0

Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user.

Since the statute only applies to persons present in the EU, are companies legally permitted to demand that a user requesting personal data removal supply proof that they are present in the EU, so that they can deny the request to those outside?

1
  • 2
    any company doing business in the EU must remove EU users' personal data upon request from that user. - This is incorrect. If a company needs that personal data for another purpose, it must not be removed. (assuming that purpose is compatible with the GDPR).
    – wimh
    Jun 26, 2018 at 11:05

2 Answers 2

4

the statute only applies to EU residents

Wrong.

GDPR applies to everyone in the EU (Art. 3). This means tourists are also covered. Residence status is completely irrelevant (Recital 14(1)):

The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence

There is no provision for data processors/controllers to demand proof from data subjects of them being located in the EU. You can challenge them, but if they refuse to provide proof you will still be liable to fulfill their GDPR request should they indeed be present in the EU.

1
  • Can they still demand proof that you are present in the EU? Please see question edit.
    – gparyani
    Jun 26, 2018 at 0:00
2

I don't think it would be acceptable, in most cases, to demand such proof:

It shall be as easy to withdraw as to give consent. (art. 7.3)

So if the user was indeed covered by the GDPR, it is probably against it to require that (I don't know about your procedure, but you probably don't require any similar proof for signing up).

1
  • Withdrawing consent is not the same as invoking Art. 17 GDPR Right to erasure (‘right to be forgotten’) gdpr-info.eu/art-17-gdpr
    – Shinrai
    Jun 28, 2018 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .