The Importance Of UK Businesses Appointing An EU Data Protection Representative

• Published date: 22 June 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: Shepherd and Wedderburn LLP
• Author: Ms Joanna Boag-Thomson

A recent fine of '525,000 by the Autoriteit Persoonsgegevens (AP), the Dutch Data Protection Authority, has focused attention on one of the least discussed provisions of the GDPR - Article 27. This provision requires those who are subject to the GDPR but who do not have a base in the EU to appoint an EU representative to act as a point of contact for supervisory authorities such as the AP and individuals (data subjects) within the EU. Although the subject of this decision is a website that appears to be based in Canada it is a warning to those businesses within the UK that may not have understood the need to appoint such a representative following the end of the Brexit transition period on 31 December 2020 and the UK's exit from the EU.

The AP had received numerous complaints about a website called Locatefamily.com. The website displayed the personal information (e.g. full addresses and telephone numbers) of people who had not provided their information to the website and were unaware of how the platform had obtained their personal information.

It was the view of the AP that it is unacceptable for a website to publish these details without the individuals' knowledge or consent. It highlighted the importance of having an effective mechanism for the removal of such information at the request of a data subject. This was not possible in this case largely because the website did not have an EU representative.

This is the first time enforcement action has been taken by an authority for a breach of this requirement. The lack of enforcement of this provision to date may have led organisations to believe that this was not a key provision of the GDPR, however this first action suggests otherwise. It will be interesting to see how enforcement of this fine progresses, particularly as it seems unclear who is operating the website. The AP has given the website 12 weeks to pay the fine and to remedy this breach by appointing a representative. If it does not designate a representative in that time it faces an additional penalty of '20,000 every two weeks up to a maximum of '120,000, and it may be that the threat of this additional penalty will result in an acceptable response.

Having had little discussion of the scope of an EU representative's role to date, we also now have further guidance on this point. Although the Dutch decision emphasises the importance of having a representative in place to facilitate enforcement action, the recent High Court case of Rondon v...