The basic legal principle (GDPR article 6) is that processing data about people is allowed only if a specific legal basis applies, and only to the extent that t

The basic legal principle (GDPR article 6) is that processing data about people is allowed only if a specific legal basis applies, and only to the extent that this legal basis allows it. So before we're even talking about expectations of the availability of this data - e.g. detailed interview notes in some company HR system (personal notes of specific interviewing employees would not count if these notes are not used in the company processes) - the company must consider why do they think they are allowed to record and store that data in the first place, since the "default expectation" is that they are not. And if they have a valid reason, they are required to have their Data Protection Officer to know that they are processing this data and it's the duty of the DPO to inform these people about what exactly they are permitted and required to do with this data - so if the people recording this data have a misleading expectation, that's fully the fault of the company. Before "the company produces data (interview evaluations) based on the expectation that their internal data is kept proprietary" it's the duty of the company to ensure that this processing of private data is reviewed, verified whether that processing is lawful in the first place and ensure that the people recording this information are informed about what they can/can't/must do with it, as the law requires the company to either ensure "appropriate organizational measures" for that, or not process this data at all. If the company has their employees "simply" producing data that includes personal data of others without considering the GDPR impact, that by itself is a breach of their legal duty of Article 24 of GDPR. In situations like these, most companies would assert that they have a specific legitimate interest (article 6.1.f) in processing the data for conducting the interview and application decision process, which is a perfectly valid justification - however, that would not necessarily grant them the right to process the data after the interview process ended with a rejection; there's no inherent right for the company to just continue storing the detailed interview notes just because, so it would be interesting to see what legal basis they assert for having that data in the first place, and IMHO in most EU companies the standard HR process now would require to discard the details after the interviews.