Hi all
I’ve been asked a question about data sharing with application agents (not based in the EU) with whom we work with at university recruitment fairs around the world, specifically with relation
to potential students who have a dual nationality.
If, for example, we were at a fair in Brazil and took the details of a potential student who holds a dual citizenship with Portugal but resides in Brazil would we, and by extension the application
agent, be required to process their personal data in accordance with GDPR? Thinking about Article 3, which is the closest I can find to guidance on this, does ‘in the Union’ mean they must be physically located in the Union for GDPR to apply or is there a
wider scope of interpretation which would mean that anyone of the Union is considered to be in it?
Taking this further, if we take their personal data and so are processing the data of a non-resident EU citizen in the EU, does GDPR apply? Para 14 of the preamble, ‘The protection afforded
by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data’ would suggest that this is the case.
Thoughts on this would be much appreciated as I’ve managed to tie my own in a big knot!
With thanks,
Christine