Article 27 GDPR

← Article 27 - Representatives of controllers or processors not established in the Union →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 27 - Representatives of controllers or processors not established in the Union

1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.

2. The obligation laid down in paragraph 1 of this Article shall not apply to:

(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

(b) a public authority or body.

3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.

4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.

5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

Relevant Recitals

Recital 80: Designated Representative

Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body. The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority. The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation. The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation. Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.

Commentary

The aim of Article 27 GDPR is to ensure that the level of protection afforded to EU-based data subjects is not reduced where non-EU based controllers or processors process their data. It aims to both, providing a contact point for data subjects and ensuring that there is legal accountability for processing activities by mandating the appointment of a representative. This representative can be subject to enforcement proceedings in the event of non-compliance with the GDPR. Article 27 GDPR also helps to clarify the scope of obligations placed on controllers and processors based outside of the EU.

EDPB Guidelines: for this Article see EDPB, 'Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)', 12 November 2019 (Version 2.1), (available here).

(1) Conditions for applicability

Where Article 3(2) applies

In case the territorial scope of Article 3(2) GDPR applies to a controller or processor not established in the Union (due to the processing of personal data of data subjects in the Union related to either the offering of goods or services to such data subjects or the monitoring of their behaviour in the Union), the controller or processor must designate a representative in the Union.

"Data controllers or processors subject to the GDPR as per its Article 3(2) are under the obligation to designate a representative in the Union. A controller or processor not established in the Union but subject to the GDPR failing to designate a representative in the Union would therefore be in breach of the Regulation."

EDPB, 'Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)', 12 November 2019 (Version 2.1), page 23.

The controller or processor shall designate in writing

The obligation to designate a representative in the Union is directed at controllers and processors established outside of the union but performing some kind of processing targeting data subject in the Union (i.e. falling under Article 3(2) GDPR). If more than one processing activity of the controller or processor fall under Article 3(2) GDPR, it is sufficient to designate one representative. At the same time, one representative can act on behalf of one or more controllers and/or processors outside of the Union.

The designation of the representative must be done in writing. This is necessary to guarantee the authenticity of the mandate and to ensure a certain tangibility of the parties involved. Qualified electronic signature or other equivalent method would also be admissible. However, this agreement could not be concluded by email.

In practice, the function of representative in the Union can be exercised based on a contract concluded between the controller or processor and an individual or an organization, provided that the individual or organization is established in the Union. The role can be assumed by a wide range of commercial and non-commercial entities, such as law firms, consultancies, or private companies. However, according to the EDPB, the role should not overlap with the DPO’s given its requirement for independence.

"Similarly, given the possible conflict of obligation and interests in cases of enforcement proceedings, the EDPB does not consider the function of a data controller representative in the Union as compatible with the role of data processor for that same data controller, in particular when it comes to compliance with their respective responsibilities and compliance."

EDPB, 'Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)', 12 November 2019 (Version 2.1), page 24 et seq.

Representative in the Union

A representative is defined in Article 4(17) GDPR as a "a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation".

The GDPR does not specify any particular requirements for the representative. However, under Article 4(17) GDPR, the representative must be capable of representing the controller or processor "with regard to their obligations under this Regulation". Therefore, the representative should act on behalf of the controller or processor according to the mandate received. The representative should also act as a (possible) point of contact for data subjects as well as for supervisory authorities and should be able to provide documentation to the authorities like the record of processing activities. The information provided to data subjects under Articles 13(1)(a) and 14(1)(a) GDPR must contain information of the controller's representative.

For example: A company established in the US is the provider of a webshop directed to to data subjects in the Union. According to Article 27 GDPR the controller must designate a representative in the Union (in the on of the member states where the products are offered).

The representative designated by the controller or processor should be subject to enforcement proceedings in case of non-compliance by the controller or the processor. However, the designation of a representative does not exclude the responsibility or liability of the controller or processor themselves.

It remains unclear how compliance of the GDPR by entities not providing such a representative should be effectively ensured (e.g. regarding public authorities that are excluded from the designation of a representative). Arguably, also a voluntary designation of a representative is possible.

It should be noted however, that the one-stop-shop mechanism (Article 60 et seqq. GDPR) is not applicable for controllers and processors outside of the Union.

(2) Exemptions

The obligation shall not apply to...

The requirement to designate a representative is not absolute. Article 27(2) GDPR presents two instances in which the requirement to have a representative does not apply. These are (a) when the processing is occasional, does not include data covered by Article 9 GDPR or Article 10 GDPR, and is unlikely to result in a risk to the rights and freedoms of natural persons, and (b) when the processing is done by a public authority or body. It should be noted that all processing activities of a controller under Article 3(2) GDPR should be considered; if just one of those activities does not fall under one of the exceptions below, a representative has to be designated who is then designated for all processing activities under Article 3(2) GDPR (if not otherwise agreed upon).

(a) Processing which is occasional and does not include data in the sense of Articles 9 and 10 GDPR

The first exception in Article 27(2)(a) GDPR states that the requirement to designate a representative does not apply if the processing meets three cumulative conditions:

First, the processing must be "occasional". A processing activity can be considered occasional if it is not carried out regularly and is not part of the regular course of business or activity of the controller or processor. In other words, occasional refers to a "non-systematic" processing, i.e. a processing happening on an ad hoc and infrequent basis and not in a regular way.

Second, it must not include "processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10" on a large scale. What meaning should be assigned to the expression “large scale” is not entirely clear but considerations could include a temporal, quantitative or qualitative aspects. Recital 91 mentions processing operations which aim to process "a considerable amount of personal data [...] which could affect a large number of data subjects".

"[T] the following factors, in particular, be considered when determining whether the processing is carried out on a large scale: the number of data subjects concerned - either as a specific number or as a proportion of the relevant population; the volume of data and/or the range of different data items being processed; the duration, or permanence, of the data processing activity; the geographical extent of the processing activity."

EDPB, 'Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)', 12 November 2019 (Version 2.1), page 25 et seq.

Third, the processing must be "unlikely to result in a risk to the rights and freedoms of natural persons". Thus, processing activities with a (not unlikely) risk to data subjects can not be subject to this exception to delegate designate a representative in the Union. Recital 75 GDPR sets out that when the risk to the rights and freedom of data subjects is being assessed, special consideration should be given to both its likelihood and severity. This includes, inter alia, risks of discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorized reversal of pseudonymisation, or any other significant economic or social disadvantage.

The unifying factor of these three (cumulative) conditions is the existence of processing which is in some way 'non-negligible' because of its scale, the data processed, or its possible negative consequences. In all the other cases, an representative in the Union must be appointed and the exemption in Article 27(1)(a) GDPR cannot apply.

(b) Processing carried out by a public authority or body

The second exemption to the requirement to designate a representative applies if the non-EU controller or processor is a public authority or body. The reason for this is exception is the territoriality principle in international law. According to this principle, no state has power or jurisdiction over another state and the Union cannot unilaterally impose requirements on another state or its public authorities.

It is up for the supervisory authority to assess on a case-by-case basis what constitutes a public authority or body. It should be considered whether the potential public authority or body processes personal data for their public purposes. However, instances in which a public authority or body in a third country would be monitoring the behaviour of data subjects in the Union, or offering them goods or services, are likely to be limited.

(3) Place of establishment of the representative

Article 27(3) GDPR states that the representative of the controller or processor shall be established in one of the Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are located.

"In cases where a significant proportion of data subjects whose personal data are processed are located in one particular Member State, the EDPB recommends, as a good practice, that the representative is established in that same Member State. However, the representative must remain easily accessible for data subjects in Member States where it is not established and where the services or goods are being offered or where the behaviour is being monitored."

EDPB, 'Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)', 12 November 2019 (Version 2.1), page 26.

The main criterion for establishing where a representative should be designated is the location of the data subjects who are subject to the processing. One way to interpret this is in the event that there are two member states in which processing takes place, the country which has more data subjects who are subject to the processing should be the country in which the representative is established. However, the wording of the provision implies that the controller or processor is free to designate a representative in a Member State of his choice as long as some of the affected data subjects are in this member state.

(4) Obligations and responsibilities of the representative

Under Article 27(4) GDPR, data subjects and supervisory authorities can address the representative on "all issues related to processing" in order to ensure compliance with the Regulation. This can be done "in addition to or instead of" addressing the controller or processor themselves.

The main role of the representative is to serve as a point of contact and be readily available for supervisory authorities and data subjects regarding data protection matters, as stated in Article 27(4). This includes providing relevant information, addressing inquiries, and handling documents. To fulfill these responsibilities effectively, the representative may enlist the support of a team and ensure effective communication in the appropriate languages.

Under Article 30 GDPR the representative of the controller or processor must maintain a record of the processing activities performed by the controller or processor. However, the controller or processor themselves are responsible for updating the content of the record, and must provide the representative with up-to-date information. At the same time, the representative must be ready to share this record.

Finally, as clarified by Recital 80 GDPR, the representative should also perform its tasks according to the mandate received from the controller or processor, including cooperating with the supervisory authorities regarding any action that may need to be taken in order to comply with the GDPR (Article 31 GDPR). Direct liability of the representative is limited to the obligations set out in Article 30 and Article 58(1)(a) GDPR.

(5) Continued liability

Article 27(5) GDPR makes it very clear that the controller or processor cannot escape legal liability by designating a representative. Indeed, it states that legal action can be initiated directly against the controller or processor. This notably happened in a case before the Austrian DPA, in which it chose to address a decision directly to a US company instead of its representative in the Netherlands, because “Article 27(5) GDPR does not entail a transfer of responsibility”.

Decisions

→ You can find all related decisions in Category:Article 27 GDPR