Article 93 GDPR: Difference between revisions

From GDPRhub
(style consistency)
Line 200: Line 200:


=== (1) Implementing acts ===
=== (1) Implementing acts ===
The Commission can be delegated to adopt implementing acts (Article 291 TFEU). [In such a case the Commission “''is supported by a committee''”, as Article 93(1) euphemistically puts it. In clearer words, in such a case the Commission is obliged to involve a Committee in accordance with Paragraph 1. The Committee is composed of representatives of the Member States (Article 3(2) of Regulation (EU) No. 182/2011).<ref>As ''Husband'' rightly points out, this provision does not concern the adoption of delegated acts in accordance with Article 290 TFEU. The heading of Chapter X (“Delegated Acts and Implementing Acts”), which consists only of Articles 92 and 93, may at first suggest that the provision is also related to delegated acts, but is misleading in this respect. In this sense, ''Husband'', in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 93 GDPR, margin number 1 (Beck 2018, 2nd ed.) (accessed 13.8.2021)</ref>
The adoption of implementing acts can be delegated to the Commission (Article 291 TFEU). In such a case, the Commission “''shall be assisted by a committee''”, as Article 93(1) euphemistically puts it [In this sense, ''Ehmann'', in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 93 GDPR, margin number 1 (C. H. Beck 2018, 2nd ed.)]. In clearer words, the Commission is obliged to involve a Committee in accordance with this provision. This Committee shall be composed of representatives of the Member States according to Article 3(2) of Regulation (EU) No. 182/2011.<ref>This provision does not concern the adoption of delegated acts in accordance with Article 290 TFEU. The heading of Chapter X (“''Delegated Acts and Implementing Acts''”), which consists only of Articles 92 and 93, may at first suggest that the provision is also related to delegated acts, but is misleading in this respect.</ref>


=== (2) Examination procedure under Article 5 of Regulation (EU) No. 182/2011 ===
=== (2) Examination procedure under Article 5 of Regulation (EU) No. 182/2011 ===
Regulation (EU) No 182/2011 establishes different procedures for the adoption of implementing acts. Article 93(2), however, refers exclusively to the so-called "examination procedure" provided for in Article 5 Regulation (EU) No 182/2011. This procedure is generally foreseen for (a) implementing acts of general scope and (b) other implementing acts relating to programmes with substantial implications, and foresees the intervention of a committee composed of representatives of each member state.
Regulation (EU) No 182/2011 establishes different procedures for the adoption of implementing acts. Article 93(2), however, refers exclusively to the so-called "examination procedure" provided for in Article 5 Regulation (EU) No 182/2011. This procedure is generally foreseen for (a) implementing acts of general scope and (b) other implementing acts relating to programmes with substantial implications, including the intervention of a committee composed of representatives of each Member State.  


==== GDPR cases where the examination procedure is referred to ====
==== GDPR cases where the examination procedure is referred to ====
Specifically, the GDPR provides the Commission with the power to adopt implementing acts in several occasions. For example, in Article 28(7) (standard contractual clauses between controllers and processors and between processors), Article 40(9) (codes of conduct), Article 43(9) (technical standards and mechanisms for certification), Article 45(3) (the adequate level of protection afforded by a third country, a territory or a specified sector within that third country, or an international organisation), Article 45(5) (revocation, change of such determinations), Article 46(2)(c) and (d) (standard protection clauses), Article 47(3) (formats and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules), Article 61(9) (mutual assistance), Article 67 (arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board).<ref>Recital 168.</ref>
Specifically, the GDPR provides the Commission with the power to adopt implementing acts in several occasions. For example, in Article 28(7) (standard contractual clauses between controllers and processors and between processors), Article 40(9) (codes of conduct), Article 43(9) (technical standards and mechanisms for certification), Article 45(3) (the adequate level of protection afforded by a third country, a territory or a specified sector within that third country, or an international organisation), Article 45(5) (revocation, change of such determinations), Article 46(2)(c) and (d) (standard protection clauses), Article 47(3) (formats and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules), Article 61(9) (mutual assistance), and lastly Article 67 (arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board).<ref>Recital 168.</ref>


==== Procedural aspects ====
==== Procedural aspects ====
The Commission proposes the measures to be taken and the committee gives its opinion, generally by a qualified majority vote (55% of the Member States representing at least 65% of the population). If the majority indicated in favour of the draft act is reached (favourable opinion), the Commission adopts the implementing act. If not (negative opinion), the President of the Commission may submit an amended version to the Committee, in accordance with various procedures. If neither a favourable nor an unfavourable opinion is obtained, the Commission may decide to adopt the implementing act anyway.
The Commission proposes the measures to be taken and the committee gives its opinion, generally by a qualified majority vote (55% of the Member States representing at least 65% of the population). If the majority indicated in favour of the draft act is reached (favourable opinion), the Commission adopts the implementing act. If not (negative opinion), the President of the Commission may submit an amended version to the Committee, in accordance with various procedures. If neither a favourable nor an unfavourable opinion is obtained, the Commission may decide to adopt the implementing act anyway.  


=== (3) Urgency procedure under Article 8 of Regulation (EU) No. 182/2011 ===
=== (3) Urgency procedure under Article 8 of Regulation (EU) No. 182/2011 ===
Under Article 8 of Regulation (EU) No. 182/2011, by way of derogation from Articles 4 and 5, a basic act may provide that, on duly justified imperative grounds of urgency, the Commission shall adopt an implementing act which shall apply immediately, without its prior submission to a committee, and shall remain in force for a period not exceeding 6 months unless the basic act provides otherwise. At the latest 14 days after its adoption, the chair shall submit the urgent act to the relevant committee in order to obtain its opinion.
Under Article 8 of Regulation (EU) No. 182/2011 (by way of derogation from Articles 4 and 5) on duly justified imperative grounds of urgency, a basic act may provide that the Commission adopts an implementing act which shall apply immediately, without prior submission to a committee. This implementing act will remain in force for a maximum period of 6 months, unless the basic act provides otherwise. At the latest, 14 days after its adoption, the chair shall submit the urgent act to the relevant committee in order to obtain its opinion. In Recital 159, the GDPR provides for the only case of “imperative urgency”. In particular, ''“''[t]''he Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require.”''
 
In Recital 159 the GDPR provides for the only case of “imperative urgency”. In particular, the Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require.


== Decisions ==
== Decisions ==

Revision as of 12:41, 29 April 2022

Article 93 - Committee procedure
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 93 - Committee procedure

1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.

Relevant Recitals

Recital 168: Examination Procedure
The examination procedure should be used for the adoption of implementing acts on standard contractual clauses between controllers and processors and between processors; codes of conduct; technical standards and mechanisms for certification; the adequate level of protection afforded by a third country, a territory or a specified sector within that third country, or an international organisation; standard protection clauses; formats and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules; mutual assistance; and arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board.

Recital 169: Immediately Applicable Implementing Acts
The Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require.

Commentary

(1) Implementing acts

The adoption of implementing acts can be delegated to the Commission (Article 291 TFEU). In such a case, the Commission “shall be assisted by a committee”, as Article 93(1) euphemistically puts it [In this sense, Ehmann, in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 93 GDPR, margin number 1 (C. H. Beck 2018, 2nd ed.)]. In clearer words, the Commission is obliged to involve a Committee in accordance with this provision. This Committee shall be composed of representatives of the Member States according to Article 3(2) of Regulation (EU) No. 182/2011.[1]

(2) Examination procedure under Article 5 of Regulation (EU) No. 182/2011

Regulation (EU) No 182/2011 establishes different procedures for the adoption of implementing acts. Article 93(2), however, refers exclusively to the so-called "examination procedure" provided for in Article 5 Regulation (EU) No 182/2011. This procedure is generally foreseen for (a) implementing acts of general scope and (b) other implementing acts relating to programmes with substantial implications, including the intervention of a committee composed of representatives of each Member State.

GDPR cases where the examination procedure is referred to

Specifically, the GDPR provides the Commission with the power to adopt implementing acts in several occasions. For example, in Article 28(7) (standard contractual clauses between controllers and processors and between processors), Article 40(9) (codes of conduct), Article 43(9) (technical standards and mechanisms for certification), Article 45(3) (the adequate level of protection afforded by a third country, a territory or a specified sector within that third country, or an international organisation), Article 45(5) (revocation, change of such determinations), Article 46(2)(c) and (d) (standard protection clauses), Article 47(3) (formats and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules), Article 61(9) (mutual assistance), and lastly Article 67 (arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board).[2]

Procedural aspects

The Commission proposes the measures to be taken and the committee gives its opinion, generally by a qualified majority vote (55% of the Member States representing at least 65% of the population). If the majority indicated in favour of the draft act is reached (favourable opinion), the Commission adopts the implementing act. If not (negative opinion), the President of the Commission may submit an amended version to the Committee, in accordance with various procedures. If neither a favourable nor an unfavourable opinion is obtained, the Commission may decide to adopt the implementing act anyway.

(3) Urgency procedure under Article 8 of Regulation (EU) No. 182/2011

Under Article 8 of Regulation (EU) No. 182/2011 (by way of derogation from Articles 4 and 5) on duly justified imperative grounds of urgency, a basic act may provide that the Commission adopts an implementing act which shall apply immediately, without prior submission to a committee. This implementing act will remain in force for a maximum period of 6 months, unless the basic act provides otherwise. At the latest, 14 days after its adoption, the chair shall submit the urgent act to the relevant committee in order to obtain its opinion. In Recital 159, the GDPR provides for the only case of “imperative urgency”. In particular, [t]he Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require.”

Decisions

→ You can find all related decisions in Category:Article 93 GDPR

References

  1. This provision does not concern the adoption of delegated acts in accordance with Article 290 TFEU. The heading of Chapter X (“Delegated Acts and Implementing Acts”), which consists only of Articles 92 and 93, may at first suggest that the provision is also related to delegated acts, but is misleading in this respect.
  2. Recital 168.