Selling goods or services into the EU or EEA after Brexit – do you need to appoint an EEA Representative for your business?

Many UK businesses sell their goods or services to customers throughout the EEA, especially as the share of markets sold via e-commerce continues to increase. One negative consequence of Brexit may be that, following the end of the Transition Period (31 December 2020), businesses selling to customers in the EEA will need to appoint a local Representative as customers’ “point of contact” for data protection matters in the EEA.

There are two exemptions from the requirement:

•    Public authorities are exempt; and
•    Businesses who meet all three of the following criteria are also exempt, being those whose activities in advertising to and selling to EEA subjects:   
     o    Is occasional (meaning not carried out regularly and not part of the regular course of the business or activity of the seller);
     o    Presents a low risk to the data protection rights of those individuals; and
     o    Does not make large-scale use of special category data.

If you consider yourself to be exempt

Many businesses will consider themselves to be exempt. In most cases, this will be legitimate. In some cases, it will be an artificial thought process designed to avoid the work and expense of establishing a Representative.

It is essential that, if you consider yourself to be exempt under the above rules, you have a properly documented and reasoned management note setting out the considerations that you have gone through and how you reached your decision. Even if the applicable authority reaches a different conclusion to you following an investigation, it will be powerful mitigation for you to demonstrate that you have put careful thought into the matter (rather than simply making an arbitrary snap decision). Please contact me if you would like to talk through your circumstances as part of this assessment process. It will be further mitigation if you can demonstrate that you have sought legal advice (provided that you didn’t then ignore the advice!)

If you do not consider yourself to be exempt

For businesses who are part of a group including other companies based in the EEA, this will be relatively straightforward – but still requires action. In order for (e.g.) your French sister company to become your Representative, you will need (i) a formal contract detailing that relationship, and (ii) updates to your privacy policy and website to ensure that customers and regulators can easily see who the Representative is. Please contact me if you would like help putting these documents together and/or updating them.

For businesses who are not in this kind of group, the position is more difficult. You would need to appoint an individual or business within the EEA to act as a your Representative. As you might expect, they are likely to want to charge you for being so appointed! There are a number of organisations advertising such services on Google, with varying degrees of apparent professionalism. The European Data Protection Board (EDPB) seems to think that professionals such as accountants and solicitors in the EEA would be willing to take on this role. From an informal sampling of my contacts, I have not found many people willing to commit to doing so at this stage. For those businesses falling in this category, it may be that this needs to be added to the list of items to be dealt with in the last couple of months of the Transition Period, when hopefully the EDPB has been able to provide greater clarity on the issue.

If you would like to discuss your individual circumstances, please contact me on 01522 542211 or 07818 253008 or emclaughlin@sillslegal.co.uk