EU Regulation 2016/679, relating to the protection of natural persons with regard to the processing of personal data, introduces the figure of the representative who, in Article 4, paragraph 1, is defined as follows:

“17) ‘representative’: a natural or legal person established in the Union who, designated by the controller or the processor in writing pursuant to Article 27, represents them with regard to their respective obligations under this Regulation”.

Article 27 of EU Regulation 2016/679, entitled “Representatives of controllers or processors not established in the Union”, in paragraphs 1 and 2 provides as follows:

1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. 2. The obligation laid down in paragraph 1 of this Article shall not apply to: a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or b) public authorities or public bodies.

Article 3, paragraph 2, of the aforementioned Regulation, entitled “Territorial scope” provides as follows:

2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

From the aforementioned regulatory provision it emerges that, in the case of offering goods or services (Article 3, par. 2, letter a), the GDPR also applies to subjects (controller or processor) who are not established in the Union. Therefore, in this case, if the controller or processor is established outside the Union and offers goods or services to data subjects located in the Union, they are required to apply EU Regulation 2016/679. In the case of offering goods or services to data subjects located in the Union, the non-mandatory nature of the appointment of the representative pursuant to Article 27, paragraph 2, letter a) of the GDPR exists only when all the following conditions occur simultaneously:

  • the processing of personal data is occasional;
  • large-scale processing of special categories of data or personal data relating to criminal convictions and offences is not included;
  • the processing is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing.

If all the aforementioned conditions exist, the appointment of the representative is not required.

However, there could be cases in which only some (but not all) of the conditions indicated by the aforementioned Article 27, paragraph 2, letter a) are present.

For example, only the condition “the processing of personal data is not occasional” could occur, or only the conditions “large-scale processing of special categories of data or personal data relating to criminal convictions and offences is not included” and “the processing is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing”).

In these cases, a doubt could arise as to whether the appointment of the representative is mandatory anyway.

From the literal interpretation of the rule, also in relation to recital no. 80, it is clear that the conditions must exist cumulatively, that is, all of them, for the appointment of the representative not to be mandatory.

A deeper examination of the hermeneutic criteria highlights how the Community legislator did not use disjunctions between one condition and another, but - on the contrary - indicated the individual cases listing them separated only by commas.

More specifically, for the last condition ("and is unlikely …"), the conjunction “and” is even used to confirm that this last one must also coexist.

The English version of the GDPR states the same, as does the regulatory technique used by the Community legislator in the entire text of EU Regulation 2016/679, since - where the existence of specific conditions was to be specified - the individual cases were expressly indicated by listing letters (a, b, c, etc.). Moreover, this interpretation is confirmed by the presence, in Article 27, paragraph 2, of letter b) and this attests that the Community legislator wanted to concentrate in letter a) a single condition although composed of multiple cases.

Therefore, even in the absence of only one of the conditions provided for by the aforementioned letter a) of Article 27, paragraph 2, or in the presence of only some of them but not all, the appointment of the representative is mandatory.