Rina Steenkamp - Privacy and technology

My annotated General Data Protection Regulation

Chapter IV Controller and processor

Section 1 General obligations

Article 25 Representatives of controllers not established in the Union

October 2013

Article 25(1)

1. In the situation referred to in Article 3(2), the controller shall designate a representative in the Union.

Article 25(2)

2. This obligation shall not apply to:

Article 25(3)

3. The representative shall be established in one of those Member States where the offering of goods or services to the data subjects, or the monitoring of them, take place.

Article 25(4)

4. The designation of a representative by the controller shall be without prejudice to legal actions which could be initiated against the controller itself.

[Source: October 2013]

Recital 63

(63) Where a controller not established in the Union is processing personal data of data subjects in the Union, the controller should designate a representative, unless the controller is established in a third country ensuring an adequate level of protection, or the processing relates to fewer than 5000 data subjects during any consecutive 12-month period and is not carried out on special categories of personal data, or is a public authority or body or where the controller is only occasionally offering goods or services to such data subjects. The representative should act on behalf of the controller and may be addressed by any supervisory authority.

Recital 64

(64) In order to determine whether a controller is only occasionally offering goods and services to data subjects in the Union, it should be ascertained whether it is apparent from the controller's overall activities that the offering of goods and services to such data subjects is ancillary to those main activities.

[Source: October 2013 | Notes: Recitals | Context: Recitals]

January 2012

Explanatory memorandum

3.4. Detailed explanation of the proposal

Article 25 obliges under certain conditions controllers not established in the Union, where the Regulation applies to their processing activities, to designate a representative in the Union.

[Source: January 2012 | Context: Proposal from the European Commission]

Article 25(1)

1. In the situation referred to in Article 3(2), the controller shall designate a representative in the Union.

Article 25(2) [Amended: October 2013]

2. This obligation shall not apply to:

Article 25(3) [Amended: October 2013]

3. The representative shall be established in one of those Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.

Article 25(4)

4. The designation of a representative by the controller shall be without prejudice to legal actions which could be initiated against the controller itself.

[Source: January 2012 | Context: Proposal from the European Commission]

Recital 63 [Amended: October 2013]

(63) Where a controller not established in the Union is processing personal data of data subjects residing in the Union whose processing activities are related to the offering of goods or services to such data subjects, or to the monitoring their behaviour, the controller should designate a representative, unless the controller is established in a third country ensuring an adequate level of protection, or the controller is a small or medium sized enterprise or a public authority or body or where the controller is only occasionally offering goods or services to such data subjects. The representative should act on behalf of the controller and may be addressed by any supervisory authority.

Recital 64 [Amended: October 2013]

(64) In order to determine whether a controller is only occasionally offering goods and services to data subjects residing in the Union, it should be ascertained whether it is apparent from the controller's overall activities that the offering of goods and services to such data subjects is ancillary to those main activities.

[Source: January 2012 | Notes: Recitals | Context: Proposal from the European Commission, Recitals]

Directive 95/46/EC

Chapter I General provisions

Article 4 National law applicable

Article 4(2)

2. In the circumstances referred to in paragraph 1 (c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.

[Context: Article 4 Directive 95/46/EC]