How To Make A Successful Become A Representative Tips From Home

What Is a UK Representative and Why Do You Need One?

Natacha has served in a number senior positions at the Foreign Office, including as Deputy Ambassador for China and Director of Economic Diplomacy and Emerging Powers. She has also worked on international trade policy and development issues.

Businesses located outside the UK are bound by UK privacy legislation. They must appoint an agent in the UK who will be their point of contact for individuals who have data and the ICO.

What is an UK representative?

The UK Representative is an individual, company or other entity that has been formally authorised by a processor or controller of data to act on behalf of the controller or processor in all matters around GDPR compliance. They will be the primary point of contact for enquiries from individuals exercising their rights, or for requests from supervisory authorities and may also be subject to national requirements which have been implemented in the context of GDPR's extraterritorial reach (see the UK case Rondon v LexisNexis Risk Solutions).

The EU GDPR Article 27 and its UK equivalent Section 3.2.2 of the Data Protection Act 2018, require the appointment of an official representative. The requirement applies to any organization that does not have its own place of business within the United Kingdom and that offers services or goods to or monitors the behaviour of individuals residing in the United Kingdom, or that manages personal data of those individuals. The representative must be able to provide proof of their identity, and that they can represent the controller or processor of data in relation how to become an avon representative (Jewelersmutualgroup published an article) UK GDPR obligations.

As well as acting as become a representative portal for individuals to exercise their rights under GDPR, the Representative must be in a position to communicate with authorities in the event of an incident. This is because the Representative must send a notice to the supervisory authority that appointed them, regardless of whether the breach affects individuals across multiple jurisdictions.

It is essential that the representative you choose has experience working with both European and UK authorities for data protection. It is also recommended for them to speak a local language since they are likely to receive calls from individuals and data protection agencies in the countries they operate in.

While the EDPB states that the Representative must be held accountable in the event of non-compliance, the UK court case of Rondon v LexisNexis UK Ltd (2019) EWHC 1427 has established that a Representative cannot be sued by a person for the data controller's apparent failure to adhere to the UK GDPR. The court found that the Representative did not have a direct connection with the data processing activities of the entity being represented.

Who is required to appoint the UK Representative?

To comply with the EU GDPR, businesses outside of the EU that are targeting goods or services towards European citizens, but do not have an office, branch, or establishment within the EU must appoint an EU Representative. This is in addition to the requirements of national laws on data protection. The function of a representative is to be an individual point of contact for individuals and supervisory authorities in relation to GDPR compliance issues.

The UK has similar requirements to the EU as laid out in Article 27 of the UK-GDPR. The threshold is the same as that of the EU requirement: any organization that offers goods or services in the UK or monitoring the behaviour of data subjects, must appoint an UK Representative.

Under the UK-GDPR, a representative must be appointed in writing "to be addressed, in addition or alternatively addressed, on behalf of the controller or processor by the data subjects and the [British Information Commissioner's Office]". They cannot be personally held accountable for compliance with the GDPR. However they must cooperate with supervisory authorities in official proceedings and receive information from data subjects exercising their rights (access request, right to be forgotten, etc. ).

Representatives must be located in the member state of the European Union in which the individuals whose personal information is processed are residents. This isn't a straightforward decision and requires an extensive legal and business analysis to determine the most suitable location for a company. We offer a dedicated service to help companies assess their needs and choose the most appropriate representative location.

It is also recommended that representatives have previous experience in dealing with both supervisory authority and handling inquiries from data subjects. Language skills in the local area are often of importance as the job is likely to include dealing with inquiries from supervisory authorities or data subject across Europe.

The identity of the representative should be made known to the data subjects through the privacy policies and other information that is provided before collecting data (see article 13 UK-GDPR). Contact information for the UK Representative should be posted on your website so that supervisory authorities are able to easily reach them.

When is the best time to nominate the UK Representative?

If your company is located outside the UK provides goods or services to individuals who reside in the UK or monitors their behavior, you may need to select the position of a UK representative. The UK's applied EU GDPR regime applies for established entities outside the UK which are operating in the UK. It has the same reach as EU GDPR, with some exceptions. You should take our free self-assessment to determine if you are required to comply with this requirement.

A Representative is appointed by the appointing party under an agreement of service to act for that party in relation to specific obligations under UK GDPR and EU GDPR, as applicable. In the UK the primary purpose of this is to facilitate communication between the appointing entity and the Information Commissioner's Office (ICO) or any data subjects affected in the UK. A Representative can be either an individual or a business which is based in the UK. The appointing entity must inform data subjects that their personal information will be processed by the Representative, and the identity of that individual or company must be made easily accessible to supervisory authorities.

The appointing entity must also provide the contact details of its representative to the ICO and the data subjects that are affected in the UK in accordance with Article 13 and 14 of the UK GDPR. It must make it clear that the function of a Representative is different from and incompatible with the duties of the role of a Data Protection Officer ("DPO"), which requires a level of autonomy and independence that cannot be provided by a Representative.

If you are required to nominate an UK representative, you should do so as soon as you can. This is because the requirement arises immediately after Brexit (if there is a 'hard' or 'no deal' Brexit) or after an implementation period (if there is a'soft' or "with deal" Brexit). There is no grace period.

What are the requirements for a UK Representative?

Under the UK law on data protection (and specifically article 27 of the UK GDPR), a representative is an individual or a company that is "designated in writing" by an entity that lacks a presence in the UK but is subject to the rules of the law. The UK representative must be able to represent an entity in relation to its legal obligations. Their contact details should also be readily available to UK residents whose personal information are being processed by a non-UK business.

The individual who is the UK Representative must be a senior worker of the foreign media or business organization and has been hired and appointed as an employee outside the UK by the media or business organisation. The applicant must genuinely intend to work full-time as the UK representative for the media or business organization, and they are not allowed to engage in any other business activity in the UK.

The visa applicant also needs to prove they have the knowledge and experience needed to fulfill their role as UK representative, which involves serving as an individual point of contact for Proceed data subjects and UK data protection authorities. This is to ensure that the UK Representative is knowledgeable of and understanding of the UK data protection laws and can respond to any requests from individuals exercising their rights under the law, as well as any other requests or enquiries received from data protection authorities.

As the Brexit process moves forward, it is likely the UK laws on data protection will be altered over time. In the present, however it is expected of companies that are not based in the UK, but do business in the UK and collect personal information on individuals within the UK to nominate UK representatives.

This is because the UK GDPR requires that entities that do not have a UK presence must appoint representatives under article 27 of the UK GDPR which has been incorporated as a law of the nation in the UK. If you are not sure whether you need to appoint the position of a UK representative for data protection it is recommended that you speak to an experienced lawyer.