GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

adoption of standard clauses for data protection (Article 46 (2), (c)). Each of the provisions conferring implementing powers to the Commission provides that the implementing acts should be adopted in accordance with the procedure referred to in article 93 (2) or, in an extreme urgency, in accordance with the procedure laid down in article 93 (3).

Article 93 refers to Article 5 or Article 8 of Regulation (EU) No. 182/2011 of Regulation (EU) No. 182/2011 of the European Parliament and the Council of 16 February 2011 establishing the rules and general principles on the modes of control by the Member States of the exercise of the powers of enforcement by the Commission, depending on whether the future Regulation refer to paragraphs 2 or 3

of article 87. Regulation 181/2011 sets out the procedure to follow when a legally binding Union act requires uniform conditions of implementation and that the implementing acts by the Commission are submitted to the control of the Member States.

Article 5 of that Regulation defines the procedure of review:

The Chair of the Committee (committee composed of representatives of the Member States) responsible for assisting the Commission shall submit a draft-implementing act to the Committee;

-The Committee shall issue an opinion by a qualified majority (qualified majority is defined in article 16 (4) of the Treaty on the European Union as being equal to at least 55% of the members of the Council, comprising at least fifteen of them and representing Member States with at least 65% of the population of the Union);

In the case of a favourable opinion of the Committee, the Commission shall adopt the draft-implementing act;

in the case of an unfavourable opinion , two cases are possible: the Chair can either submit a modified version of the draft implementing act to the same Committee, within a period of two months from the issue of the unfavourable opinion, or submit draft implementing act, within a period of one month from the issuance of this opinion, to a Committee of appeal for a new discussion.

in the absence of an opinion of the Committee, the Commission can, in principle, adopt the draft implementing act.

As previously indicated, certain provisions of the Regulation provide that for reasons of urgency, said implementing acts should be adopted in accordance with paragraph 3 of Article 93, which on this part refers to Article 8 of Regulation 181/2011. According to this provision, an implementing act can apply immediately, without needing to be previously submitted to a Committee, for duly justified reasons of extreme urgency. In this case, the implementing act remains in force only for a period of six months. It is the responsibility of the Chair however to submit the implementing act to the Commission for review, not later than fourteen days after its adoption. In case of negative opinion, the Commission shall immediately repeal the act.

* * *

CHAPTER 11: FINAL PROVISIONS

Art. 94 GDPR Repeal of Directive 95/46/EC

Directive 95/46/EC is repealed with effect from 25th May 2018.

References to the repealed Directive shall be construed as references to this Regulation. References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation.

Suitable Recitals

(171) Repeal of Directive 95/46/EC and transitional provisions.

COMMENTARY:

Logically, Article 94 repeals the Directive from the moment when the Regulation enters into force that is 2 years after the 20th day following its publication in the Official Journal of the European Union. The Regulation does not affect the decisions of the Commission, which were adopted on the basis of the Directive, and the permissions that have been granted by the supervisory authorities on the basis of Directive 95/46/EC. The GDPR repeals the Directive, with effect from the GDPR Effective Date. From that point on, any references to the Directive will be construed as references to the GDPR, and any references to the WP29 will be construed as references to the EDPB.

Art. 95 GDPR Relationship with Directive 2002/58/EC

This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC.

Suitable Recitals

(173) Relationship to Directive 2002/58/EC.

COMMENTARY:

Article 95 clarifies the link with Directive 2002/58/EC of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector. The Regulation does not impose any additional obligations in the provision of electronic communications services available to the public on public networks of communications in the Union, for the areas in which they are submitted to specific obligations having the same purpose as those set out in Directive 2002/58/EC.

According to recital 173, the future Regulation is intended to apply to all aspects of the protection of rights and freedoms with respect to the personal data processing,

unless specific obligations with the same purpose are set out in the Directive 2002/58/EC. The Regulation calls for a revision of Directive 2002/58/EC to ensure consistency with the new European text. The GDPR does not impose additional obligations on telecoms providers that process personal data under the e-Privacy Directive. However, there remains some uncertainty in the relationship between the e-Privacy Directive and the GDPR, which will require future clarification.

Art. 96 GDPR Relationship with previously concluded Agreements

International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked.

COMMENTARY:

International agreements involving the transfer of personal data to third countries or international organizations which were concluded by Member States prior to the entry into force of the GDPR, and which are compliant with applicable EU law remain in force until amended, replaced or revoked.

Art. 97 GDPR Commission reports

By 25th May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public.

In the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in particular, the application and functioning of:

Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC;

Chapter VII on cooperation and consistency.

For the purpose of paragraph 1, the Commission may request information from Member States and supervisory authorities.

In carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources.

The Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking into account of developments in information technology and in the light of the state of progress in the information society.

COMMENTARY:

The Directive was already requiring the Commission to provide a report to the European Parliament and the Council on the application of the Directive, accompanied, as appropriate, by proposals for amendment (see Article 33).

Art. 98 GDPR Review of other Union legal acts on data protection

The Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on the protection of personal data, in order to ensure uniform and consistent protection of natural persons with regard to processing. This shall in particular concern the rules relating to the protection of natural persons with regard to processing by Union institutions, bodies, offices and agencies and on the free movement of such data.

COMMENTARY:

In the final version of the Regulation, a new provision was included in Article 98 relating to the review of other legal instruments on the data protection occurring in the Union. Pursuant to this new provision, the Commission is granted the power to submit legislative amendments to any other legal instruments under EU law on data protection. The goal is to ensure, by means of amendments, the consistency of the protection of individuals with respect to the personal data processing, particularly with regard to the protection of individuals with respect to the processing carried out by the European institutions (see Regulation (EC) No. 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of natural persons with respect to the treatment of the personal data by the Community institutions and bodies) and the free movement of such data).

Art. 99 GDPR Entry into force and application

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

It shall apply from 25th May 2018.

COMMENTARY:

Article 99 specifies that this Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. The Regulation was published on 4th May 2016 in the Official Journal of the European Union and will therefore enter into force on 25th May 2016. However, the Regulation will only be applicable after the two years following its entry into force, i.e., from 25th May 2018 on. The Regulation does not provide for a transitional regime, but, strangely, gives some transition principles in recital 171. Thus, any processing operations in progress at the time of the entry into force of the Regulation on 25th May 2016 will have to be brought into line within a period of two years.

It further provides that the consent given under the Directive should not be repeated, as it was given in accordance with the terms of the settlement so that the controller can continue such processing after the date of entry into force of the Regulation. We may wonder what the purpose of such a rule is. In a previous version, it was stated "Where such processing is in line with Directive 95/46/EC, it is not necessary that the data subjects agrees again to allow the controller to continue processing after the date of application of this Regulation". We see that the recital does not provide for anything new: the consent which was given by a data subject earlier and which was given consistent with the Regulation should not be repeated, which had been assumed.

Finally, Article 99 reminds the mandatory character of all the elements contained in the Regulation and its directly binding character in all Member States.

The lack of a transitional regime is problematic, for example, when considering the impact analyses that must precede the implementation of certain processing operations or the prior consultation of the supervisory authority. Will the rendering of compliance with the existing processing operations result in the need for retroactive analyses or prior consultations? The second version of the Regulation provided explicitly for these scenarios, incorporating an exemption if the processing was consistent with the Directive, but this was erased in the final version.

Such seems to be the extreme consequences, which the system of rendering the processing operations into compliance results in – and is provided for in one recital only. In addition to the questions that may be asked on the nature of such a “rule” that is provided for in the preamble only, how will such a regime be coordinated with the entry into force of the multiple new national rules designed to apply the Regulation in each national state.

* * *

CASE LAWS

NUMBER)

 

COURT OF JUSTICE DECISIONS

C-450/00, COMMISSION V. LUXEMBOURG, 4.10.2001 (“LUXEMBOURG”)

Infringement procedure against Luxembourg for failure to bring into force, within the prescribed period, the laws, regulations and administrative provisions necessary to comply with Directive 95/46/EC, as required under Article 32 of the Directive.

Transposition: Luxembourg argued that its