Source: https://igguru.net/2018/06/20/representatives-under-art-27-of-the-gdpr-all-your-questions-answered/
Timestamp: 2019-04-23 02:08:37+00:00

Document:
Some companies outside the EU were supposed to be subject to a similar requirement already before May 25, 2018. Yet, little is known or publicized to date about compliance by companies or standardized processes or enforcement attempts by data protection authorities. It seems that very few foreign companies have appointed representatives in the EU under Article 4 of Directive 95/46/EC, which has provided since 1995 that a “controller must designate a representative established in the territory of [a] Member State” where such controller “makes use of equipment, automated or otherwise, situated on the territory of the said Member State …” Art. 3(2) and 27 of the GDPR expand the requirements to processors and discontinue the limiting condition of local equipment.
Most companies are covered if they are subject to the GDPR but do not maintain an establishment in the EU. Companies have to comply with the GDPR with respect to personal data that pertains to persons who are in the EU if they process such data relating to the monitoring of such persons’ behavior or relating to the offering of goods or services directly to data subjects in the EU. It does not matter whether the company charges for such goods or services. Controllers and processors are covered.
The term “establishment” is not defined, but Recital 22 notes: “Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.” In the context of international tax treaties, the term “permanent establishment” is defined to mean a fixed place of business, such as an office, branch or factory. Most companies try to avoid maintaining a permanent establishment in another country, because it can subject them to double taxation and accounting complexities. Instead, they incorporate a subsidiary, which is responsible for its own local tax filings and its own compliance under data protection laws.
For example, if a U.S. company incorporates a subsidiary company in the EU, such subsidiary company is fully subject to the GDPR and does not have to designate a representative under Art. 27 GDPR. Also, the U.S. company does not become subject to the designation requirement merely by incorporating a subsidiary in the EU. If the U.S. company conducts business with its subsidiary at arm’s length — e.g., subject to a services or distribution agreement — then the EU subsidiary should not be considered as the U.S. company’s own establishment. In that case, which is common in practice, the U.S. company would become subject to the requirement of designating a local representative under Art. 27 GDPR if the U.S. company collects personal data directly from persons in the EU relating to the offering of services, e.g., via a consumer-facing website.
On the other hand, a U.S. company that provides a cloud storage or software-as-a-service solution to EU-based manufacturers of industrial goods would likely not be covered, because the U.S. company does not offer goods or services to data subjects (only to companies), even if it will likely receive and process some personal data (e.g., contact information of the EU corporate customers’ employees).
In terms of active duties, the representative shall maintain records of processing activities for the non-EU based company (which is the one that has to prepare and provide such records, pursuant to Art. 30). And, the local representative shall “cooperate” with the supervisory authority pursuant to Art. 31 on request.
Yes, but only for the representative’s own violations of its own obligations.
If the foreign company commits violations of the GDPR, the data protection authorities in the EU have to impose enforcement proceedings and fines against the foreign company. For administrative convenience, the EU authorities can address summons, orders and fines to the local representative, provided that it is the foreign company that is subject to the sanction. Courts and government agencies outside the EU do not typically cooperate with authorities in the EU regarding the enforcement of orders, injunctions, fines or other sanctions. Therefore, fines imposed under the GDPR against companies outside the EU will be difficult if not impossible to enforce outside the EU, contrary to commonly-made assumptions (see, for example, Tim Bell, “Is Article 27 the GDPR’s ‘hidden obligation’?“, in The Privacy Advisor, May 3, 2018). As a consequence, data protection authorities in the EU can be expected to continue to apply pressure indirectly, e.g., on EU-based subsidiaries and customers of foreign companies, and, going forward, on local representatives of foreign companies.
Also, companies that have appointed an external data protection officer could designate the same person as representative under Art. 27. The data protection officer will usually be involved in inquiries from data protection authorities anyhow and knows how to handle them. But, companies usually appoint individuals, not companies, as data protection officer, and such individuals may become concerned about personal liability as a representative under Art. 27. Also, not all companies that have to appoint a representative under Art. 27 are also subject to the requirement of appointment a data protection officer under Art. 37. Foreign companies will typically appoint a data protection officer in their home jurisdiction, outside the EU, whereas the Art. 27 representative must be in the EU. Moreover, the roles of a representative under Art. 27 and a data protection officer under Art. 37 are quite different, as noted above. The fact that the legal representative is subject to a mandate and instructions whereas the data protection officer has to act independently could create conflicts and put an individual into a difficult position in the context of inquiries or enforcement actions from data protection authorities (see, Thomas Shaw, “How do the DPO and EU representative interplay?“, IAPP Advisor, Jan 23, 2018).
Alternatively, a company could appoint an unaffiliated person or entity. A number of professional services firms are already offering themselves up as representatives. Companies are wary of costs and potential conflicts of interests. Law firms face the issue that such a designation does not constitute “practice of law” for purposes of insurance, VAT/GST and attorney-client privilege. This could create risk management, tax and ethical problems for law firms and their clients, such as implied waivers of attorney-client privilege and conflicts of interest. The representative can be subjected to enforcement actions, which would not be covered by law firm malpractice insurance. Also, joint actions against law firms and their clients create diverging or outright conflicting interests. A law firm cannot as easily or quickly resign from representation of a client as may be necessary in the context of acting as a representative. The representative acts in a non-advisory role, which can destroy attorney-client privilege. If a law firm accepts or responds to an inquiry from a data protection authority to its client, this could constitute a waiver of objections on jurisdictional grounds. Attorneys or auditors face limitations under professional rules and responsibilities regarding what they can communicate on behalf of their clients to an authority whereas Art. 27(4) subjects the representative to a mandate without express limitations or discretion. Also, any professional services firm, including law firms and consulting firms, have incentives to provide additional advice and services to clients. This motivation could create conflicts of interest in the case of inquiries from authorities about compliance with data protection laws.
In light of these considerations, many companies may gravitate towards appointing a subsidiary that they control and which is exposed to inquiries and challenges in any event. Companies that maintain several subsidiaries may select the one that is in the EU member state where it has “EU headquarters” or its largest presence or the presence most involved with the processing of personal data, because that is where it may find its “lead authority” under Art. 56 and possibly apply for binding corporate rules according to Art. 47.

References: Art. 3
 Art. 27
 Art. 27
 Art. 30
 Art. 31
 Art. 27
 Art. 27
 Art. 27
 Art. 37
 Art. 27
 Art. 27
 Art. 37
 Art. 27
 Art. 56
 Art. 47