In today's digital economy, a growing number of organisations established outside the European Union (EU) are entering the EU market, by offering goods or services to individuals within the EU. As a result, they are likely to process personal data of individuals located in the EU. Based on the extraterritorial scope of the General Data Protection Regulation (GDPR), this processing of personal data triggers the application of GDPR.
If this applies to your business, one of the key legal obligations you must comply with is the appointment of an EU-based GDPR Representative.
This article explores why the role of a GDPR Representative matters to you, how it differs from the position and tasks of a Data Protection Officer (DPO) and the regulatory consequences of non-compliance.
Beyond borders: the extraterritorial scope of GDPR
One of the GDPR's defining features, is its extraterritorial scope which extends the Regulation's applicability beyond the borders of the European Union. The so-called “targeting” criterion establishes that, even without any physical presence, such as an office or personnel, organisations may still be subject to GDPR obligations.
More specifically, businesses outside the EU are bound by the GDPR if they are either:
- Offering goods or services to such data subjects in the Union, irrespective of whether a payment from the them is required, or
- Monitoring data subjects' behaviour as far as their behaviour takes place within the Union.
The European Data Protection Board's (EDPB) Guidelines 3/2018 clarifies that the concept of “monitoring” includes, but is not limited to, behavioural advertising,geo-location for marketing purposes, online tracking using cookies, health and diet analytics services, CCTV surveillance, market research based on individual profiles and the monitoring of individuals' health status.
If your organisation engages in such data processing activities involving individuals in the EU, you are likely operating within the scope of the GDPR and therefore your organisation is obliged to appoint a GDPR Representative in EU.
What a GDPR Representative does – and why you need one in the EU
The data Representative is your organisation's formal point of contact within the European Union, an official “ambassador” in EU. Its core responsibilities include:
- Serve as a contact point for EU supervisory authorities and data subjects;
- Represent the organization in all GDPR related matters.
It is important to note that the GDPR Representative is not directly responsible for ensuring the organisations' compliance with the GDPR. The non-EU organisation remains fully accountable for compliance.
This role may be fulfilled by a law firm, a consultancy firm or an independent professional, provided they are established within the EU and possess a thorough understanding of GDPR obligations.
Are there exemptions to this requirement?
Yes. Organisations may be exempt if their data processing is occasional, low-risk, does not involve large-scale processing of special categories of data or criminal data, or if they are public authorities. However, if your organisation does not fall within these exceptions, the appointment of a GDPR Representative is not optional, it is a legal obligation.
GDPR Representative vs. Data Protection Officer (DPO): different roles, different missions
A common misconception is that a Data Protection Officer (DPO) and a GDPR Representative are the same, or that one can serve as the other. This is not the case.
The DPO is responsible for overseeing data protection activities, ensuring compliance with the GDPR and acting as an internal resource for both data subjects and supervisory authorities. The DPO must operate independently and should not be influenced by the organisation's interests.
On the other hand, a GDPR Representative follows the Organisation's instructions, acts as an intermediary between the organisation and data subjects or supervisory authorities within the EU, but is not tasked with ensuring GDPR compliance.
The EDPB, in its Guidelines 3/2018 on the territorial scope of the GDPR, has explicitly clarified that the function of a GDPR Representative is incompatible with that of an external DPO within the EU: while the DPO is required to exercise autonomy and independence in the performance of its duties, the GDPR Representative operates under the instruction of the organisation.
Legal risks of not having a GDPR Representative in the EU
Failure to appoint a GDPR Representative where required, may result in significant regulatory penalties and reputational damage. The following decisions highlight how this obligation has been enforced and what are the key takeaways for organisations.
The Locatefamily.com case (The Netherlands)
Locatefamily.com is a Canada-based entity operating a globally accessible online platform which facilitates reconnections between individuals who have lost touch.
The platform gathers personal information, including names, residential addresses, and, in some instances, telephone numbers. This information is published on the company's website and made publicly accessible without any requirement for user authentication or subscription, thereby allowing unrestricted access to any internet user.
In the case at hand, the Dutch Data Protection Authority (DPA), following a number of complaints lodged against the Company, carried out an investigation. Among other GDPR violations, it was found that although the Company had no establishment within the EU, it was engaging in activities directed at data subjects within the EU. As a result, the Authority imposed a fine for failing to appoint a GDPR Representative.
The case is significant for reinforcing that GDPR obligations apply to organisations without an EU presence, holding them accountable for processing EU individuals' data. This case also clarifies that appointing an EU Representative does not exempt organisations from being subject to direct legal action and law enforcement.
Clearview AI (Italy)
Clearview AI is a company that provides face-recognition solutions based on the collection of face pictures using web-scraping of the internet and particularly social media sites. The Clearview software allows customers to match a face image against the Clearview biometric database. The platform is based in the US and the company does not have any offices or Representatives in the EU.
Following complaints lodged by data subjects in Italy, who were dissatisfied with Clearview's responses to their data access requests, the Italian data protection authority (Garante per la protezione dei dati personali) launched an investigation. Besides imposing a ban on further personal data collection, the Garante ordered the erasure of data relating to individuals within the Italian territory (including biometric data) and ordered Clearview to designate a GDPR Representative in the territory of the European Union. A fine of €20 million was imposed on the company as a result of various GDPR breaches.
For a deeper understanding of data transfer requirements outside the EEA, refer to our article “Transferring Personal data outside the EEA? The impact of the new standard contractual clauses in brief” on impact of the new standard contractual clauses.
Why appointing a GDPR Representative is not just an obligation. It is a strategic decision
For organisations established outside the European Union, the appointment of a GDPR Representative within the EU is not merely a formal compliance obligation, it is instead a prudent strategic step to mitigate the risk of penalties and reputational harm.
The importance of the GDPR Representative role has been further amplified by the expansion of EU regulatory frameworks, such as the Digital Services Act (DSA), the Network and Information Systems Directive (NIS 2) and the Data Governance Act (DGA), underscoring the necessity for a designated EU-based point of contact for businesses engaging with the European market.
If your business is expanding into the EU market, you will need a trusted GDPR Representative, as your strategic partner in maintaining compliance and navigating the complexities of EU data protection law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
