locatefamily.com – €525,000 Fine (Netherlands, 2020)

Locatefamily.com is an organisation established outside of the European Union (EU) that with its website 'Locatefamily.com' offers a platform on which anyone can search for contact details of friends and family they have lost track of. The AP stated that it received 19 complaints between 25 May 2018 and 25 July 2019 from individuals who had not registered with Locatefamily.com, but whose information, including full addresses and sometimes telephone numbers, had appeared on the website without their knowledge. The complaints concerned the failure of Locatefamily.com to respond to requests for erasure, and the lack of an official EU representative. On 18 July 2018 the AP sent a request for mutual assistance under Article 61 GDPR to other EU DPAs, asking whether they had received similar complaints on Locatefamily.com. Ten DPAs responded confirming that they had, and the AP initiated an ex officio investigation into Locatefamily.com regarding a potential violation of Article 27 GDPR. The dispute regarded whether it is necessary for locatefamily.com to appoint a representative in the European Union. Locatefamily.com argued it was not, as it has no office or representatives in the EU, and does not offer goods and services to the EU, preventing the application of the GDPR under Article 3. The AP fined Locatefamily.com €525,000 for not appointing an EU representative. It further required Locatefamily.com to pay an exrta €20,000 for each two-week period it failed to appoint an EU representative, up to a maximum of €120,000. The AP underlined that its investigation, which was carried out in collaboration with other EU supervisory authorities, revealed that locatefamily.com offered its services both in the Netherlands and in eight other EU countries. In accordance with Article 3(2) GDPR, Locatefamily.com's processing activities fell within the GDPRs territorial scope, and it was obliged to appoint an EU representative with whom EU citizens could exercise their privacy