[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLopvIXuD14BLANsDFabJnEi_GfSzP1bZo22Kz4T6OJc":3},{"tableOfContents":4,"markDownContent":5,"htmlContent":6,"metaTitle":5,"metaDescription":5,"wordCount":7,"readTime":7,"title":8,"nbDownloads":7,"excerpt":5,"lang":9,"url":10,"intro":11,"featured":4,"state":12,"author":13,"authorId":14,"datePublication":20,"dateCreation":21,"dateUpdate":21,"mainCategory":22,"categories":38,"metaDatas":44,"imageUrl":45,"imageThumbUrls":46,"id":54},true,null,"\u003Ch2>525,000€ for not having a EU representative\u003C/h2>\r\n\u003Cp>On May 12, 2021, the Dutch supervisory authority imposed a \u003Ca href=\"https://edpb.europa.eu/news/national-news/2021/dutch-dpa-imposes-fine-eu525000-locatefamilycom_en\" rel=\"nofollow\">penalty\u003C/a> of \u003Cstrong>€525,000\u003C/strong> on a \u003Cstrong>Canadian company that had no representative in the European Union (EU)\u003C/strong>.\u003C/p>\r\n\u003Cp>The website \u003Cstrong>Locatefamily.com\u003C/strong>, published by the eponymous company under Canadian law, is active in the search for people who could be in its family. As such, it publishes the names, addresses and telephones of people without obtaining their consent.\u003C/p>\r\n\u003Cp>The company had \u003Cstrong>no establishment in the EU\u003C/strong> and processed the \u003Cstrong>data of at least 700,000 Dutch people\u003C/strong>.\u003C/p>\r\n\u003Cp>The Dutch supervisory authority received \u003Cstrong>dozen of complaints\u003C/strong> about this site and the difficulties in having personal information removed from the site. The people concerned were not informed that their personnal data were made public and could be surprised to see someone knocking on their door.\u003C/p>\r\n\u003Cp>A \u003Cstrong>cooperation\u003C/strong> process was set up between \u003Cstrong>9 national supervisory authorities\u003C/strong> in conjunction with the \u003Cstrong>European Data Protection Board\u003C/strong> to provide a response to the complainants.\u003C/p>\r\n\u003Cp>The Canadian supervisory authority, the \u003Cstrong>Office of the Privacy Commissioner of Canada\u003C/strong>, was also involved in the process.\u003C/p>\r\n\u003Cp>A \u003Cstrong>fine\u003C/strong> was imposed largely for \u003Cstrong>failure to appoint a representative in the EU\u003C/strong> within the meaning of \u003Cstrong>Article 27 of the GDPR\u003C/strong>. Indeed, the \u003Cstrong>absence of a representative prevented data subjects from turning to a European structure in order to exercise their rights\u003C/strong>, in particular their right of opposition and erasure.\u003C/p>\r\n\u003Cp>This is the \u003Cstrong>first time\u003C/strong> that an supervisory authority has sanctioned a data controller for this type of violation.\u003C/p>\r\n\u003Ch2>What is a representative?\u003C/h2>\r\n\u003Cp>The \u003Cstrong>recital 80\u003C/strong> and \u003Cstrong>article 27 of the GDPR\u003C/strong> provide us with some answers.\u003C/p>\r\n\u003Cp>The representative is defined as \" \u003Ci data-tomark-pass=\"\">\u003Cstrong>a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation\u003C/strong>\u003C/i>\" (Article 4 of the GDPR).\u003C/p>\r\n\u003Ch2>Under what conditions should a representative be appointed?\u003C/h2>\r\n\u003Cp>\u003Cstrong>The representative must be appointed under the following conditions\u003C/strong>:\u003C/p>\r\n\u003Cul>\r\n\u003Cli>he must represent a \u003Cstrong>controller\u003C/strong> or the \u003Cstrong>processor\u003C/strong> that is \u003Cstrong>not established in the EU\u003C/strong>;\u003C/li>\r\n\u003Cli>the controller or processor processes \u003Cstrong>data of data subjects who are located in the EU\u003C/strong>;\u003C/li>\r\n\u003Cli>the \u003Cstrong>processing activities\u003C/strong> are related to the \u003Cstrong>provision of goods or services to those data subjects\u003C/strong> in the EU, whether or not payment is requested, or to the \u003Cstrong>monitoring of their behavior\u003C/strong>, to the extent that it takes place within the EU.\u003C/li>\r\n\u003C/ul>\r\n\u003Cp>In practice, the use of personal data of individuals in the EU in the context of a record on a website constitutes an offer of goods and services to those individuals.\u003C/p>\r\n\u003Cp>\u003Cstrong>This rule does not apply if\u003C/strong>\u003C/p>\r\n\u003Cul>\r\n\u003Cli>\u003Cstrong>the controller or processor is not required to keep a register of processing activities\u003C/strong> or categories of processing activities. Indeed, the criteria for exemption are the same (occasional processing, processing that does not involve sensitive data or infringement data);\u003C/li>\r\n\u003Cli>if \u003Cstrong>the controller or procesor is a public body or public authority\u003C/strong>.\u003C/li>\r\n\u003C/ul>\r\n\u003Ch2>How do you appoint a representative?\u003C/h2>\r\n\u003Cp>A \u003Cstrong>written mandate\u003C/strong> by the controller or processor is required.\u003C/p>\r\n\u003Ch2>What are the responsibilities?\u003C/h2>\r\n\u003Cp>The representative is the \u003Cstrong>point of contact\u003C/strong> for supervisory authorities in the EU and \u003Cstrong>acts on behalf of the controller or processor in the context of their obligations under the GDPR\u003C/strong>.\u003C/p>\r\n\u003Cp>The representative \u003Cstrong>may be subject to prosecution by the supervisory authorities\u003C/strong> for non-compliance by the controller and processor but \u003Cstrong>this does not prevent the controller or processor from being subject to enforcement action directly\u003C/strong>. The fine of Locatefamily.com is a good example.\u003C/p>\r\n",0,"Why you should appoint a representative in the EU","en","why-should-appoint-eu-representative","The Dutch supervisory authority imposed on May 12, 2021 a penalty of 525,000 euros on a Canadian company that had no representative in the European Union (EU).\r\n","Published",{"id":14,"displayName":15,"avatarUrl":16,"bio":17,"blogUrl":18,"color":5,"userId":14,"creationDate":19},31,"Jérôme de Mercey","https://static.dastra.eu/tenant-10/avatar/31/Zuh7XFZe5EnnTo/design-sans-titre-2-150.png","COO/cofounder","https://www.dastra.eu","2021-11-15T12:57:57","2021-05-23T21:03:51.034","2021-05-24T03:25:40.1434061",{"id":23,"name":24,"description":25,"url":26,"color":27,"parentId":5,"count":5,"imageUrl":5,"parent":5,"order":7,"translations":28},2,"Blog","A list of curated articles provided by the community","blog","#28449a",[29,32,35],{"lang":30,"name":24,"description":31},"fr","Une liste d'articles rédigés par la communauté",{"lang":33,"name":24,"description":34},"es","Una lista de artículos escritos por la comunidad",{"lang":36,"name":24,"description":37},"de","Eine Liste von Artikeln, die von der Community verfasst wurden",[39],{"id":23,"name":24,"description":25,"url":26,"color":27,"parentId":5,"count":5,"imageUrl":5,"parent":5,"order":7,"translations":40},[41,42,43],{"lang":30,"name":24,"description":31},{"lang":33,"name":24,"description":34},{"lang":36,"name":24,"description":37},[],"https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-1000.jpg",[47,48,49,50,51,52,53],"https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-1000.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-1500.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-800.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-600.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-300.webp","https://static.dastra.eu/content/5fd34248-ad61-487f-bf61-70ae6f8900af/christian-lue-c241mbgtgys-unsplash-100.webp",2428]