5 ms·

Citizenship is irrelevant to GDPR. A non-EU company could probably request at least some proof that you're in scope if they have reasonable doubts about if you

by detaro 5y ago

Citizenship is irrelevant to GDPR. A non-EU company could probably request at least some proof that you're in scope if they have reasonable doubts about if you are, but I suspect in practice many find it easier to just oblige a reasonable request they have a process for than getting into the weeds of scope and risk getting it wrong. (i.e. I suspect there's some fun legal nuance in scenarios like "I'm a US citizen living in the US that applied and got rejected 3 months ago, now I'm on holiday in Copenhagen and writing an access request" - I could see ways of arguing that either way depending on the circumstances, but also am not a lawyer). Although a request for interview information like this might be enough hassle to be restrictive.

remus 5y ago
It's not actually that unfeasible. A pretty standard first step in complying with a Subject Access Request is to verify the identity of the person you're talking to (wouldn't want to hand over a load of personal data to some random after all), so checking their nationality at the same time isn't miles off.
- detaro 5y ago
  again: citizenship/nationality/residency doesn't matter.
x0x0 5y ago
A non-EU company, or a company that believed a data subject was not subject to GDPR, would definitely demand some proof the company was GDPR obligated before handing over job applicant or employee data, since that is likely being used to prep for a lawsuit. You can't fly to Copenhagen and submit a request if the employer and application took place in eg the US. That's all part of the territorial applicability -- you don't necessarily need a presence in the EU, but you do need an establishment through eg stable arrangements. See Guidelines 3/2018 on the territorial scope of the GDPR (Article 3).
- detaro 5y ago
  I was thinking more multinational corp, where there could be interesting questions if the US could in edge-cases still count as touching the context of the (clearly existing) EU establishment. E.g. if an employee in an EU office happened to do one interview stage or was otherwise involved, they'd have done "data processing" in the EU. Or if the same hiring process and organization also runs the equivalent for EU offices, does that pull it in through same way. Etc. Very possible that not, just not something I'd be confident on for all cases. Of course a large multinational is also likely to have had people look at these questions and design their process around them where needed. Good point on the lawsuit risk being a reason to be strict though.

by detaro 5y ago

remus 5y ago

It's not actually that unfeasible. A pretty standard first step in complying with a Subject Access Request is to verify the identity of the person you're talking to (wouldn't want to hand over a load of personal data to some random after all), so checking their nationality at the same time isn't miles off.

detaro 5y ago
again: citizenship/nationality/residency doesn't matter.

x0x0 5y ago

A non-EU company, or a company that believed a data subject was not subject to GDPR, would definitely demand some proof the company was GDPR obligated before handing over job applicant or employee data, since that is likely being used to prep for a lawsuit. You can't fly to Copenhagen and submit a request if the employer and application took place in eg the US. That's all part of the territorial applicability -- you don't necessarily need a presence in the EU, but you do need an establishment through eg stable arrangements. See Guidelines 3/2018 on the territorial scope of the GDPR (Article 3).

detaro 5y ago
I was thinking more multinational corp, where there could be interesting questions if the US could in edge-cases still count as touching the context of the (clearly existing) EU establishment. E.g. if an employee in an EU office happened to do one interview stage or was otherwise involved, they'd have done "data processing" in the EU. Or if the same hiring process and organization also runs the equivalent for EU offices, does that pull it in through same way. Etc. Very possible that not, just not something I'd be confident on for all cases. Of course a large multinational is also likely to have had people look at these questions and design their process around them where needed. Good point on the lawsuit risk being a reason to be strict though.