Canadian Organizations Take Note – Data Protection Authority Fines Foreign-based Business Under GDPR For Not Having "Article 27" Representative

As we have discussed in several previous articles, Canadian businesses and other organizations can be subject to the European General Data Protection Regulation ("GDPR") for a number of reasons and in a number of different contexts, be it as a "data processor" (i.e. the service provider to the data controller), as "data controller" (the organization deemed in control of the personal data at issue) or as "joint controller" with another organization, irrespective of whether the Canadian concern has a physical presence in the EU. The requirement to have an "Article 27" representative has existed since the inception of the GDPR but it has been an elusive and quite enigmatic requirement. Not to be confused with the concept of a "Data Protection Officer", an "Article 27 representative" should serve as a contact and gatekeeper for matters pertaining to the processing of EU personal data. This requirement had not at first been enforced but this appears to be changing with a