EU Representative of the Controller or Processor

27.11.2020. 19:30:00

GDPR teme

Traditionally, at the beginning of December, "the fragrance" related to holidays and New Year's atmosphere has become dominant through promotional content on the various websites. Of course, this year will not be dominated by the popular offer for group celebrations and travel, but we expect to be “bombarded” with offers of practical goods and services, and some of those offers will also come from companies outside the Union.

How are our personal data protected in such situations and in what way are they in compliance GDPR?

The territorial scope of the GDPR refers to organizations that have their headquarters or branch in the territory of the EU, regardless of whether personal data are processed inside or outside the EU.

This Regulation clearly regulates the processing of personal data in its territory. However, if the organization does not have a headquarters or physical office in the EU, it will target goods and services or personal data of EU citizens for monitoring purposes, and it will appoint a representative established in the Union, whether controller or processor.

Who is the representative of the controller or processor?

Basically, the Representative's function was introduced to facilitate communication regarding the implementation of the GDPR to organizations specifically dealing with the personal data of EU citizens, which do not have their headquarters or office in the EU, and therefore the Supervisory body can take remedial actions and fines.

The General Regulation allows the organization to appoint one representative for business activities throughout the EU.

In case when the organization conducts processing in e.g. Croatia, Hungary and Slovenia a representative should be appointed in one of the three countries. Regardless of the territorial scope of processing in the EU, it is recommended that the representative comes from the country where the largest amount of personal data is processed, but he or she should be able to communicate in languages understood by all respondents and supervisory bodies.

The controller or processor shall, by written authorization, appoint his representative to act on his behalf.

The representative may be a natural or legal person, and his liability may be stipulated as part of business contracts or as a single service intended only to fulfill an obligation under the Regulation.

On the other hand, a representative can act on behalf of a number of different controllers andprocessors.

The representative ensures that the processing of personal data is in accordance with the GDPR. In the first place, it must enable effective communication with the respondents in terms of exercising their rights and at the request of the Supervisory Body for checking the compliance of the controller / processor. Although the controller / processor is responsible for the content of the records on activities related to processing, the Representative is obliged to take care that the Records are always updated and available to the Supervisory Body.

Therefore, the representative of the controller or processor (Representative) for the organization outside the EU is the same as the Data Protection Officer (Officer) for the organization within the EU?

In addition to a number of similarities in action, in this section we will look back only at the differences concerning the activities conducted by the controller or the processor. The officer is appointed on the basis of professional qualifications and knowledge of the right and protection of personal data with a sufficient level of autonomy to act independently and without instructions from the controller or processor and submits his contact details to the Supervisory Body.

A representative is appointed to act on behalf of the controller or processor and is obliged to follow their direct instructions.

Although his or her expertise is not a requirement, it is recommended for him or her to be an expert, which is also in the interest of the controller and the processor.

The controller and the processor will not be liable for sanctions if the contact information of the Representative is not communicated to the Supervisory Body, but in terms of informing citizens, his or her contact information should be available before collecting personal information (e.g. in the Privacy Statement).

Are there exceptions regarding the appointment of a Representative?

The appointment of a Representative for organizations with a registered office and office outside the EU is not mandatory:

for public authorities or a public body. The General Regulation did not specify who these bodies are, but it is considered that they should be prescribed by national law, and by their nature the operation and conduct of such bodies in the supply of goods and services should be limited.
if the processing of data is occasionaly, that is to say it is not conducted on a regular basis regular and is outside normal business activities, does not pose a high risk to the rights and freedoms of individuals and does not include data relating to criminal convictions or to a large extent data of a special category.