Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:35Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 26 GDPR|←]] Article 27 - Representatives of controllers or processors not established in the Union [[Article 28 GDPR|→]]
|-
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

==Legal Text==
<br /><center>'''Article 27 - Representatives of controllers or processors not established in the Union'''</center>

<span id="1">1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.</span>

<span id="2">2. The obligation laid down in paragraph 1 of this Article shall not apply to:</span>

::<span id="2a">(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or</span>

::<span id="2b">(b) a public authority or body.</span>

<span id="3">3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.</span>

<span id="4">4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.</span>

<span id="5">5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.</span>

==Relevant Recitals==
{{Recital/80 GDPR}}

==Commentary==
The aim of Article 27 GDPR is to ensure that the level of protection afforded to EU-based data subjects is not reduced where non-EU based controllers or processors process their data. It aims to both provide a contact point for data subjects and ensure that there is legal accountability for processing activities by mandating the appointment of a representative. This representative can be subject to enforcement proceedings in the event of non-compliance with the GDPR. Article 27 GDPR also helps to clarify the scope of obligations placed on controllers and processors based outside of the EU.

===(1) Conditions for Applicability===
Where [[Article 3 GDPR|Article 3(2) GDPR]] applies,<ref>Article 3(2) GDPR can be divided into two requirements: first, there must be processing by a controller or processor who is not established in the Union, and second, the processing activities must relate either to the offering of goods or services, or to the monitoring of the behaviour of the data subjects within the Union.</ref> the controller or processor must designate a representative in the Union.<ref>If a “''controller or processor not established in the Union but subject to the GDPR fails to designate a representative in the Union it would therefore be in breach of the Regulation''”. See EDPB, ‘Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 23 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf here]).</ref> In practice, the function of “''representative in the Union''” can be exercised based on a contract concluded with an individual or an organisation. It can therefore be assumed by a wide range of commercial and non-commercial entities, such as law firms, consultancies, or private companies, provided that they are established in the Union. However, according to the EDPB, the role should not overlap with the DPO’s given its requirement for independence.<ref>EDPB, ‘Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 24 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf here]).</ref> The designation must be done in written form.<ref>Some commentators argue that the mandate must<span lang="EN-GB">The aim of Article 27 GDPR is to ensure that the level of protection afforded to EU-based data subjects is not reduced where non-EU based controllers or processors process their data. It aims to both provide a contact point for data subjects and ensure that there is legal accountability for processing activities by mandating the appointment of a representative. This representative can be subject to enforcement proceedings in the event of non-compliance with the GDPR. Article 27 GDPR also helps to clarify the scope of obligations placed on controllers and processors based outside of the EU. </span> be in writing in order to be valid. This would be necessary to guarantee the authenticity of the mandate and to ensure a certain tangibility of the parties involved. Qualified electronic signature or other equivalent method would also be admissible. In this sense, this agreement could not be concluded by email. See, ''Martini'', in Paal, Pauly, DS-GVO BDSG, Article 27, margin numbers 17-20 (C.H.Beck 2021, 3rd Edition).</ref> The GDPR does not specify any particular requirements for the representative.<ref>Though the Article does little to elaborate o<span lang="EN-GB">The aim of Article 27 GDPR is to ensure that the level of protection afforded to EU-based data subjects is not reduced where non-EU based controllers or processors process their data. It aims to both provide a contact point for data subjects and ensure that there is legal accountability for processing activities by mandating the appointment of a representative. This representative can be subject to enforcement proceedings in the event of non-compliance with the GDPR. Article 27 GDPR also helps to clarify the scope of obligations placed on controllers and processors based outside of the EU. </span>n the nature of this requirement, such as what the consequences are if this requirement is breached, it is one step towards establishing accountability for non-EU based actors who process data. Indeed, this is what ''Millard'' and ''Kamarinou'' have labeled as enhancing the “''practical-procedural traction of the GDPR''”. See, ''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 27 GDPR, pp. 595-596 (Oxford University Press 2020).</ref> Thus, under Article 1(17) GDPR, it can be any natural or legal person which is capable of representing the controller or processor "''with regard to their obligations under this Regulation''".<ref>''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 27 GDPR, pp. 595-596 (Oxford University Press 2020).</ref>

<u>'''[copied from definition:]'''</u>

''In this regard, the notion of a representative becomes relevant in terms of actors that are falling within the territorial scope of the GDPR without having any establishment within the union (see [https://gdprhub.eu/index.php%3Ftitle=Article_3_GDPR Article 3(2) GDPR] and Recital 80 GDPR).<ref>According to which the GDPR applies to controllers outside the union processing personal data on subjects within the union ''“related to the offering of goods or services“'' or ''“the monitoring of their behaviour”''.</ref> In such cases, the representative becomes the addressee of enforcement proceedings in the event of non-compliance of the respective controller or processor.<ref>Recital 80 sentence 6 GDPR.</ref> This way, the representative prevents such actors only established in a third country to become “infeasible” for data subjects and DPA’s within the union. Examples for representatives may therefore be designated employees, lawyers or whole firms established within the union.<ref>''Gola'', in Gola, DS-GVO, Article 4 GDPR, margin number 106 (C.H. Beck 2018).</ref>''

''The designation shall happen in a written form, containing the a mandate to represent the controller or processor under the obligations from the GDPR.<ref>Recital 80 sentences 3, 4 GDPR.</ref> At the same time. the designation of a representative does not exclude the responsibility or liability of the controller or processor themselves.<ref>Recital 80 sentence 5 GDPR.</ref> However, it remains unclear how entities not providing a representative may be tackled by the GDPR.<ref>''Ziebarth'', in Sydow, Europäische Datenschutzgrundverordnung, Article 4 GDPR, margin number 204 (Nomos 2018).</ref> This goes especially for public authorities that are excluded from the designation of a representative.<ref>''Klabunde'', in Ehmann, Selmayr, DS-GVO, Article 4 GDPR, margin number 52 (C.H. Beck 2017).</ref>''
===(2) Exemptions===
The requirement to designate a representative is not absolute. Article 27(2) GDPR presents two instances in which the requirement to have a representative does not apply. These are (a) when the processing is occasional, does not include data covered by [[Article 9 GDPR]] or [[Article 10 GDPR]], and is unlikely to result in a risk to the rights and freedoms of natural persons, and (b) when the processing is done by a public authority or body.
====(a) Processing Which is Occasional and Does Not Include Data in the Sense of [[Article 9 GDPR|Articles 9]] and [[Article 10 GDPR|10 GDPR]]====
Article 27(2)(a) GDPR states that the requirement to designate a representative does not apply if the processing meets three cumulative conditions. First, the processing must be "''occasional''". Second, it must not include "''processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10''" on a large scale. Third, the processing must be "''unlikely to result in a risk to the rights and freedoms of natural persons''".

The term "''occasional''" has been interpreted by the WP29 to mean processing that is not carried out regularly and that falls outside of the scope of the regular activities of the controller or processor.<ref>WP29, ‘Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR’, p. 2 (available [https://ec.europa.eu/newsroom/article29/redirection/document/51422 here]). This position paper has been endorsed by the EDPB on 19 April 2018.</ref> Similarly, ''Millard'' and ''Kamarinou'' have interpreted the term "''occasional''" to mean "''non-systematic''" processing, or in other words, processing that happens on an ad hoc and infrequent basis and not in a regular way.<ref>''Millard, Kamarinou'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 27 GDPR, p. 595 (Oxford University Press 2020).</ref>

The second condition requires that the processing does not use the categories of data covered by Articles 9 and 10 GDPR on a “''large scale''”. What meaning should be assigned to the expression “''large scale''” is not entirely clear.<ref>''Hartnung'', in Kühling, Buchner, DS-GVO BDSG, Article 27 GDPR, margin numbers 9 (C.H. Beck 2020, 3rd Edition).</ref> According to Recital 91, it should concern "''a considerable amount of personal data'' [...] ''which could affect a large number of data subjects''".

Finally, the third requirement specifies that the processing must be “''unlikely to result in a risk to the rights and freedoms of a natural person''”. Recital 75 GDPR sets out that when the risk to the rights and freedom of data subjects is being assessed, special consideration should be given to both its likelihood and severity. This includes, ''inter alia'', risks of discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage.

The unifying factor of these three conditions seems to be the existence of processing which is in some way 'non-negligible' because of its scale, the data processed, or its possible negative consequences. In all the other cases, an EU representative must be appointed and the exemption in Article 27(1)(a) GDPR cannot apply.
====(b) Processing Carried Out by a Public Authority or Body ====
The second exemption to the requirement to designate a representative applies if the non-EU controller or processor is a public authority or body. It is up for the supervisory authority to assess on a case-by-case basis what constitutes a public authority or body. However, instances in which a public authority or body in a third country would be monitoring the behaviour of data subjects in the Union, or offering them goods or services, are likely to be limited.

===(3) Place of Establishment of the Representative===
Article 27(3) GDPR states that the representative of the controller or processor shall be established in one of the Member States where the data subject is located. The EDPB has recommended that “''where a significant proportion of data subjects whose personal data are processed are located in one particular Member State […] the representative is established in that same Member State''”. The main criterion for establishing where a representative should be designated is the location of the data subjects who are subject to the processing.<ref>EDPB, ‘Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 26 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf here]).</ref> One way to interpret this is in the event that there are two member states in which processing takes place, the country which has more data subjects who are subject to the processing should be the country in which the representative is established.

===(4) Obligations and Responsibilities of the Representative===
Article 27(4) GDPR stipulates that the representative shall be responsible for complying with the GDPR in regards to the processing activities that take place. This includes handling requests from data subjects.<ref>''Martini'', in Paal, Pauly, DS-GVO BDSG, Article 27, margin number 52 (C.H.Beck 2021, 3rd Edition).</ref> While not directly responsible for complying with data subject rights, the representative must facilitate the communication between data subjects and the controller or processor represented, in order to make the exercise of data subject rights effective. Under [[Article 30 GDPR]] the representative of the controller or processor must maintain a record of the processing activities performed by the controller or processor. However, the controller or processor themselves are responsible for updating the content of the record, and must provide the representative with up-to-date information. At the same time, the representative must be ready to share this record. The EDPB has also confirmed that the representative must be in a position where it can effectively communicate with data subjects and cooperate with supervisory authorities. Finally, as clarified by Recital 80 GDPR, the representative should also perform its tasks according to the mandate received from the controller or processor, including cooperating with the supervisory authorities regarding any action that may need to be taken in order to comply with the GDPR (Article 31 GDPR). However, the EDPB guidelines on the territorial scope of the GDPR state that the direct liability of the representative is limited to the obligations set out in [[Article 30 GDPR|Article 30]] and [[Article 58 GDPR|Article 58(1)(a) GDPR]]. <ref>EDPB, ‘Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 27-28 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf here]).</ref>
=== (5) Continued Liability ===
Article 27(5) GDPR makes it very clear that the controller or processor cannot escape legal liability by designating a representative. Indeed, it states that legal action can be initiated directly against the controller or processor. This notably happened in a case before the Austrian DPA, in which it chose to address a decision directly to a US company instead of its representative in the Netherlands, because “''Article 27(5) GDPR does not entail a transfer of responsibility''”.<ref>Datenschutzbehörde, 7 March 2019, DSB-D130.033/0003-DSB/2019 (available [https://www.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20190307_DSB_D130_033_0003_DSB_2019_00 here]).</ref>
==Decisions==
→ You can find all related decisions in [[:Category:Article 27 GDPR]]

==References==
<references />

[[Category:GDPR Articles]]

Article 27 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18