3 ms·
A non-EU company, or a company that believed a data subject was not subject to GDPR, would definitely demand some proof the company was GDPR obligated before ha
by x0x0 5y ago
A non-EU company, or a company that believed a data subject was not subject to GDPR, would definitely demand some proof the company was GDPR obligated before handing over job applicant or employee data, since that is likely being used to prep for a lawsuit.
You can't fly to Copenhagen and submit a request if the employer and application took place in eg the US. That's all part of the territorial applicability -- you don't necessarily need a presence in the EU, but you do need an establishment through eg stable arrangements. See Guidelines 3/2018 on the territorial scope of the GDPR (Article 3).
- detaro 5y agoI was thinking more multinational corp, where there could be interesting questions if the US could in edge-cases still count as touching the context of the (clearly existing) EU establishment. E.g. if an employee in an EU office happened to do one interview stage or was otherwise involved, they'd have done "data processing" in the EU. Or if the same hiring process and organization also runs the equivalent for EU offices, does that pull it in through same way. Etc. Very possible that not, just not something I'd be confident on for all cases. Of course a large multinational is also likely to have had people look at these questions and design their process around them where needed. Good point on the lawsuit risk being a reason to be strict though.