10 Become A Representative Related Projects That Can Stretch Your Creativity

What Is a UK Representative and Why Do You Need One?

Natacha has held various senior positions at the Foreign Office, djngo.or.kr including as the Deputy Ambassador for China and Director of Economic Diplomacy and Emerging Powers. She has also worked on global trade policy and international issues of development.

Businesses established outside of the UK must adhere to UK privacy laws. They must appoint a Representative in the UK to act as their point of contact for data subjects as well as the ICO.

What is what is a UK representative?

The UK Representative is a person, company or other entity that has been formally authorised by a processor or controller of data to act on their behalf in relation to all matters around GDPR compliance. They will be the primary contact avon for representatives all queries from individuals exercising their rights or requests from supervisory authorities. They may also be subject to national regulations that have been put in place due to the GDPR’s extraterritorial scope (see the UK case Rondon against LexisNexis Risk Solutions).

The EU GDPR Article 27 and its UK equivalent, Section 3.2.2 of the Data Protection Act 2018, require the appointment of a representative. This requirement is applicable to all organizations that do not have a permanent location in the United Kingdom but offer goods or services or monitor the behavior of those who reside there or handle personal data. The Representative must be able provide proof of their identity, and also prove that they are able to represent the data processor or controller in connection with UK GDPR obligations.

In addition to serving as a portal for individuals to exercise their rights under GDPR and rights, the representative must be in a position to communicate with authorities in the event of a breach. The Representative must notify the supervisory authority who appointed them, regardless of whether or not the breach affects data subjects across multiple jurisdictions.

It is important that the representative you choose has experience working with both European and UK data protection authorities. It is also important that they are fluent in the local language as they are likely to receive calls from both individuals and data protection authorities in the countries where they work.

While the EDPB states that the Representative should be held accountable in the event of non-compliance, the UK court case of Rondon v LexisNexis UK Ltd (2019) EWHC 1427 has confirmed that a Representative can’t be sued by a person for the inability to comply with the UK GDPR. The court concluded that the Representative was not in direct connection to the processing of data by the entity being represented.

Who is required to appoint the UK Representative?

The EU GDPR requires that non-EU businesses with no office or branch within the EU that market their goods or services at European citizens, must designate representatives. This is in addition to requirements from national laws on data protection. The role of a representative is to serve as an individual point of contact for individuals and supervisory bodies regarding GDPR concerns.

The UK has a similar requirement to the EU as laid out in Article 27 of UK-GDPR. As with the EU requirement the threshold is lower for any company that provides products or services to, or monitors the behavior of, data subjects in the UK must designate a UK representative.

Under the UK-GDPR, a Representative must be mandated in writing “to be addressed, in addition or alternatively, addressed on behalf of the controller or processor, by data subjects and the British Information Commissioner’s Office[British Information Commissioner’s Office]”. They are not able to be held personally liable for the GDPR’s compliance. However, they must cooperate with supervisory authorities in formal proceedings and receive information from data subjects exercising their rights (access request and right to be forgotten, etc. ).

Representatives should be located within the EU member state where the individuals whose data are being processed reside. In most cases this isn’t an easy decision to make and a careful analysis of the legal and business context is required to assess the location(s) best suited to an organization. We provide a service that helps organisations determine their needs and select the most appropriate representative location.

It is also advisable that Representatives have experience in interacting with both supervisory authorities and handling data subject requests. Language skills in the local language can also be essential, as the job may require dealing with inquiries by supervisory authority or data subjects in multiple countries throughout Europe.

The identity of the Representative should be clarified to the individuals who are data subjects by incorporating their details in privacy policies and the information provided to individuals prior to collecting their personal data (see Article 13 UK-GDPR). The UK Representative’s contact details should also be made available on your website, giving the authorities in charge of supervision easy access to connect with them.

When do you need to designate a UK Representative?

If your organisation is based outside the UK, offers goods or services to individuals within the UK, or monitors their behaviour and conducts surveillance, you may have to select an UK Representative. The UK’s applied EU GDPR regime is available to established entities outside the UK that are performing activities in the UK. It has the same extraterritorial reach as EU GDPR, with some exceptions. Take our free self-assessment to check if you’re subject to this obligation.

A representative is appointed by the appointing entity in the terms of a service contract to represent that entity with regard to specific obligations under UK and EU GDPR if applicable. In the UK this would typically involve facilitating communications between the entity that appointed the representative and the Information Commissioner’s Office or any data subjects that are affected in the UK. A Representative can either be an individual or a company with a UK base. The appointing body must inform the data subjects that the Representative is processing their personal data and that the identity of the individual or company is readily accessible to supervisory authorities.

In accordance with Articles 13 and 14 of the UK GDPR, the appointing entity is also required to provide the contact details of its representative to the ICO as well as to people who have data in the UK. It is imperative to make clear that a representative’s role is different from that of the position of a Data Protection Officer (DPO) that requires a certain degree of autonomy and independence not possible for p.r.os.p.e.r.les.c representatives.

If you are required to appoint a UK representative the process should be completed in the earliest time possible. This is due to the fact that this requirement is required either immediately following Brexit (if it’s an “hard” or “no deal” Brexit) or following an implementation period (if it is a “soft” or “with deal”. There is no grace time.

What are the requirements for a UK Representative?

According to UK laws on data protection the definition of a representative is a person, or a business who is “designated” in writing by an entity which has no physical presence in the UK however is subject to the law. The UK representative must be able to represent an entity with respect to its legal obligations. The contact information of the representative should also be accessible to UK residents whose personal details are processed by a non-UK company.

The person who is the UK Representative must be a senior worker of the overseas media or business organization and has been enlisted and appointed as an employee outside of the UK by the media or business organisation. The visa applicant must intend to serve as the UK representative for the business or media organisation full-time, and must not be engaged in other business activities in the UK.

In addition the visa holder must demonstrate the necessary knowledge and skills to fulfill their duties as a UK Representative which includes serving as the local contact for inquiries from data subjects as well as the UK data protection authorities. The UK Representative must have the experience and knowledge of UK data protection laws to be able to respond to any inquiries and requests from data protection authorities as well as individuals exercising their rights.

As the Brexit process continues it is likely that the UK laws on data protection are going to change as time passes. However, at present it is expected of companies that are not based in the UK, but do business in the UK and collect personal data on individuals in the UK to choose UK Representatives.

This is because article 27 of the GDPR in the United Kingdom, which was retained as becoming an avon representative UK national law, requires entities without a UK-based presence to appoint the position of a UK data protection representative. If you’re not sure if you’re required to have a UK representative for data protection It is recommended to seek out a knowledgeable legal advisor.