What is "special category data"?

We are based in Dublin, Ireland.

We communicate with data subjects and supervisory authorities throughout the EEA. But we don’t set up “postbox” addresses in other countries. This is in our clients’ interests.

We’ll be happy to explain – please contact us.

We’re native English speakers. For other languages, please contact us.

We have a network of lawyers and other professionals from our work in EU litigation and investigations. We know, or know how to find, the right cost-effective expertise in the right country when it’s needed.

For most organisations, a subscription to our service will cost roughly the same as two hours of your usual lawyer’s time each month.

We don’t charge anything else for our time, for the lifetime of your subscription – no matter what happens.

If there are legal or regulatory proceedings in the EEA or UK in relation to our clients’ data protection compliance, we help choose the right legal team and consult with our clients at each step.

We provide detailed service guarantees for these situations, which we will be happy to explain – please contact us.

If your organisation needs a UK representative, you can appoint DataAgent.

We can also act as both UK representative and EU representative if your organisation requires both.  

If you have questions about this, please contact us.

DataAgent can be your EU representative if:

-         your organisation needs an EU representative; and

-         your organisation processes the personal data of data subjects who are in the Republic of Ireland.

This means that, before DataAgent can be your EU representative, you must handle at least some personal data of individuals in Ireland.

Individuals in Ireland do not need to make up a large part of your database or customer base, and it doesn’t matter if you predominantly target other EEA countries. It’s simply necessary that the personal data which your organisation holds includes some information about individuals in the Republic of Ireland.

If you have questions about this, please contact us.

If your organisation is regulated by the UK GDPR but isn't established in the UK, you're likely to need a UK representative.

This means that, in principle, your organisation will need a UK representative if it:

-         doesn't have a continuous presence in the UK (such as a subsidiary, shop, warehouse, office or UK-based employees); but

-         does either monitor the behaviour of UK data subjects or target customers in the UK.

There are exceptions, but they’ll rarely apply to commercial organisations.

If you need to understand your own specific situation, we recommend independent advice.

If your organisation is regulated by the EU GDPR but isn't established in the EEA, you’re likely to need an EU representative.

This means that, in principle, your organisation will need an EU representative if it:

-         doesn't have a continuous presence in the EEA (such as a subsidiary, shop, warehouse, office or EEA-based employees); but

-         does either monitor the behaviour of EEA data subjects or target customers in the EEA.

There are exceptions, but they’ll rarely apply to commercial organisations.

If you need to understand your own specific situation, we recommend independent advice.

If your organisation takes specific steps to provide goods or services to customers in the EEA, this is likely to count as targeting EEA customers.

Similarly, if your organisation takes specific steps to provide goods or services to customers in the UK, this is likely to count as targeting UK customers.

Examples of specific steps aimed at EEA customers might include:

-         Making sales in an EEA currency

-         Translating your website into an EEA language

-         Offering specific terms and conditions or delivery options for customers in the EEA

It’s not necessary in this context that you charge for your products or services. For example, taking specific steps to attract customers to a free online service can also count as “targeting” those customers.

If your organisation tracks or records what individuals do on the internet (such as their clicks, website visits or video views), this can count as monitoring the behaviour of data subjects.

If your organisation records offline activity of individuals – such as attendance at events or movements around retail environments – this may also count as monitoring their behaviour.

If you are in these situations and want to understand your legal position, we recommend specific legal advice.

The UK GDPR regulates organisations which process personal data, and which:

-         are established in the UK; or

-         are not established in the UK, but either (a) monitor the behaviour of data subjects in the UK, or (b) target customers in the UK.

In general, organisations which are not established in the UK, but are regulated by the UK GDPR, do need a UK representative.

The EU GDPR regulates organisations which process personal data, and which:

- are established in the EEA; or

- are not established in the EEA, but either (a) monitor the behaviour of data subjects in the EEA, or (b) target customers in the EEA.
‍

In general, organisations which are not established in the EEA, but are regulated by the EU GDPR, do need an EU representative.

Your organisation doesn’t have to be incorporated in the EEA or UK to count as “established” in those jurisdictions.

For data protection purposes, your organisation is likely to be “established” in a jurisdiction if it has a continuous presence there – which might be a subsidiary, a shop, a warehouse, an office or even just an employee based in the jurisdiction.

In general:

• an organisation will need an EU representative if it is regulated by the EU GDPR, but isn’t “established” in the EEA; and
• an organisation will need a UK representative if it is regulated by the UK GDPR, but isn’t “established” in the UK.

Some organisations will be regulated by both the EU GDPR and the UK GDPR, and won’t be established in either the EEA or the UK. These organisations may require an EU representative and a UK representative.

There are very limited exceptions, for organisations which:

• are public bodies; or
• only carry out occasional, low-risk processing of data subjects’ personal data, and don’t handle special category data.

The exceptions are unlikely to apply to most commercial organisations. But if you think that they might apply to you, we recommend independent legal advice.

A GDPR representative is an organisation based within the EEA or UK jurisdictions that acts on behalf of clients based outside those jurisdictions.

Since the UK left the European Union, there are two kinds of GDPR representative:

• an “EU representative” is an organisation based within the EEA that acts for clients outside the EEA who are required to appoint a representative under the terms of the EU GDPR.
• a “UK representative” is an organisation based in the UK that acts for clients outside the UK who are required to appoint a representative under the terms of the UK GDPR.

GDPR representatives are also sometimes called “Article 27 representatives”, since Article 27 of the EU GDPR and Article 27 of the UK GDPR describe when they’re required.

A GDPR representative has three main tasks:

1. Communicating with data subjects and regulators about clients’ data protection compliance.

As representative for our clients, we communicate with data subjects about what our clients do with their personal data.

We also communicate with supervisory authorities who enforce data protection laws in the EU and UK, on behalf of our clients.

2. Maintaining records of clients’ processing of personal data, and sharing records with supervisory authorities when they ask, as required by Article 30 of the EU GDPR and UK GDPR.

3. Responding to enforcement proceedings when clients fail to comply with data protection laws.

Currently there is legal uncertainty as to whether a GDPR representative can be held liable for its clients’ breaches of data protection laws. But it’s likely that there will be attempts in the future to bring enforcement proceedings against representatives for their clients’ breaches. Representatives will need to respond to those proceedings.