导航
GDPR > Recital 80
下载PDF

Recital 80

Recital 80

(80) 非設立於歐盟之控管者或處理者處理歐盟內資料主體之個人資 料,且其處理活動涉及提供貨品或服務時,不問是否需要資料主體付 款,對該等資料主體或對就其發生於歐盟內行為之監控,控管者或處 理者皆應指定其代表,但該處理係出於偶然、不含括大規模涉及特殊類型之個人資料處理、或涉及前科及犯罪之個人資料的處理,且考量 處理之本質、過程、範圍與目的,其不會對當事人之權利與自由造成 風險、或控管者是公務機關或機構者,不在此限。該代表應代表控管 者或處理者,且得受任何監管機關之監管。控管者或處理者應明確以 書面委託該代表履行其依照本規則所負之義務。該指定不影響控管者 或處理者基於本規則之責任或義務。該代表應依據控管者或處理者之 委託執行其任務,包括為確保符合本規則而須與主管機關合作之任何 作為。於控管者或處理者不守法時,受指定之代表應為執行程序之對 象。

(80) Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or to the monitoring of their behaviour as far as their behaviour takes place within the Union, the controller or the processor should designate a representative, unless the processing is occasional, does not include processing, on a large scale, of special categories of personal data or the processing of personal data relating to criminal convictions and offences, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing or if the controller is a public authority or body.

The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority.

The representative should be explicitly designated by a written mandate of the controller or of the processor to act on its behalf with regard to its obligations under this Regulation.

The designation of such a representative does not affect the responsibility or liability of the controller or of the processor under this Regulation.

Such a representative should perform its tasks according to the mandate received from the controller or processor, including cooperating with the competent supervisory authorities with regard to any action taken to ensure compliance with this Regulation.

The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor.