Rina Steenkamp - Privacy and technology
Chapter IV Controller and processor
1. In the situation referred to in Article 3(2), the controller shall designate a representative in the Union.
2. This obligation shall not apply to:
3. The representative shall be established in one of those Member States where the offering of goods or services to the data subjects, or the monitoring of them, take place.
4. The designation of a representative by the controller shall be without prejudice to legal actions which could be initiated against the controller itself.
[Source: October 2013]
(63) Where a controller not established in the Union is processing personal data of data subjects in the Union, the controller should designate a representative, unless the controller is established in a third country ensuring an adequate level of protection, or the processing relates to fewer than 5000 data subjects during any consecutive 12-month period and is not carried out on special categories of personal data, or is a public authority or body or where the controller is only occasionally offering goods or services to such data subjects. The representative should act on behalf of the controller and may be addressed by any supervisory authority.
(64) In order to determine whether a controller is only occasionally offering goods and services to data subjects in the Union, it should be ascertained whether it is apparent from the controller's overall activities that the offering of goods and services to such data subjects is ancillary to those main activities.
[Source: October 2013 | Notes: Recitals | Context: Recitals]
Article 25 obliges under certain conditions controllers not established in the Union, where the Regulation applies to their processing activities, to designate a representative in the Union.
[Source: January 2012 | Context: Proposal from the European Commission]
1. In the situation referred to in Article 3(2), the controller shall designate a representative in the Union.
2. This obligation shall not apply to:
3. The representative shall be established in one of those Member States where the data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.
4. The designation of a representative by the controller shall be without prejudice to legal actions which could be initiated against the controller itself.
[Source: January 2012 | Context: Proposal from the European Commission]
(63) Where a controller not established in the Union is processing personal data of data subjects residing in the Union whose processing activities are related to the offering of goods or services to such data subjects, or to the monitoring their behaviour, the controller should designate a representative, unless the controller is established in a third country ensuring an adequate level of protection, or the controller is a small or medium sized enterprise or a public authority or body or where the controller is only occasionally offering goods or services to such data subjects. The representative should act on behalf of the controller and may be addressed by any supervisory authority.
(64) In order to determine whether a controller is only occasionally offering goods and services to data subjects residing in the Union, it should be ascertained whether it is apparent from the controller's overall activities that the offering of goods and services to such data subjects is ancillary to those main activities.
[Source: January 2012 | Notes: Recitals | Context: Proposal from the European Commission, Recitals]
2. In the circumstances referred to in paragraph 1 (c), the controller must designate a representative established in the territory of that Member State, without prejudice to legal actions which could be initiated against the controller himself.
[Context: Article 4 Directive 95/46/EC]