RIPD Open Letter to Foreign Data Controllers

During the 22nd Ibero-American Data Protection Authorities Meeting, the Ibero-American Data Protection Network (RIPD) issued an Open Letter addressed to companies that, without being established in any member state, process personal data on a large or massive scale within the jurisdictions of any of the RIPD’s member countries.

Through the Open Letter, the RIPD invites companies to:

•    Appoint and inform the contact information of a representative or liaison before the federal data protection authorities of the jurisdictions where they process personal data. This representative should be duly empowered to carry out both administrative and judicial representation functions;
•    Implement accessible and efficient communication channels to receive data protection related communications, manage data subject requests and security incidents, and receive administrative notifications; and 
•    Provide a priority communication mechanism (e.g., an emergency button) for urgent opposition requests, particularly in cases involving the non-consensual dissemination of sexual or violent content.

The RIPD stresses that failure to appoint a representative or to implement adequate communication mechanisms does not exempt data controllers or processors from complying with national data protection laws. The RIPD urges companies that process personal data at a large or massive scale to adhere to the legislation in the jurisdiction where they process the data, to cooperate with judicial and regulatory authorities, and to uphold democratic values, accountability, and fundamental rights.

Lastly, the RIPD states that the contents of the letter are subject to the specific legislation of each RIPD member country and do not create binding obligations for its members, in case of conflict with local laws.