Suppose that a person not resident (nor present) in the EU, say in Mexico, obtains services from a provider located in the US, and provides personal information in connection with those services, including filling out a "public profile" giving permission to list specified personal information publicly. Let us further suppose that there was no continuing exchange of information and no continuing provision of services. There was no continuing monitoring of the Data Subject by the provider. Consent was freely given by the person at the time of the original transaction. The only continuing processing of this person's data is to store it, and to make the items previously consented to as public available on the relevant web page.
The provider specifies policies and purposes, and also stores an manipulates the information, and thus it would be both a Controller and a Processor in GDPR terms. The provider does provide services to EU residents, although it is primarily targeted on the US market.
Several years later, the person moves to the EU, say to Spain. Subsequently, the person sends either a data access request fort all information that the provider has on the person, or a "right to be forgotten" request to have all personal information deleted from the provider's records. The person has clearly established that s/he is the same person who provided PI from Mexico years before.
No services have been requested by, or provided to, this person for some years, since before the person was an EU resident. The provider may be providing services to other people who are present in the EU.
Under these circumstances, does the GDPR require the provider to provide the requested information, or to delete information from its records, given that the information was not collected from a person present in the EU at the time of collection?