Under the GDPR, any company doing business in the EU must remove EU users' personal data upon request from that user.
Since the statute only applies to persons present in the EU, are companies legally permitted to demand that a user requesting personal data removal supply proof that they are present in the EU, so that they can deny the request to those outside?