Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user.
Since the statute only applies to persons present in the EU, are companies legally permitted to demand that a user requesting personal data removal supply proof that they are present in the EU, so that they can deny the request to those outside?
the statute only applies to EU residents
Wrong.
GDPR applies to everyone in the EU (Art. 3). This means tourists are also covered. Residence status is completely irrelevant (Recital 14(1)):
The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence
There is no provision for data processors/controllers to demand proof from data subjects of them being located in the EU. You can challenge them, but if they refuse to provide proof you will still be liable to fulfill their GDPR request should they indeed be present in the EU.
I don't think it would be acceptable, in most cases, to demand such proof:
It shall be as easy to withdraw as to give consent. (art. 7.3)
So if the user was indeed covered by the GDPR, it is probably against it to require that (I don't know about your procedure, but you probably don't require any similar proof for signing up).
