representative will ask the child if they've been naughty or nice that year and what type of present they want.

As long as the child's parent/legal guardian is nearby to confirm the data change requests, Santa will be happy to update his database to ensure the naughty/nice data is accurate and that the requested presents are delivered.

As for consent, the children are obviously too young to provide consent and must rely on their parent/guardian to consent to Santa's data collection. I doubt there's a single house that is receiving presents from Santa without the parent's explicit consent, and I'm sure we've all been told by our parents at some point to "be good or Santa won't give you presents this year!".

  • 78
    $\begingroup$ @DavidMulder: Santa certainly has legitimate interest: he needs to watch you to collect naughty/nice data, and needs to know when you're sleeping in order to deliver your presents. As for consent, just ask any parent with their kid nearby and I'm sure they'll tell you that they're happy to have Santa make sure their kid is being nice all year long. $\endgroup$
    – Giter
    Commented Jun 4, 2018 at 15:55
  • 135
    $\begingroup$ Oh, that explains why my Jewish house never gets any gifts from Santa: My parents never consented to it! $\endgroup$
    – AAM111
    Commented Jun 4, 2018 at 16:28
  • 26
    $\begingroup$ Oh my, Santa invented GDPR decades ago and we haven't even noticed.. He's so good in hiding! $\endgroup$ Commented Jun 5, 2018 at 0:11
  • 32
    $\begingroup$ "I doubt there's a single house that is receiving presents from Santa without the parent's explicit consent" --- What about Batman? $\endgroup$
    – Aloha
    Commented Jun 5, 2018 at 1:18
  • 38
    $\begingroup$ @pandalion98: In such a case, "parent" should really read as "legal guardian", which would be Alfred. $\endgroup$
    – Flater
    Commented Jun 5, 2018 at 7:39

Santa is Christian priest (bishop as far as I remember). As you can see here he is covered by exemption:

The new Regulation will maintain the existing exemption which allows churches and other bodies with a 'religious... aim' to process sensitive data:

  • 'in the course of its legitimate activities...';
  • '...with appropriate safeguards';
  • '...on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes'; and
  • on condition that 'the data are not disclosed outside that body without the consent of the data subject'.

As no one ever saw his lists, and we don't know about any other activities, we can safely assume above bullets are met.

  • 94
    $\begingroup$ Ah, the old non-separation of church and state... $\endgroup$ Commented Jun 4, 2018 at 14:54
  • 25
    $\begingroup$ @Renan actually it kinda is separation - state does not interfere with church data usage as long as it really is for church purposes. $\endgroup$
    – Mołot
    Commented Jun 4, 2018 at 14:57
  • 57
    $\begingroup$ Yeah, but this basically makes the church immune to the law, based on a government decision. $\endgroup$ Commented Jun 4, 2018 at 14:58
  • 15
    $\begingroup$ May be, maybe not, this discussion is not really going to improve my answer in any way. Would make good question on Politics Stack Exchange, I guess. $\endgroup$
    – Mołot
    Commented Jun 4, 2018 at 15:01
  • 18
    $\begingroup$ You probably find that Santa checks for any list inaccuracies against the all-inclusive Easter Bunny Visits. Easter Bunny doesn't care if you naughty or nice, and could provide Santa with a slightly updated address field and total regional numbers. They are from the same religious organisation (albeit different departments), but the data was collected under different "given purposes". I don't know if this would be allowed or not. $\endgroup$ Commented Jun 4, 2018 at 15:04

Well you are making a fundamental misunderstanding about the GDPR (as many have), that consent is the only basis for holding and processing information.

There are actually six legal bases for holding data (you have to scroll down a little as the link doesn't work properly).
Those six bases are:

  1. Consent
  2. Contract
  3. Legal obligation
  4. Vital interests
  5. Public task
  6. Legitimate interests

So let's look at each of them and see if Santa has any basis for collecting our information.

Consent - Actually this one may not even be as troublesome as it first seems. Presumably we're all writing letters to Santa asking for presents, this could potentially be seen as a form of consent for collecting our data, though I think that's a little iffy.

Contract - The letter to Santa could also form the basis for a contract for the provision of services (present delivery), so I think this works.

Legal Obligation - Unless you want to argue that Santa is legally obligated to perform his duties I don't think this one works.

Vital Interests - No one is going to die if Santa doesn't do his job, probably doesn't work either.

Public Task - I think this is a strong contender. From the website I linked above; "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law." I would say the worldwide provision of joy and happiness is in the public interest, and the processing of our information is definitely required for Santa's official functions.

Legitimate Interests - This is a little of a grey area and many businesses have used it as the basis for continuing to hold and process information, I see no reason why Santa couldn't do the same.

So in short, there is no real issue at all and Santa can continue doing what he needs to do as long as he properly deals with our information and updates his privacy policies.

  • 52
    $\begingroup$ Legitimate interest is his strongest argument here. If Santa doesn't hold your data you don't get a present, and you want your present don't you? $\endgroup$
    – Separatrix
    Commented Jun 4, 2018 at 14:31
  • 3
    $\begingroup$ If we take the official UK interpration of GDPR (easier to understand for us non-lawyers) we find regarding legitimate interests: "It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.". The collection by santa of everything good and bad you do has a HUGE privacy impact and straight up rules legitimate interest out. $\endgroup$ Commented Jun 4, 2018 at 15:51
  • 2
    $\begingroup$ Vital Interests can be covered. For example: "Dear Santa; I want a new heart for Christmas. Signed: A patient with a defective heart." $\endgroup$
    – Frostfyre
    Commented Jun 4, 2018 at 17:33
  • 21
    $\begingroup$ @Frostfyre If Santa starts delivering human hearts there may be a few other regulations he's breaking. $\endgroup$ Commented Jun 4, 2018 at 20:37
  • 2
    $\begingroup$ Contract law (at least in the US, don't know about EU) requires consideration and agreement on both parties, meaning if Santa does not receive anything for his service, or provide documented consent to provide the service requested in the letter, then it is not legally a contract. $\endgroup$
    – Nosajimiki
    Commented Sep 14, 2023 at 15:00

Santa already exempts himself from the petty concerns of local laws. He invades sovereign airspace each year and unlawfully enters private residences.

The GDPR seems to be a lesser violation compared to others he willfully commits each year.

Why should he concern himself with the GDPR?

  • 47
    $\begingroup$ Who is to say Santa doesn't have bilateral treaties with every country in the world that allow him to enter their airspace? I have never seen any country complain about him violating their airspace, yet. $\endgroup$
    – Polygnome
    Commented Jun 4, 2018 at 21:04
  • 27
    $\begingroup$ @Polygnome The same would apply to entering private residences. I haven't heard of any complaints to the police about it and Santa doesn't seem to be on any police wanted lists. $\endgroup$
    – CJ Dennis
    Commented Jun 5, 2018 at 0:46
  • 32
    $\begingroup$ @Polygnome NORAD has been tracking Santa's movements for over 6 decades. It's not like his flight path is much of a secret. All countries on his route have been readily informed about his exact location during his flight, and not one single country has objected to Santa in their airspace. I'd say that definitely falls within implied consent. $\endgroup$
    – Shawn
    Commented Jun 5, 2018 at 15:05
  • 3
    $\begingroup$ I think the whole point is the absurdity of Santa concerning himself with the GDPR. $\endgroup$
    – Klik
    Commented Jun 6, 2018 at 0:36
  • 4
    $\begingroup$ All of this and to say nothing about owning all those slave elves, forced to make toys all year long without even getting coffee breaks. $\endgroup$ Commented Jun 8, 2018 at 16:06

Everyone gets the same present - a letter about sending your personal data

This year we will all get a letter about the updated general terms and conditions and how you will be required to send a certain set of information to Santa so that he may send you your presents next year. Everyone will be required to send their address, name and age. You will also have to allow your parents to send Santa the data about you being nice or naughty. In case you don't want to disclose the naughty-or-nice information you will receive a generic probably-not-that-naughty present, which will most likely consist of old chocolate he found lying around in the elven workshops.

Be careful to send your data as fast as you can. It will be harder to get into contact with Santa after the timeframe he had allocated for everyone to send in their address, name and age. If you don't send that information you will receive nothing because Santa is not allowed to use your address any longer. If he still sends you something you can sue him - and thereby make sure that lots of children will cry because they won't get any presents after the EU is done with Santa. Good job, now it's clear on which list you are...

There is also talk about Santa cooperating with the Easter Bunny in 2019 for a late present delivery.

  • 1
    $\begingroup$ I agree on 90% of this. I just think that instead of a generic present, you will get nothing, since he needs your address to deliver and addresses are also personal data. $\endgroup$ Commented Jun 4, 2018 at 14:09
  • $\begingroup$ @Renan That was about the nice-or-naughty information from your parents. If you don't send your address he obviously is not allowed to send you presents and you could instead sue him. $\endgroup$
    – Secespitus
    Commented Jun 4, 2018 at 14:11
  • 28
    $\begingroup$ "We've updated our privacy policy" is already a meme, I can't wait to see the world's collective faces when they wake up on Christmas morning to find it in their stockings as well. $\endgroup$
    – F1Krazy
    Commented Jun 4, 2018 at 14:21
  • 2
    $\begingroup$ If he's sending presents to everybody then he doesn't need to keep track of our addresses. He can just deliver to note to every house. $\endgroup$
    – Yay295
    Commented Jun 5, 2018 at 7:37
  • 1
    $\begingroup$ In order to receive presents, you will be required to opt-in to having your personal details stored so that Santa can ensure you receive advertising that is relevant to your interests. You must also consent to Santa sharing your information with other parties, including the Tooth Fairy and the Easter bunny. The use of the information includes, but is not limited to, targeted advertising for dental treatments. $\endgroup$ Commented Jun 6, 2018 at 12:45

I'd like to take another route to answering your question:

He simply doesn't care.

For years, he has been punishing kids and breaking into houses; despite attempts from kids and governments, he has never been caught. He doesn't have an aviator's license or a landing permit for his sled, while flying very close to houses and otherwise endangering people.

Though, if you put him to a D&D scale, he may be chaotic good, he is nonetheless chaotic: he breaks the law to reach his goals.
I'm certain he doesn't pay VAT on his gifts. Also, the working conditions of his elves are questionable.

But it's the same with every other criminal:
As long they can't catch him, he will continue.

  • 3
    $\begingroup$ I was getting tired of the "your privacy is (suddenly) important to us (because the law forces us to)". It would have been refreshing to get at least one e-mail from Santa Inc honestly stating "we don't care about your privacy". $\endgroup$
    – CompuChip
    Commented Jun 14, 2018 at 7:52
  • 1
    $\begingroup$ (1) VAT is paid on the sale price, and I don't believe Santa sells any product or service. (2) VAT (if any) on the materials he uses to make the gifts, would be payable by Santa's supplier, not Santa. (3) Under international law, the North Pole and the region of the Arctic Ocean surrounding it are not owned by any country - therefore taxes do not apply, and only internation law applies. $\endgroup$ Commented Oct 12, 2022 at 19:26

Note: This answer pertains to Santa Claus, as distinct from St Nicholas, Sinterklaas, Krampus, etc. - as per the question.

He is not bound by GDPR.

an entity or more precisely an "enterprise" has to be engaged in "economic activity" to be covered by the GDPR


What qualifies as "economic activity"? I'm glad you asked:

... the Court determins that an activity is economic on the basis of two criteria of agreement and renumeration

(from https://www.springer.com/cda/content/document/cda_downloaddocument/9789462651166-c2.pdf )

I do not agree with other posts that the recipients of the gifts agree (in the legal sense, nor in any sense that would stand up in court). I am not aware of any way a person can "agree" to be the recipient of gifts from Santa (there are obvious ways to object, of course).

Santa Clause also does not seem to meet the criteria for remuneration. He brings "gifts" or "presents" (https://en.wikipedia.org/wiki/Santa_Claus); "A gift or a present is an item given to someone without the expectation of payment or return" - https://en.wikipedia.org/wiki/Gift

In many cultures, something that may be considered payment is left for Santa (e.g. milk & cookies in the US & Canada; sherry or beer and mince pies in Britain & Australia; rice porridge in Denmark, Norway & Sweden); however, I can find no source that indicates that failing to leave these items will result in suspension of gifts. - https://en.wikipedia.org/wiki/Santa_Claus


'enterprise' means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.

As far as I can tell, Santa Clause is neither a natural nor legal person. Human Beings "acquire legal personhood when they are born (or even before...", juridical persons "acquire legal personhood when they are incorporated" (https://en.wikipedia.org/wiki/Legal_person). I am not aware of Santa Clause having been born, nor incorporated.


There was a question if "being nice" qualifies as remuneration. I would argue against this for the following reasons:

  • If an item is traded for remuneration, it is, by definition, not a present. The items are clearly declared as presents.
  • Santa is not the recipient of the "niceness" (in almost all cases).
  • Although it is clearly document in "Santa Claus is coming to town", (H. Gillespie et al.) that "he's going to find out who's been naughty or nice", "He knows when you've been bad or good" and "He's making a list", there is nothing in this thesis that claims that this list affects the presents. Wikipedia claims it does, but none of the sources it cites (that I checked) back this up. Does anybody know of a reasonable source for this, or is it just an urban myth? Does anybody know of a child that has not received a present, because they were naughty?
  • 7
    $\begingroup$ "Santa Clause"? That's a nice slip of the tongue... $\endgroup$
    – dim
    Commented Jun 9, 2018 at 18:27
  • 2
    $\begingroup$ Sorry, English is my second language. $\endgroup$ Commented Jun 10, 2018 at 22:10
  • $\begingroup$ One could argue that being nice would satisfy as renumeration, and thus deemed as payment for services, or 'the present'. $\endgroup$ Commented Jun 12, 2018 at 14:14
  • $\begingroup$ Answered in the addendum. $\endgroup$ Commented Jun 14, 2018 at 2:47

Santa will no longer be giving presents in EU region. Santa will only provide means of transportation for Ded Moroz who exist in time pocket created in USSR in 1946 and as a citizen of USSR is not obligated by EU law as law cannot work backwards.
So your future present WAS delivered before GDPR.

  • 5
    $\begingroup$ But Santa is based in Lapland, which is in the EU, so he is bound by EU law even for operations outside the EU. $\endgroup$
    – Mike Scott
    Commented Jun 4, 2018 at 14:08
  • 3
    $\begingroup$ @MikeScott only when processing personal data you need to disclose agreement between data processor and collector. Santa is DRIVER. He don't ask questions. $\endgroup$ Commented Jun 4, 2018 at 14:11
  • 6
    $\begingroup$ @MikeScott no, Santa is based in Canada nowadays. $\endgroup$ Commented Jun 4, 2018 at 14:55
  • 3
    $\begingroup$ I thought he was based at the North Pole? $\endgroup$
    – komodosp
    Commented Jun 5, 2018 at 8:38
  • $\begingroup$ @colmde He is, and he gets his mail via the Alaskan USPS. Renan is linking to a Canadian troller's prank redirecting the mail in that country to Montreal because it allows a postal code to read H0H0H0. Mr Scott is referencing the British impostor 'Father Christmas', who had to be created by HM's Government to keep up spirits in WWI, given that British children were generally exploited as coal sources by unscrupulous parents during the Victorian and Edwardian eras. $\endgroup$
    – lly
    Commented Jun 12, 2018 at 23:48

IANAL but here is my take of things.

In a nuthsell, GPDR requires any businesses/organizations/pineapples that have users in the European Union to:

  • Disclose what they do with the info they have on you, and why they need it;
  • Disclose with whom they share that information, and what those other businesses/organizations/pineapples do with it;
  • Allow you to order them to "forget" you. Once you give them the order, they (and their partners) have to delete all your data that can be used to identify you.

All within limits of reasonability, of course. You can't order the government or a bank to forget that you have not paid your credit card bill and your income tax in months, for example.

Santa has to adhere to the GDPR only for some europeans. For starters, many european countries are not members of the EU, such as Norway and Serbia. Santa Claus also does not operate in Italy.

What would most probably happen is that the elves in charge of Santa's legal department will have sent every parent or legal guardian in the 28 (soon to be 27) member states a letter around May 25 stating that:

  • They collect personal data from their children in order to assess a naughtiness score;
  • They are the keepers of the data. The processors of the data are Tencent and Alibaba, two chinese companies that specialize in social credit systems;
  • The legal guardian or parent may choose to opt-out of the system at any time, if they so wish. They may also request their children's personal data removed from the system at any moment, no questions asked;
  • However, opting out means their kids will never receive christmas presents again, at least until they join the program once more. Gifts not received due to non-participation will not be resent when they rejoin;
  • Participation does not imply in presents. Should a child receive a low reputation score due to naughty actions, they may instead receive a lump of coal, a visit from Krampus, or whatever punishment is seen as fit for the culture of the country where they live.

Adults capable of having children will also receive a notice that in the future, they will have to manually input any future children's data in the system if they wish to receive christmas presents. Of course, people who have opted out of any social credit system will not receive such messages.

Finally, Santa will not be the only one sending such letters. So will every imaginary folklore people who bring any joy to kids:

  • The tooth fairy (and her rat affiliates in France) will promise that any data linking fallen teeth to their owners is anonymized;
  • Sandman will make sure that parents/legal guardians dream with his new EULA ASAP. Their children will not have sweet dreams until their parents agree to it. Should they opt out, their children will have neither dreams not nightmares.
  • When winter comes, rather than patterns on windows, people will see Jack Frost new service terms, and a couple of ice buttons for opt-in and opt-out;

The Easter Bunny is the only one having an easy time. AFAIK in Europe he does not hide chocolate eggs for kids to look for - rather, people paint actual eggs and give those as presents. He will provide an easy opt out for people who don't want to pay him his royalties.

  • 2
    $\begingroup$ Ah! Hence the real reason for Brexit. $\endgroup$
    – Magoo
    Commented Jun 5, 2018 at 19:17

A letter to Santa is considered to be implied consent for data storage, as the data is required for the requested delivery of presents.

This is similar to the implied consent between a patient and a healthcare provider.

Santa will use the data for the purposes of direct gift-giving, without breaching confidentiality.

If you would like to remove your data, or would like to access your data to see if you are considered naughty or nice, you will have to write another letter to Santa.

Santa will have 30 days to respond to your request. If this is in terms of working days, you should expect a reply by 2048.


Santa only has output; no income. Therefore, if EU decides to prosecute for an alleged violation, the prescribed percentage penalty is not a burden. Besides, EU has no courts at the North Pole, and no extradition treaty. So it will be hard to collect that penalty of €0.

  • 9
    $\begingroup$ Actually it's 4% of annual global turnover or 20 million €, whichever is greater. $\endgroup$ Commented Jun 6, 2018 at 8:37
  • $\begingroup$ In other words, if anyone smaller than Amazon goofs, EU wants to put them out of business. Well, there's still the jurisdiction issue. $\endgroup$
    – WGroleau
    Commented Jun 6, 2018 at 16:39
  • 4
    $\begingroup$ These are the maximum fines; penalties may be lower. $\endgroup$
    – SJuan76
    Commented Jun 8, 2018 at 12:12


He simply informs everyone involved in the enforcement of GDPR that if they take action against him he will replace everyone's present that year with a note explaining why they didn't get what they asked for and giving the names and addresses of those responsible.

Nobody's going to want to be the one who spoiled Christmas for everyone in the entire world. That would be a good way to get lynched.


Santa exists in a parallel world where this law doesn't apply. Children in our world who believe that Santa exists have identical copies in worlds where Santa does exist. If we give them a present and tell that it's from Santa and they believe that to be true, then what we have here is the exact copy of the child who really got that exact same present from Santa.

The moment the child finds out that Santa does not exist, the child diverges from his/her copies in the worlds where Santa does exist.

  • $\begingroup$ "then what we have here is the exact copy of the child who really got that exact same present from Santa." Conversations overheard from parents will not be the same. The worlds will diverge in other ways, and very quickly will not be reconcilable. $\endgroup$
    – wizzwizz4
    Commented Jun 6, 2018 at 18:18
  • $\begingroup$ This was kinda my "answer", too. If you've watched "Miracle on 34th St.", Santa says that he, his North Pole abode, the elves, etc. live in the "magical" world, not ours. Our rules don't apply there! By the way, "I believe!!" $\endgroup$ Commented Mar 4, 2019 at 17:48

GDPR is apparently explained as General Data Protection Regulation.

Actually, and thanks to the lobbying of elves and little people, the legislature has come with that clever explanation to hide its real meaning: Gift Donors Privacy Relieved.

Santa, together with other Gift Donors, such as the Tooth Fairy, is exempted from observing the privacy of his "customers" to better serve their interest.


If you are over 16 and have not consented to Santa collecting your personal data, it is very likely that you will not receive presents from Santa. If you are under 13, then the GDPR allows your parents to consent on your behalf, so if they have done so, you likely will receive presents. Between 13 and 16 it depends on the jurisdiction.


He would just remember everything himself.

He's not a regular person, he's Santa, why shouldn't he simply know all he needs to know? In fact, even under GDPR, no one is obliged to call everyone whose number they have in their head. So personal memories are very clearly exempt from the "any collection of data" clause.

Furthermore, Santa is not in any way a commercial entity and doesn't act commercially. To project our usual human assumptions about our economic system onto a being like Santa is flawed reasoning.

  • 3
    $\begingroup$ You don't need to call everyone whose name you have in your personal address book, either. GDPR doesn't apply to individuals, see (18): This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. $\endgroup$
    – Ángel
    Commented Jun 13, 2018 at 20:18

Santa did forsee this decades ago. Once he understood where our law-addicted society was headed, he instructed his huge apparatus of elven servants to foster the belief that he didn’t exist. This strategy has been so successful, that no member of the EU executive dares taking action against him, for they would be branded as crazy and sent to uncomfortable places. In fact last year around Christmas I saw something big and distinctly sledge-like in the sky. I was naive enough to point it out, but when I heard someone at the table mutter „97, hampf, dampf, retirement home“, I started giggling and pretending to be drunk...

In fact, the day after I was visited by a strapping young elf who made clear that Santa didn’t wish... Oh, let me get the dooooooor


He doesn't have to

I might point out that as he is based in the North pole, an area that doesn't fall within the EU's borders, arguably he doesn't have to technically comply with GDPR because the regulation only impacts European businesses, and Santa isn't in Europe.

How GDPR impacts countries outside of the EU is another question altogether, and is certainly a grey area legally because how would the EU enforce it's laws over that of another sovereign nation state or a company located in another country?

They could certain legislate some absurd law (sounds like great grounds for a story) but then how can they enforce against a man who travels faster than the speed of light and can disappear down small chimneys? I'd love to see some lawyers try to serve notice to the man in red in the North pole. A full arctic expedition just to serve some legal documents.

On a legal technicality, GDPR allows for data to be retained where it's needed to provide a service - in this case, knowing the address and whether they're children who meet the eligibility criteria (asleep, good) for present delivery is fundamental. Although, if he's bound to GDPR, then he's probably also bound to anti-discrimination laws regarding good and bad kids.

  • $\begingroup$ Although he is based in North Pole, he/his company operates in EU, and holds data on EU citizens. He is very much inside the purview of GDPR. $\endgroup$ Commented Jun 8, 2018 at 10:25
  • 5
    $\begingroup$ GDPR is extraterritorial: no matter where you are, if you are handling personal information of EU citizens or you do business in the EU, you must comply with the GDPR. This means GDPR also impacts American or Australian businesses that do business with the EU, even if those businesses are not in the EU. $\endgroup$ Commented Jun 8, 2018 at 12:49
  • $\begingroup$ EU says it applies. But neither USA nor Santa's Workshop is going to even read to the end of a GDPR extradition request before tossing it in the bin. $\endgroup$
    – WGroleau
    Commented Aug 30, 2019 at 1:45

The elf's head loophole

Santa could hire more elves and teach them memorization techniques for committing all the personal information to memory. The elves would self-organize into groups by cities and would then label themselves with their city region that they have memorized.

Santa can then have easy access to the data without violating any GDPR restrictions.

I'm not a GDPR expert but I can't imagine it prohibiting people (or elves) from remembering personal information. To stop Santa from using this loophole I guess the next move for GDPR is to prohibit systematic memorization of personal information.

But until then Santa is likely to be wanting an AI for predicting which presents that are going to be popular next year so that he can get his elves producing them already. We better stop him before he attempts to do this because it will require quite a few elves in some really ridiculous jobs. Although it would be a really impressive setup of elves!

  • 6
    $\begingroup$ That would violate GDPR. In this case the elves are both drivers and processors of data, and the fact that they are making commercial use of that information makes them susceptible to the law. $\endgroup$ Commented Jun 6, 2018 at 11:55
  • $\begingroup$ @Renan; +1 You’re probably right, as it sounds sensible. I guess where I’m trying to go is to the question of what rights do we have to know things, and what rights do we have to use that information in a commercial setting. So where exactly are the boundaries drawn between data that one have in one’s head and data on a computer? Say a company hires someone that know a lot about some people in some community, would that company be affected by GDPR? $\endgroup$
    – Vegard
    Commented Jun 7, 2018 at 9:22
  • $\begingroup$ if the company makes use of that knowledge, then yes. $\endgroup$ Commented Jun 7, 2018 at 10:14
  • 5
    $\begingroup$ Art 2.1: "This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system" (my emphasis) $\endgroup$ Commented Jun 8, 2018 at 18:21
  • $\begingroup$ @PeterTaylor Good thing I don't live in the EU. It would be fun to raise merry hob with that. Pick some small firm that knows all of its customers by name. Get an account there. Do just enough business that they remember you. Then close the account, demand your data be deleted, and two weeks later walk in the front door. If they remember who you are, bingo, lawsuit. And given that the minimum fines will bankrupt most small businesses they'll probably be willing to skip the courts and just pay you a more reasonable fee to go away. $\endgroup$
    – Perkins
    Commented Nov 8, 2022 at 1:55

You have some of this backwards, my friend. Santa's mission statement is to compel boys and girls of the world to be good, not to be good himself. Santa is allowed to be naughty, just not you.

He collects data using his custom KrampOS, derived from Tails, and running relays off of the Dark Web and a network of numerous reindeer-launched high-orbit stealth satellites.

While in recent years, simply coming up with an Amazon partnership and using their cloud services, customer records, and a basic probability has been tempting, the northern state of Santonia is seen to be a rogue state by the EU and numerous other territories.

In the course of a single night, he has been sighted breaking into the personal properly of 448 million EU citizens, leaving anomalous and disguised objects, devouring food, and promptly leaving under the cover of darkness. This is already a blatant violation of personal property laws, and has been going on for many centuries in one form or another. Santa was already unequivocally guilty when GDPR was passed. Taking personal data is just "the icing on the cake".

Santa is a clear and present danger, and a rogue agent. He is a master infiltrator. His folk-hero status may have given him some protection from above-ground justice, but make no mistake—he cares not for the EU or its laws, and is to be apprehended on sight.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .