FAQ 4 - Investment banking and, audits and headhunters

Q: The activities of auditors and, investment bankers [and headhunters]1 may involve processing personal data without the consent or knowledge of the individual. Under what circumstances is this permitted by the notice, choice, and access principles?

A: Investment bankers or and auditorsAn organization may process information without knowledge of the individual only to the extent and for the period necessary to meet statutory or public interest requirements and in other circumstances in which the application of these principles would prejudice the legitimate interests of the organization. These legitimate interests include the monitoring of companies' compliance with their legal obligations and legitimate accounting activities, and the need for confidentiality connected with possible acquisitions, mergers, joint ventures, personnel appointments, or other similar transactionscarried out by investment bankers or auditors.

1. The EC notes that neither the directive nor Member State law creates exceptions for headhunters. The US seeks advice on whether headhunters can adhere to the requirements of the safe harbor principles and conduct their business.