![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
England and Wales High Court (Queen's Bench Division) Decisions |
||||||||||
PLEASE SUPPORT BAILII & FREE ACCESS TO LAW
To maintain its current level of service, BAILII urgently needs the support of its users.
Since you use the site, please consider making a donation to celebrate BAILII's 25 years of providing free access to law. No contribution is too small. If every visitor this month gives just £5, it will have a significant impact on BAILII's ability to continue providing this vital service.
Thank you for your support! | ||||||||||
You are here: BAILII >> Databases >> England and Wales High Court (Queen's Bench Division) Decisions >> Sanso Rondon v LexisNexis Risk Solutions UK Ltd [2021] EWHC 1427 (QB) (28 May 2021) URL: https://www.bailii.org/ew/cases/EWHC/QB/2021/1427.html Cite as: [2021] EWHC 1427 (QB) |
[New search]
[Context]
[View without highlighting]
[Printable PDF version]
[Help]
![]() |
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Strand, London, WC2A 2LL |
||
B e f o r e :
____________________
MR BALDO SANSÓ RONDÓN |
Claimant/ |
|
- and – |
Respondent |
|
LEXISNEXIS RISK SOLUTIONS UK LIMITED |
Defendant/ |
____________________
Miss Lorna Skinner QC (instructed by Osborne Clarke LLP) for the Defendant
Hearing date: 20th April 2021
____________________
Crown Copyright ©
Mrs Justice Collins Rice :
Introduction
The Underlying Claim
(1) a compliance order under Section 167 of the Data Protection Act 2018 requiring the Defendant to erase (or cause to be erased) the Claimant's personal data, and restraining the Defendant from further unlawful processing of the Claimant's personal data;
(2) an order under Article 19 of the GDPR that
(a) the Defendant notify (or cause to be notified) each recipient to whom the Claimant's personal data have been disclosed, through their having accessed any version of the profile, of such erasure, and
(b) the Defendant provide the Claimant with details of the identities of the recipients;
(3) compensation pursuant to Article 82 of the GDPR.
The Defendant's Application for a Terminating Ruling
Article 27 GDPR
Representatives of controllers or processors not established in the Union
1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
2. The obligation laid down in paragraph 1 shall not apply to:
(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
(b) a public authority or body.
3. The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
4. The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
5. The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union.
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
3. …
'representative' means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation.
The Rival Interpretations of Article 27
Proposed Aids to Interpretation
(i) The Scheme of the GDPR's Operative Provisions
i) Arts.13 and 14 require the controller to provide the identity and contact details of its representative, as well as its own, to a data subject when it obtains their data.
ii) Art.30 imposes duties on a representative, in addition to those of a controller, to maintain detailed records of processing activities.
iii) Art.31 imposes duties on controllers and representatives to co-operate, on request, with the ICO in the performance of its tasks.
iv) Art.58 requires the ICO's investigative powers to include the ability to order not just a controller but also a representative to provide any information the ICO requires for the performance of its tasks; the ICO's corrective powers by contrast are not (separately) applied to representatives.
(ii) The GDPR Recitals
Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body.
The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority.
The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation.
The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.
Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.
The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.
(iii) EDPB Guidelines 3/2018
As clarified by recital 80, the representative should also perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation. In practice, this means that a supervisory authority would contact the representative in connection with any matter relating to the compliance obligations of a controller or processor established outside the Union, and the representative shall be able to facilitate any informational or procedural exchange between a requesting supervisory authority and a controller or processor established outside the Union.
With the help of a team if necessary, the representative in the Union must therefore be in a position to efficiently communicate with data subjects and cooperate with the supervisory authorities concerned. This means that this communication should in principle take place in the language or languages used by the supervisory authorities and the data subjects concerned or, should this result in a disproportionate effort, that other means and techniques shall be used by the representative in order to ensure the effectiveness of communication. The availability of a representative is therefore essential in order to ensure that data subjects and supervisory authorities will be able to establish contact easily with the non-EU controller or processor. In line with Recital 80 and Article 27(5), the designation of a representative in the Union does not affect the responsibility and liability of the controller or of the processor under the GDPR and shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves. The GDPR does not establish a substitutive liability of the representative in place of the controller or processor it represents in the Union.
It should however be noted that the concept of the representative was introduced precisely with the aim of facilitating the liaison with and ensuring effective enforcement of the GDPR against controllers or processors that fall under Article 3(2) of the GDPR. To this end, it was the intention to enable supervisory authorities to initiate enforcement proceedings through the representative designated by the controllers or processors not established in the Union. This includes the possibility for supervisory authorities to address corrective measures or administrative fines and penalties imposed on the controller or processor not established in the Union to the representative, in accordance with articles 58(2) and 83 of the GDPR. The possibility to hold a representative directly liable is however limited to its direct obligations referred to in articles 30 and article 58(1) a of the GDPR.
It should however be noted that the concept of the representative was introduced precisely with the aim of ensuring enforcement of the GDPR against controllers or processors that fall under Article 3(2) of the GDPR. To this end, it was the intention to enable enforcers to initiate enforcement action against a representative in the same way as against controllers or processors. This includes the possibility to impose administrative fines and penalties and to hold representatives liable.
(iv) The Position of the ICO
It is the view of the ICO that the role of an Article 27 representative of overseas data controllers and processors is limited to that of conduit of communications between the overseas entity and the ICO or relevant data subjects.
Therefore the ICO is not seeking an interpretation of Article 27 that allows representatives to be held directly liable should a controller or processor they represent fail in their data protection obligations.
…
An Article 27 representative does not undertake any other business activity related to the processing of the controller or processor, other than acting as a contact point for data subjects and the ICO. From the point of view of the ICO, the existence of a representative makes it easier to take action against a controller by acting as a conduit, but any enforcement action is directed against the controller itself.
(v) The Data Protection Act 2018
(vi) Article 79 GDPR, the EU Charter and the Principle of Effectiveness
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
The Claimant points out this reflects the general provision made in Art.47 of the EU Charter that everyone whose rights have been guaranteed by the law of the Union has the right to an effective remedy before an independent tribunal if those rights are violated.
(vii) 'Representatives' in other Regulations
For manufacturers who are not established in the Union, the authorised representative plays a pivotal role in ensuring the compliance of the devices produced by those manufacturers and in serving as their contact person established in the Union. Given that pivotal role, for the purposes of enforcement it is appropriate to make the authorised representative legally liable for defective devices in the event that a manufacturer established outside the Union has not complied with its general obligations. The liability of the authorised representative provided for in this Regulation is without prejudice to the provisions of Directive 85/374/EEC, and accordingly the authorised representative should be jointly and severally liable with the importer and the manufacturer. The tasks of an authorised representative should be defined in a written mandate. Considering the role of authorised representatives, the minimum requirements they should meet should be clearly defined, including the requirement of having available a person who fulfils minimum conditions of qualification which should be similar to those for a manufacturer's person responsible for regulatory compliance.
Analysis
(i) General Approach
(ii) The Controller's Perspective
(iii) The Regulator's Perspective
(iv) The Data Subject's Perspective
(v) Overview of the Role and Function of Representatives
(vi) 'Representative Liability' and the Scheme of the GDPR
(vii) 'Representative Liability', the EDPB Guidelines and Other Context
The EDPB furthermore highlights that article 50 of the GDPR notably aims at facilitating the enforcement of legislation in relation to third countries and international organisations, and that the development of further international cooperation mechanisms in this regard is currently being considered.
In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to:
(a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data;
(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms;
(c) engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data;
(d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries.
(viii) 'Representative Liability' and Recital 80
Conclusion