The General Data Protection Regulation applies to any data controller and processor who deals with the data of EU citizens or residents, whether the data handler is based within the European Union or not.
In addition to ensuring that they meet general compliance standards, companies based outside the EU need to take steps to make themselves available to the regulatory authorities when required. Perhaps the key step in this requirement is to appoint a GDPR Data Representative within an EU member state.
What is a European Union GDPR Data Representative?
As a quick reminder, the Data representative is described under Article 27(3) of the GDPR. It states that the representative must;
“…be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.”
The appointee may be either a natural or legal person based in any member state of the EU. The representative acts as a point of contact for European Union or the relevant state GDPR enforcement authorities for any issue or query related to your data handling.
Where Should the Data Representative Be Based?,
Simply put, an EU data representative can be located in any member state of the European Union. ‘Where should an EU data representative be located?’ is, however, a much more interesting question.
For many American companies, the UK must have seemed like a good option when the GDPR was first being discussed. Shared history, culture, and more significantly the English language and the common law legal system offered obvious advantages to those more familiar with US business practices. Alas, Brexit has removed the United Kingdom from the list of options for those wishing to appoint an EU data representative for the first time, and perhaps more significantly, companies that had already appointed a UK-based representative, may now need to nominate a new one.
As already stated, the representative can be based in any one of the 27 member states of the European Union. Which one, however, is best for your business? The Republic or Ireland is rapidly emerging as the simplest, and best, choice for companies headquartered in the Anglosphere.
Why is Ireland an Attractive Option?
All of the advantages briefly mentioned above that the pre-Brexit UK could have boasted as a suitable choice for a representative office apply to Ireland, so it’s important to consider those points in a little more detail.
Ireland’s two official languages are Gaelic Irish and English and although Gaelic is defined as the ‘first’ language in the Irish constitution, English is in reality the common tongue of 21st century Ireland. Undoubtedly, it must be recognised that many European professionals speak fluent English, but nonetheless it is reassuring for any business person to correspond and communicate in his or her own language with fellow native speakers.
Legal System in Ireland
Following the completion of Brexit, the only EU member state which shall function on a common law system will be Ireland. Admittedly, Maltese law incorporates some common law principles but it is equally influenced by continental civil law, it is therefore more accurately described as a mixed, or hybrid, legal system. The majority of EU states use variants of the French Napoleonic code. It would be misleading to suggest that there is anything to fear in these systems, or that they are in any way ‘wrong’; the member states of the European Union are perfectly functional democracies with excellent human rights records after all! Nonetheless, the similarity of the Irish legal approach, i.e. another common law legal system, makes things a great deal easier for the average US company. Like the UK, Ireland overall has a very similar approach to the American system on most legal questions. It is perhaps true to say that the legal system which resembles the British system the most is indeed that of Ireland (which is of course, rather logical given the shared history of the two neighbouring nations). For a company already used to dealing with the UK, the opening of an EU representative office in the Republic of Ireland is, therefore, the most obvious and logical option for any obligatory readjustment following Brexit.
Additional Advantages of Ireland
Ireland’s regulation approach has been described as ‘amicable’ in general when compared to its continental neighbors. In fact the Irish regulator, the Data Protection Commission or DPC, has a statutory obligation to seek an amicable resolution to a regulatory complaint if that appears to be at all possible. Interestingly, the DPC is currently responsible for regulating the non-US activity (on a global basis) of Facebook, Google, Twitter, Linkedin, and Microsoft amongst others. It also regulates the Irish state, together with the domestic activities of other smaller companies and organisations. The Irish regulator has approximately 70 employees at present. Therefore Ireland’s DPC is perhaps currently somewhat overstretched. Commission employees must focus their efforts on priorities. To date, no fines against firms which have set up their representative offices in Ireland have yet been issued. Inevitably, this will change sooner or later but it does imply that enforcement against smaller bodies is not presently a priority.
A Skilled Workforce
It is no secret that the Irish tech sector is booming. Global giants such as Google, Microsoft, Intel, Apple and Facebook all have operations in the Republic of Ireland. Many of the reasons for this have been set out above, but the fact that so many IT companies are already in Ireland brings another advantage: the country’s resident tech workforce. Young Irish people have opportunities to train and gain experience with world leading companies right on their doorstep, and additionally , European and international talent continues to be attracted to Ireland’s shores. The expectation is that the aftermath of Brexit, the ‘pull’ of Ireland for IT professionals will strengthen further.
How Does an EU GDPR Representative Function?
One option would be to set up a subsidiary office in Ireland. This would be registered as an Irish Limited Company under the sole ownership of the parent company. The function of the subsidiary office would be, primarily, to respond to any request from the regulator. A subsidiary office can serve as a “One stop shop” for any and all EU matters. The key advantage of this is that any European Union data problems may be dealt with by the same regulator, the Irish DPC, as opposed to dealing with up to 27 state regulators and all of the legal and language differences that would imply.