EU Representative

A company must appoint an EU representative pursuant to Article 27 (1) GDPR if this company (i.e., the represented party) offers goods or services within the EU to data subjects or monitors their behaviour in the EU in accordance with the marketplace principle laid down in Article 3 (2) GDPR, but does not have an establishment in the EU, i.e., within the scope of the GDPR, but instead is established in a third country.

• Accordingly, there must be a targeted processing of personal data of data subjects located in the EU, regardless of their nationality/legal status (Recital 14) and
• the specific data processing must relate to the offering of goods or services (including free of charge) or behavioural monitoring in the EU.

Exceptions only apply in the case of occasional processing of personal data with low sensitivity, which does not result in a risk to the rights and freedoms of natural persons, or if the company is a public authority or body. If these exceptions do not apply, the designation of an EU representative is mandatory by law and therefore required. If the designation is not made despite the existence of the above-mentioned requirements, the competent supervisory authority may impose an administrative fine on the company in question.

The concrete tasks and duties of the representative result from Article 27 (4) GDPR in conjunction with. Recital 80 sentence 5 as well as from the contract with the represented party. Essentially, the EU representative shall act as a concrete contact point for data subjects as well as supervisory authorities. The following tasks and duties are essentially covered by this:

• Maintaining and making available the records of processing activities in response to requests from supervisory authorities, insofar as these activities are subject to the responsibility of the representative. This includes processing activities for which the territorial scope of application is opened pursuant to Article 3 (2) GDPR (Article 30 GDPR).
• Cooperation with the supervisory authority in the performance of its tasks (Article 31 GDPR).
• Provision of all information required by the supervisory authority in the performance of its tasks (Article 58 (1) (a) GDPR). The supervisory authority may accordingly require the EU representative to provide the necessary information.
• Additional contact point for the supervisory authority, data subjects, and, where applicable, other bodies for all issues relating to the processing of personal data, Article 27 (4) GDPR.
• Pursuant to Section 44 (3) sentence 1 German Federal Data Protection Act, the representative is authorised to accept official service in civil court proceedings (only applies to actions brought by data subjects against the controller or processor).

The EU representative must be established in one of the EU Member States where the data processing takes place or where the data subjects are located. Pursuant to Article 27 (1) GDPR, the controller or processor, in cases pursuant to Article 3 (2), shall designate in writing a representative in the Union. In addition, the controller or processor shall expressly appoint the representative and instruct him or her in writing. The GDPR does not provide any further specific requirements regarding the duration of the designation, the possibility of revocation or termination.

In practice, the function of a representative in the Union may be exercised based on a service contract. The contract should regulate the responsibilities, tasks and powers incumbent on the EU representative under Article 27 GDPR. It is not necessary to inform the supervisory authorities about the EU representative. The EU representative should be named in the data protection information (Article 13, 14 GDPR) and in the records of processing activities.