Article 93 GDPR
|← Article 93 - Committee procedure →|
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
3. Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.
(1) Implementing acts
The Commission can be delegated to adopt implementing acts (Article 291 TFEU). [In such a case the Commission “is supported by a committee”, as Article 93(1) euphemistically puts it. In clearer words, in such a case the Commission is obliged to involve a Committee in accordance with Paragraph 1. The Committee is composed of representatives of the Member States (Article 3(2) of Regulation (EU) No. 182/2011).
(2) Examination procedure under Article 5 of Regulation (EU) No. 182/2011
Regulation (EU) No 182/2011 establishes different procedures for the adoption of implementing acts. Article 93(2), however, refers exclusively to the so-called "examination procedure" provided for in Article 5 Regulation (EU) No 182/2011. This procedure is generally foreseen for (a) implementing acts of general scope and (b) other implementing acts relating to programmes with substantial implications, and foresees the intervention of a committee composed of representatives of each member state.
GDPR cases where the examination procedure is referred to
Specifically, the GDPR provides the Commission with the power to adopt implementing acts in several occasions. For example, in Article 28(7) (standard contractual clauses between controllers and processors and between processors), Article 40(9) (codes of conduct), Article 43(9) (technical standards and mechanisms for certification), Article 45(3) (the adequate level of protection afforded by a third country, a territory or a specified sector within that third country, or an international organisation), Article 45(5) (revocation, change of such determinations), Article 46(2)(c) and (d) (standard protection clauses), Article 47(3) (formats and procedures for the exchange of information by electronic means between controllers, processors and supervisory authorities for binding corporate rules), Article 61(9) (mutual assistance), Article 67 (arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board).
The Commission proposes the measures to be taken and the committee gives its opinion, generally by a qualified majority vote (55% of the Member States representing at least 65% of the population). If the majority indicated in favour of the draft act is reached (favourable opinion), the Commission adopts the implementing act. If not (negative opinion), the President of the Commission may submit an amended version to the Committee, in accordance with various procedures. If neither a favourable nor an unfavourable opinion is obtained, the Commission may decide to adopt the implementing act anyway.
(3) Urgency procedure under Article 8 of Regulation (EU) No. 182/2011
Under Article 8 of Regulation (EU) No. 182/2011, by way of derogation from Articles 4 and 5, a basic act may provide that, on duly justified imperative grounds of urgency, the Commission shall adopt an implementing act which shall apply immediately, without its prior submission to a committee, and shall remain in force for a period not exceeding 6 months unless the basic act provides otherwise. At the latest 14 days after its adoption, the chair shall submit the urgent act to the relevant committee in order to obtain its opinion.
In Recital 159 the GDPR provides for the only case of “imperative urgency”. In particular, the Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an international organisation does not ensure an adequate level of protection, and imperative grounds of urgency so require.
→ You can find all related decisions in Category:Article 93 GDPR
- As Husband rightly points out, this provision does not concern the adoption of delegated acts in accordance with Article 290 TFEU. The heading of Chapter X (“Delegated Acts and Implementing Acts”), which consists only of Articles 92 and 93, may at first suggest that the provision is also related to delegated acts, but is misleading in this respect. In this sense, Husband, in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 93 GDPR, margin number 1 (Beck 2018, 2nd ed.) (accessed 13.8.2021)
- Recital 168.