Fin(d)ing Locatefamily.com: Dutch DPA imposes €525,000 fine for not having a GDPR representative

About Locatefamily.com 

Locatefamily.com offers a platform for individuals who are looking for the contact details of people they lost track of by providing personal information such as name, address and sometimes phone number. Locatefamily.com offers this information to any interested party free of charge on a website which is publicly accessible, and which contains data of both EU and non-EU residents. Locatefamily.com obtains information from various sources such as social media accounts, government records and telecommunication providers, all without the individuals concerned having to become members of the platform or create an account.

Since the GDPR came into force, the Dutch Data Protection Authority has received a number of complaints about Locatefamily.com. These range from issues raised by individuals wishing to exercise their rights, non-compliance such as the lack of a GDPR representative to more general privacy concerns about the purpose of the website and its potential to facilitate stalking. 

Locating Locatefamily.com

Following these complaints, the AP took it upon itself to locate where the company was based, which ironically proved to be a difficult task itself. Initial requests sent to Locatefamily.com only resulted in the company stating that it is not located in the European Union and does not have any business relationships in the Union, nor an office or a representative, and that it does not offer goods or services to the Union. After futile follow-up attempts to get more information on this (Locatefamily.com responded that it was “puzzled as to why you would you need to know where we are situated”), the AP reached out to its fellow data protection authorities in other EU countries in search for more information. This confirmed that Locatefamily.com did not have an representative in the EU, and that there were a substantial number of complaints in other EU member states.

Following this, the AP conducted ‘technical investigations’, which led to it believing that Locatefamily.com might be a Canadian company due to the fact that the website is hosted by a Canadian webhost. On behalf of itself and ten other European DPAs, the AP reached out to the Canadian Office of the Privacy Commissioner (OPC). Although the OPC provided assistance, the AP was not able to determine the location of Locatefamily.com. The fining decision (dated 20 December 2020) mentions that “to date, this did not result in concrete clues on the location of establishment of Locatefamily.com”.

Fine and order under penalty 

For the violation of article 27 GDPR, the AP imposed a fine of €525,000. The AP calculated this fine by applying the Guidelines on Administrative Fines (see here for more information). 

Under these Guidelines, a violation of article 27 GDPR is qualified as a ‘Category III’ violation, which has a base level fine of €525,000 is connected. This amount can be adjusted upwards or downwards depending on relevant factors, such as the duration of the violation, the impact on individuals, and the degree of cooperation with the investigation. Despite the fact that Locatefamily.com at some point no longer seemed to respond to questions from the AP, the AP did not use this as a reason to increase the fine, nor did it otherwise amend the fine. 

This is line with our experience from other cases – it seems that the AP will not lightly deviate from the base amounts it has set for violations of the GDPR, which range from €100,000 for the lowest Category I (which applies for example to a violation of article 26 GDPR on joint-controllers or not seeking the views of data subjects or their representatives in case of a DPIA as per article 35(9) GDPR) to €725,000 for Category IV violations (which apply for example to a violation of article 9 GDPR containing the general prohibition to process sensitive personal data). To be clear, the AP could still impose the GDPR’s maximum penalty of €20 million or 4% turnover, but this seems to be an option only in exceptional cases. 

To force Locatefamily.com to appoint a representative, the regulator also imposed an order subject to a penalty. The company had until 18 March 2021 to appoint a representative in the EU. For every 2 weeks that the order was not complied with, the company would be required to pay €20,000, with a maximum of €120,000. In the press release of 12 May 2021, the AP confirmed that to its knowledge Locatefamily.com did not appoint a representative on time, and the maximum additional fine of €120,000 will be due in addition to the initial fine.

International enforcement

As a result of its failure to appoint a representative, Locatefamily.com is therefore required to pay a total of €645,000 to the AP. However, we expect that the AP will not be able to collect that amount easily. Although there are international (multinational and bilateral) agreements for international matters of criminal or administrative law which might in theory be used by the AP for cross border enforcement of orders, fines and penalties, these agreements are patchy and difficult to use in practice by the AP, especially since Locatefamily.com’s location is not known. Effective enforcement of the fine is more likely if the AP were to determine that Locatefamily.com has assets on Dutch territory that can be seized (for example, money on bank accounts or payment claims against third parties in the Netherlands). The fine and the AP’s public comments will doubtless have an impact on Locatefamily.com’s reputation in the Netherlands and elsewhere.

For your company

Companies that are not established in the European Union but might have customers or users in the EU or otherwise process personal data relating to EU data subjects are strongly advised to (re-)assess whether they need an EU representative. With this case the AP in particular, but also the other DPAs that provided assistance, such as the French CNIL and Irish DPC, have sent a signal to such companies that EU data protection laws have a wide applicability and can extend far beyond the EU’s borders. Actual enforcement however remains difficult in practice, as this case illustrates. 

For completeness sake we note that a similar obligation to appoint a representative exists in the UK. This means that any company that is not established in the UK but offers good or services to the UK or monitors the behaviour of its citizens would generally need to appoint a representative in the UK too.

While it remains to be seen to what the effect of this fining decision is on the way this is approached in the UK, companies would thus do well to specifically verify the above for the UK too.

See here for the press release from the AP on the fining decision.