作者
Paul Voigt

Paul Voigt, Lic. en Derecho, CIPP/E

合伙人

Read More
Axel Frhr. von dem Bussche

Dr. Axel Frhr. von dem Bussche, LL.M. (LSE)

合伙人

Read More
作者
Paul Voigt

Paul Voigt, Lic. en Derecho, CIPP/E

合伙人

Read More
Axel Frhr. von dem Bussche

Dr. Axel Frhr. von dem Bussche, LL.M. (LSE)

合伙人

Read More

2020年8月21日

GDPR EU-Representative - For companies without EU establishments

Extended scope of the GDPR

The GDPR has a very broad scope of application; companies doing business within the EU will often be subject to the GDPR, even if they have no establishments in the EU. The GDPR applies already when a NON-EU COMPANY offers goods or services to individuals in the EU or monitors their behaviour (Art. 3 sec. 2 GDPR).

Who has to appoint a representative under the GDPR?

All companies

  • without establishment in the EU
  • offering goods or services (even if for free) to, or monitoring the behaviour of individuals in the EU

will need to appoint an EU REPRESENTATIVE (Art. 27 GDPR), regardless of whether the companies are considered controllers or processors under the GDPR.


The threshold is very low: offering services to the EU via a website directed to EU users (e.g. because goods/services are delivered to the EU, EU currency is accepted or EU languages are used) will trigger the requirement to appoint an EU REPRESENTATIVE. Same applies to any user tracking of EU residents, e.g. via cookies. 

Duties of the Representative 

The EU REPRESENTATIVE shall act as local contact point for EU individuals and EU data protection supervisory authorities, and represent the NON-EU COMPANY with regard to their respective obligations under the GDPR (Art. 4 No. 17 GDPR).

The following requirements have to be met:

  1. The EU REPRESENTATIVE needs to be designated in writing
  2. The EU REPRESENTATIVE shall act on behalf of the NON-EU COMPANY and therefore needs to have power of representation.
  3. The Representative needs to be established in one of the EU member states where the data subjects affected by the activity of the NON-EU COMPANY are located. It is not necessary to appoint an EU REPRESENTATIVE for each EU member state.

Fines

If a NON-EU COMPANY needs to appoint an EU REPRESENTATIVE but fails to do so, this may lead to fines of up to EUR 10,000,000.00 or 2% of NON-EU COMPANY’s annual group turnover, whatever is higher. 

Exemptions

The obligation of appointing an EU REPRESENTATIVE does not apply to cases where the legislator anticipates a small risk from a privacy perspective. This is the case if processing only takes place occasionally, no sensitive personal data is involved, and the processing is unlikely to result in a risk to the rights and freedoms of individuals. All these conditions have to be met cumulatively; therefore it is highly unlikely that a NON-EU COMPANY falling into the territorial scope of the GDPR can benefit from that exception. 

EU REPRESENTATIVE creates “one stop shop” for data breaches

NON EU COMPANIES can generally not take advantage of the “one stop shop” principle of the GDPR, which says that only one “lead authority” is responsible for all regulatory matters of a company throughout the EU. Consequently, whenever the GDPR requires contacting data protection authorities, without the one stop shop rule regulators in potentially all EU member states have to be contacted - in local language! One important practical example where notification of data protection authorities is required are data breaches, which have to be reported to the competent regulator within 72 hours. However, good news for companies who appointed an EU REPRESENTATIVE: the EU supervisory authorities regard the notification of a single data protection authority at the place of residence of the EU REPRESENTATIVE as sufficient. This facilitates the process of data breach notification significantly, in particular if individuals from various EU countries are affected. 

From 2021: UK Representative required

As of January 1, 2021, GDPR does no longer apply directly in the UK, but is implemented via the “UK GDPR”. The requirements of the GDPR are introduced “copy and paste” into UK law, including the requirement to appoint a representative. This means that companies doing cross-border business with the UK may need to appoint a separate UK Representative if they do not have an establishment in the UK. The requirements for appointing a UK rep and the corresponding fines for not doing so are the same as under the GDPR. In particular, if they do not have an establishment “on the ground”,

  • companies based in the EU collecting data in the UK may need to appoint a representative under the UK GDPR,
  • companies based in the UK collecting data in the EU may need to appoint a representative under the EU GDPR,
  • companies based in other countries collecting data in the UK and the EU may need to appoint both an EU and a UK representative.

Please click here to download the article as pdf file.

Call To Action Arrow Image

Latest insights in your inbox

Subscribe to newsletters on topics relevant to you.

Subscribe
Subscribe

Related Insights

数据保护与网络

Global Data Hub - Data transfers after Schrems II and Brexit transition

2020年10月9日
Quick read

作者

点击此处了解更多
数据保护与网络

Compliant or non-compliant? GDPR audits as a self-control tool

2020年8月26日

作者

点击此处了解更多
robot
数据保护与网络

Data Protection Officer – FAQ

2020年8月21日
IN-DEPTH ANALYSIS

作者

点击此处了解更多