FAQ 4 - Investment banking, audits and headhunters
Q: The activities of auditors, investment bankers [and headhunters](1) may involve processing personal data without the consent or knowledge of the individual. Under what circumstances is this permitted by the notice, choice, and access principles?
A: An organization may process information without knowledge of the individual only to the extent and for the period necessary to meet statutory or public interest requirements and in other circumstances in which the application of these principles would prejudice the legitimate interests of the organization. These legitimate interests include the monitoring of companies' compliance with their legal obligations and legitimate accounting activities, and the need for confidentiality connected with possible acquisitions, mergers, joint ventures, personnel appointments, or other similar transactions.
1. The EC notes that neither the directive nor Member State law creates exceptions for headhunters. The US seeks advice on whether headhunters can adhere to the requirements of the safe harbor principles and conduct their business.