How can Santa keep his lists when the GDPR is around?

Question

For my non-European readers, here is an excerpt of what the GDPR means: (emphasis mine)

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

A processor of personal data must clearly disclose any data collection, declare the lawful basis and purpose for data processing, how long data is being retained, and if it is being shared with any third-parties or outside of the EU.

I haven't been notified by Santa or his elves that he is collecting data about me. And mind you: my name and surname are my personal data, not to mention whether I have been good or naughty.

Moreover, Santa also needs my full address to deliver my presents, and again, that is also my personal data.

Santa hasn't notified me whether he is updating his Privacy Policy, so I assume that Santa stopped collecting this data, at least for Europeans.

Does it mean that Santa is delivering me nothing this Christmas? If there is any way around this, can you please tell me what it is and how Santa can deliver me presents while still being compliant with the GDPR?

Please assume I haven't been naughty.

Answer 1

Santa's data collection has always been compliant with GDPR, so he has no need to change his ways. The nature of his data collection is more transparent than most companies, and he is open to updating his records if you contact one of his representatives.

For example, he makes it clear that he is operating in your town:

You better watch out

You better not cry

Better not pout

I'm telling you why

Santa Claus is coming to town

The legitimate business purpose of his data collection is to create a list of those who are naughty and nice this year:

He's making a list

And checking it twice;

Gonna find out Who's naughty and nice

Santa Claus is coming to town

He even gives some examples of what data he's collecting:

He sees you when you're sleeping

He knows when you're awake

He knows if you've been bad or good

So be good for goodness sake!

---

The GDPR has some other requirements to it, such as an EU-based representative being necessary for operating in the EU, allowing users to request data updates, and getting consent for data collected.

Thankfully for Santa, he's been operating compliant representative systems for decades: Just go to any mall during the holiday season to meet with a representative. To ensure open and accurate records, the representative will ask the child if they've been naughty or nice that year and what type of present they want.

As long as the child's parent/legal guardian is nearby to confirm the data change requests, Santa will be happy to update his database to ensure the naughty/nice data is accurate and that the requested presents are delivered.

As for consent, the children are obviously too young to provide consent and must rely on their parent/guardian to consent to Santa's data collection. I doubt there's a single house that is receiving presents from Santa without the parent's explicit consent, and I'm sure we've all been told by our parents at some point to "be good or Santa won't give you presents this year!".

Answer 2

Santa is Christian priest (bishop as far as I remember). As you can see here he is covered by exemption:

The new Regulation will maintain the existing exemption which allows churches and other bodies with a 'religious... aim' to process sensitive data:

• 'in the course of its legitimate activities...';
• '...with appropriate safeguards';
• '...on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes'; and
• on condition that 'the data are not disclosed outside that body without the consent of the data subject'.

As no one ever saw his lists, and we don't know about any other activities, we can safely assume above bullets are met.

Answer 3

Well you are making a fundamental misunderstanding about the GDPR (as many have), that consent is the only basis for holding and processing information.

There are actually six legal bases for holding data (you have to scroll down a little as the link doesn't work properly).
Those six bases are:

1. Consent
2. Contract
3. Legal obligation
4. Vital interests
5. Public task
6. Legitimate interests

So let's look at each of them and see if Santa has any basis for collecting our information.

Consent - Actually this one may not even be as troublesome as it first seems. Presumably we're all writing letters to Santa asking for presents, this could potentially be seen as a form of consent for collecting our data, though I think that's a little iffy.

Contract - The letter to Santa could also form the basis for a contract for the provision of services (present delivery), so I think this works.

Legal Obligation - Unless you want to argue that Santa is legally obligated to perform his duties I don't think this one works.

Vital Interests - No one is going to die if Santa doesn't do his job, probably doesn't work either.

Public Task - I think this is a strong contender. From the website I linked above; "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law." I would say the worldwide provision of joy and happiness is in the public interest, and the processing of our information is definitely required for Santa's official functions.

Legitimate Interests - This is a little of a grey area and many businesses have used it as the basis for continuing to hold and process information, I see no reason why Santa couldn't do the same.

So in short, there is no real issue at all and Santa can continue doing what he needs to do as long as he properly deals with our information and updates his privacy policies.

Answer 4

Santa already exempts himself from the petty concerns of local laws. He invades sovereign airspace each year and unlawfully enters private residences.

The GDPR seems to be a lesser violation compared to others he willfully commits each year.

Why should he concern himself with the GDPR?

Answer 5

Everyone gets the same present - a letter about sending your personal data

This year we will all get a letter about the updated general terms and conditions and how you will be required to send a certain set of information to Santa so that he may send you your presents next year. Everyone will be required to send their address, name and age. You will also have to allow your parents to send Santa the data about you being nice or naughty. In case you don't want to disclose the naughty-or-nice information you will receive a generic probably-not-that-naughty present, which will most likely consist of old chocolate he found lying around in the elven workshops.

Be careful to send your data as fast as you can. It will be harder to get into contact with Santa after the timeframe he had allocated for everyone to send in their address, name and age. If you don't send that information you will receive nothing because Santa is not allowed to use your address any longer. If he still sends you something you can sue him - and thereby make sure that lots of children will cry because they won't get any presents after the EU is done with Santa. Good job, now it's clear on which list you are...

There is also talk about Santa cooperating with the Easter Bunny in 2019 for a late present delivery.

Answer 6

I'd like to take another route to answering your question:

He simply doesn't care.

For years, he has been punishing kids and breaking into houses; despite attempts from kids and governments, he has never been caught. He doesn't have an aviator's license or a landing permit for his sled, while flying very close to houses and otherwise endangering people.

Though, if you put him to a D&D scale, he may be chaotic good, he is nonetheless chaotic: he breaks the law to reach his goals.
I'm certain he doesn't pay VAT on his gifts. Also, the working conditions of his elves are questionable.

But it's the same with every other criminal:
As long they can't catch him, he will continue.

Answer 7

Note: This answer pertains to Santa Claus, as distinct from St Nicholas, Sinterklaas, Krampus, etc. - as per the question.

He is not bound by GDPR.

an entity or more precisely an "enterprise" has to be engaged in "economic activity" to be covered by the GDPR

https://en.wikipedia.org/wiki/General_Data_Protection_Regulation

What qualifies as "economic activity"? I'm glad you asked:

... the Court determins that an activity is economic on the basis of two criteria of agreement and renumeration

(from https://www.springer.com/cda/content/document/cda_downloaddocument/9789462651166-c2.pdf )

I do not agree with other posts that the recipients of the gifts agree (in the legal sense, nor in any sense that would stand up in court). I am not aware of any way a person can "agree" to be the recipient of gifts from Santa (there are obvious ways to object, of course).

Santa Clause also does not seem to meet the criteria for remuneration. He brings "gifts" or "presents" (https://en.wikipedia.org/wiki/Santa_Claus); "A gift or a present is an item given to someone without the expectation of payment or return" - https://en.wikipedia.org/wiki/Gift

In many cultures, something that may be considered payment is left for Santa (e.g. milk & cookies in the US & Canada; sherry or beer and mince pies in Britain & Australia; rice porridge in Denmark, Norway & Sweden); however, I can find no source that indicates that failing to leave these items will result in suspension of gifts. - https://en.wikipedia.org/wiki/Santa_Claus

Also:

'enterprise' means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.

As far as I can tell, Santa Clause is neither a natural nor legal person. Human Beings "acquire legal personhood when they are born (or even before...", juridical persons "acquire legal personhood when they are incorporated" (https://en.wikipedia.org/wiki/Legal_person). I am not aware of Santa Clause having been born, nor incorporated.

Addendum:

There was a question if "being nice" qualifies as remuneration. I would argue against this for the following reasons:

• If an item is traded for remuneration, it is, by definition, not a present. The items are clearly declared as presents.
• Santa is not the recipient of the "niceness" (in almost all cases).
• Although it is clearly document in "Santa Claus is coming to town", (H. Gillespie et al.) that "he's going to find out who's been naughty or nice", "He knows when you've been bad or good" and "He's making a list", there is nothing in this thesis that claims that this list affects the presents. Wikipedia claims it does, but none of the sources it cites (that I checked) back this up. Does anybody know of a reasonable source for this, or is it just an urban myth? Does anybody know of a child that has not received a present, because they were naughty?

Answer 8

Santa will no longer be giving presents in EU region. Santa will only provide means of transportation for Ded Moroz who exist in time pocket created in USSR in 1946 and as a citizen of USSR is not obligated by EU law as law cannot work backwards.
So your future present WAS delivered before GDPR.

Answer 9

IANAL but here is my take of things.

In a nuthsell, GPDR requires any businesses/organizations/pineapples that have users in the European Union to:

• Disclose what they do with the info they have on you, and why they need it;
• Disclose with whom they share that information, and what those other businesses/organizations/pineapples do with it;
• Allow you to order them to "forget" you. Once you give them the order, they (and their partners) have to delete all your data that can be used to identify you.

All within limits of reasonability, of course. You can't order the government or a bank to forget that you have not paid your credit card bill and your income tax in months, for example.

---

Santa has to adhere to the GDPR only for some europeans. For starters, many european countries are not members of the EU, such as Norway and Serbia. Santa Claus also does not operate in Italy.

---

What would most probably happen is that the elves in charge of Santa's legal department will have sent every parent or legal guardian in the 28 (soon to be 27) member states a letter around May 25 stating that:

• They collect personal data from their children in order to assess a naughtiness score;
• They are the keepers of the data. The processors of the data are Tencent and Alibaba, two chinese companies that specialize in social credit systems;
• The legal guardian or parent may choose to opt-out of the system at any time, if they so wish. They may also request their children's personal data removed from the system at any moment, no questions asked;
• However, opting out means their kids will never receive christmas presents again, at least until they join the program once more. Gifts not received due to non-participation will not be resent when they rejoin;
• Participation does not imply in presents. Should a child receive a low reputation score due to naughty actions, they may instead receive a lump of coal, a visit from Krampus, or whatever punishment is seen as fit for the culture of the country where they live.

Adults capable of having children will also receive a notice that in the future, they will have to manually input any future children's data in the system if they wish to receive christmas presents. Of course, people who have opted out of any social credit system will not receive such messages.

---

Finally, Santa will not be the only one sending such letters. So will every imaginary folklore people who bring any joy to kids:

• The tooth fairy (and her rat affiliates in France) will promise that any data linking fallen teeth to their owners is anonymized;
• Sandman will make sure that parents/legal guardians dream with his new EULA ASAP. Their children will not have sweet dreams until their parents agree to it. Should they opt out, their children will have neither dreams not nightmares.
• When winter comes, rather than patterns on windows, people will see Jack Frost new service terms, and a couple of ice buttons for opt-in and opt-out;

The Easter Bunny is the only one having an easy time. AFAIK in Europe he does not hide chocolate eggs for kids to look for - rather, people paint actual eggs and give those as presents. He will provide an easy opt out for people who don't want to pay him his royalties.

Answer 10

A letter to Santa is considered to be implied consent for data storage, as the data is required for the requested delivery of presents.

This is similar to the implied consent between a patient and a healthcare provider.

Santa will use the data for the purposes of direct gift-giving, without breaching confidentiality.

If you would like to remove your data, or would like to access your data to see if you are considered naughty or nice, you will have to write another letter to Santa.

Santa will have 30 days to respond to your request. If this is in terms of working days, you should expect a reply by 2048.

Answer 11

Santa only has output; no income. Therefore, if EU decides to prosecute for an alleged violation, the prescribed percentage penalty is not a burden. Besides, EU has no courts at the North Pole, and no extradition treaty. So it will be hard to collect that penalty of €0.

Answer 12

Extortion.

He simply informs everyone involved in the enforcement of GDPR that if they take action against him he will replace everyone's present that year with a note explaining why they didn't get what they asked for and giving the names and addresses of those responsible.

Nobody's going to want to be the one who spoiled Christmas for everyone in the entire world. That would be a good way to get lynched.

Answer 13

Santa exists in a parallel world where this law doesn't apply. Children in our world who believe that Santa exists have identical copies in worlds where Santa does exist. If we give them a present and tell that it's from Santa and they believe that to be true, then what we have here is the exact copy of the child who really got that exact same present from Santa.

The moment the child finds out that Santa does not exist, the child diverges from his/her copies in the worlds where Santa does exist.

Answer 14

GDPR is apparently explained as General Data Protection Regulation.

Actually, and thanks to the lobbying of elves and little people, the legislature has come with that clever explanation to hide its real meaning: Gift Donors Privacy Relieved.

Santa, together with other Gift Donors, such as the Tooth Fairy, is exempted from observing the privacy of his "customers" to better serve their interest.

Answer 15

If you are over 16 and have not consented to Santa collecting your personal data, it is very likely that you will not receive presents from Santa. If you are under 13, then the GDPR allows your parents to consent on your behalf, so if they have done so, you likely will receive presents. Between 13 and 16 it depends on the jurisdiction.

Answer 16

He would just remember everything himself.

He's not a regular person, he's Santa, why shouldn't he simply know all he needs to know? In fact, even under GDPR, no one is obliged to call everyone whose number they have in their head. So personal memories are very clearly exempt from the "any collection of data" clause.

Furthermore, Santa is not in any way a commercial entity and doesn't act commercially. To project our usual human assumptions about our economic system onto a being like Santa is flawed reasoning.

Answer 17

Santa did forsee this decades ago. Once he understood where our law-addicted society was headed, he instructed his huge apparatus of elven servants to foster the belief that he didn’t exist. This strategy has been so successful, that no member of the EU executive dares taking action against him, for they would be branded as crazy and sent to uncomfortable places. In fact last year around Christmas I saw something big and distinctly sledge-like in the sky. I was naive enough to point it out, but when I heard someone at the table mutter „97, hampf, dampf, retirement home“, I started giggling and pretending to be drunk...

In fact, the day after I was visited by a strapping young elf who made clear that Santa didn’t wish... Oh, let me get the dooooooor

Answer 18

He doesn't have to

I might point out that as he is based in the North pole, an area that doesn't fall within the EU's borders, arguably he doesn't have to technically comply with GDPR because the regulation only impacts European businesses, and Santa isn't in Europe.

How GDPR impacts countries outside of the EU is another question altogether, and is certainly a grey area legally because how would the EU enforce it's laws over that of another sovereign nation state or a company located in another country?

They could certain legislate some absurd law (sounds like great grounds for a story) but then how can they enforce against a man who travels faster than the speed of light and can disappear down small chimneys? I'd love to see some lawyers try to serve notice to the man in red in the North pole. A full arctic expedition just to serve some legal documents.

On a legal technicality, GDPR allows for data to be retained where it's needed to provide a service - in this case, knowing the address and whether they're children who meet the eligibility criteria (asleep, good) for present delivery is fundamental. Although, if he's bound to GDPR, then he's probably also bound to anti-discrimination laws regarding good and bad kids.

Answer 19

The elf's head loophole

Santa could hire more elves and teach them memorization techniques for committing all the personal information to memory. The elves would self-organize into groups by cities and would then label themselves with their city region that they have memorized.

Santa can then have easy access to the data without violating any GDPR restrictions.

I'm not a GDPR expert but I can't imagine it prohibiting people (or elves) from remembering personal information. To stop Santa from using this loophole I guess the next move for GDPR is to prohibit systematic memorization of personal information.

But until then Santa is likely to be wanting an AI for predicting which presents that are going to be popular next year so that he can get his elves producing them already. We better stop him before he attempts to do this because it will require quite a few elves in some really ridiculous jobs. Although it would be a really impressive setup of elves!

Answer 20

You have some of this backwards, my friend. Santa's mission statement is to compel boys and girls of the world to be good, not to be good himself. Santa is allowed to be naughty, just not you.

He collects data using his custom KrampOS, derived from Tails, and running relays off of the Dark Web and a network of numerous reindeer-launched high-orbit stealth satellites.

While in recent years, simply coming up with an Amazon partnership and using their cloud services, customer records, and a basic probability has been tempting, the northern state of Santonia is seen to be a rogue state by the EU and numerous other territories.

In the course of a single night, he has been sighted breaking into the personal properly of 448 million EU citizens, leaving anomalous and disguised objects, devouring food, and promptly leaving under the cover of darkness. This is already a blatant violation of personal property laws, and has been going on for many centuries in one form or another. Santa was already unequivocally guilty when GDPR was passed. Taking personal data is just "the icing on the cake".

Santa is a clear and present danger, and a rogue agent. He is a master infiltrator. His folk-hero status may have given him some protection from above-ground justice, but make no mistake—he cares not for the EU or its laws, and is to be apprehended on sight.