That Local Representative Problem . . . And The New Guidelines On The Territorial Scope Of The GDPR (Part I)

Companies based outside of the European Union sometimes find it challenging to determine whether the General Data Protection Regulation (GDPR) applies to them. And if they finally work out that the GDPR applies, they then have the challenge of finding a local representative as required by Art. 27. Failing to appoint a local representative when required to do so can trigger fines of 10 million euros, or, if higher, up to 2% of the corporate group's total worldwide annual turnover.

The European Data Protection Board's newly issued guidelines on territorial scope (the "Guidelines") help only slightly with the jurisdictional analysis. In fact, the main news in the Guidelines is almost a footnote to the jurisdictional analysis: In the last paragraph of the Guidelines, the EDPB has confirmed that local representatives appointed under Article 27 are directly exposed to fines, penalties and other liabilities if the company that they represent has breached the GDPR.