GDPR Representatives of controllers or processors not established in the Union - Is this basically a simple mail-forwarding activity?

Question

Art. 27 of GDPR says that whoever processes data of people located inside the EU (includes storing and deleting in the GDPR definition, with a few exceptions) needs a Representative located inside the EU. This relates to a lot of apps and webpages. The Representative has to answer questions about private data in the name of the processor (who, in this scenario, is not located in the EU), and the Representative is not liable (GDPR says so, but it looks like this is not yet 100% confirmed when you read through various law blogs).

To get such a Representative, one can e.g. rent a service typically for about 100 - 200 EUR per month, and they typically charge another 100 EUR per request (actually, per hour working on a request). This could be quite expensive.

My question is, since to my understanding the Representative just passes requests and answers via mail to the processor (who is outside the EU), couldn't this be any person inside the EU working on much lower cost without real personal risk? The commercial services claim of course that much much work and knowledge is required, but going a few times through the GDPR text, I still see practically a simple mail-forwarding activity as long as the processor provides all required documents in the required form. Businesses inside the EU don't care about this because they get the requests directly, and do the Representative's job by themselves.

Answer 1

Yes, the role of a Representative is largely to serve as a point of contact for supervisory authorities and data subjects. Much of this could be done by a person who just scans and forwards any incoming mail.

In practice, the Representative should be a lawyer or at least a compliance professional in order to fulfil their role effectively, in particular when it comes to a lawsuit or administrative proceedings against the controller/processor. These would be carried out against the representative on behalf of the controller/processor.

Regarding liability, recital 80 explicitly says: “The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.” This doesn't shield the controller/processor from liability, this just simplifies enforcement and ensures that judicial remedies are in fact available to data subjects.

There is a much more imminent consequence for the choice of Representative: which data protection agency will serve as main supervisory authority. Non-EU controllers might prefer the convenience of an English-speaking authority, otherwise (expensive) translation could be needed. Consequently, Representatives based in Ireland are effectively the default choice.

Many representatives do offer extra services, such as offering to serve as a Data Protection Officer. That would help justify the fees. Unfortunately, the conditions for appointing a representative and for appointing a DPO are somewhat different: per the letter of the law many controllers would need a Representative but not a DPO. A Representative is needed as soon as data processing is non-occasional, whereas a DPO would only be needed for processing on a large scale. I'll just add that many controllers forget about that and only think about getting a representative when appointing a DPO. Since the Representative aids enforcement, enforcing against a controller without a Representative is rather difficult, and I don't know of any fines for failing to appoint a Representative.