Author: Gerrit Hornung
- Where Art. 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
- The obligation laid down in para. 1 of this Article shall not apply to:
(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Art. 9(1) or processing of personal data relating to criminal convictions and offences referred to in Art. 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
(b) a public authority or body.
(c) The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
(d) The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
(e) The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
I. Aim and function of the provision
Art. 27 is a building block in the system of the GDPR’s application and enforcement in third countries. Since Art. 3 para. 2 extends the territorial scope in certain cases to controllers and processors in these countries (→ Art. 3 mn. 32 et seqq.), but the SA of the Member States cannot exercise sovereign power there, there is in principle a risk that the substantive obligations of the controller and processor in these countries are de facto ineffective. The designation of a representative (Art. 4 no. 17) does not relieve the parties of these obligations (para. 5) but serves to ensure orderly communication with the SA and data subjects (para. 4). The extent to which the representative is also subject to legal obligations under the GDPR or liable himself is contentious (→ mn. 26 et seq.).
II. Legislative history and predecessor provisions
The provision has a predecessor in Art. 4 para. 2 DPD (see also recital 20 DPD). According to this, if national data protection law of a Member State was applicable to controllers in third countries because they made use of equipment situated on the territory in that said Member State for the purpose of processing personal data (Art. 4 para. 1 lit. c of the DPD), the controller had to designate a representative established in the territory of that Member State. Art. 27 continues this by extending it to processors for Art. 3 para. 2, which is the successor provision to Art. 4 para. 1 lit. c DPD.
The provision was amended in the legislative process. In para. 1, especially the requirement of written form goes back to Art. 25 Council-R. The important extension to processors was not included in any draft and inserted in the trialogue. With regard to the exceptions in para. 2, Comm and EP had proposed to exclude controllers in third countries for whom an adequacy decision (Art. 45 para. 3) has been issued. This was deleted at the proposal of the Council. The same applies to other exceptions put forward by Comm and EP (companies with less than 250 employees, controllers processing personal data of less than 5.000 data subjects). Para. 2 lit. a is a mixture of Art. 25 para. 2 lit. d Comm-P, Art. 25 para. 2 lit. d Parl-R and Art. 25 para. 2 lit. b Council-R; para. 2 lit. b was included in all drafts. The requirement for the establishment of the representative in para. 3 corresponds to Art. 25 para. 3 Comm-P and Council-R. In the trialogue the connection was changed. Now it is the stay of the data subjects that matters, not where they are resident; this corresponds to the parallel amendment in Art. 3 para. 2 (→ Art. 3 mn. 6). Para. 4 was successfully proposed by Art. 25 para. 3 lit. a Council-R, while para. 5 was included in all proposals.
III. Systematic position
The representative is defined in Art. 4 no. 17 and his position is explained in more detail in recital 80. Art. 27 is directly linked to the extension of the territorial scope to third countries in Art. 3 para. 2. Moreover, there are close connections to the transfer of data to third countries according to Art. 44 et seq. The representative must be distinguished from the contact point according to Art. 26 para. 1 sentence 3, which does not hold any power of representation.
In the text of the GDPR, the term “representative” is not used uniformly despite the definition in Art. 4 no. 17 (→ Art. 4(17) mn. 1). The GDPR refers to the representative within the meaning of Art. 27 in various provisions. When collecting data, the data subject must be provided with the identity and the contact details of the representative (Art. 13 para. 1 lit. a → Art. 13 mn. 6 and Art. 14 para. 1 lit. a → Art. 14 mn. 3). Art. 30 para. 1 and 2 oblige him to keep a record of processing activities which, according to Art. 30 para. 4, must be made available to the SA on request (→ Art. 30 mn. 13 et seq.). According to Art. 31, he is obliged to cooperate with the SA. Art. 58 para. 1 lit. a also gives each SA the power to require the representative to provide all the information it needs to carry out its duties.
[…]