The GDPR articles explained: Chapter 10 - Delegated acts and implementing acts

Chapter 10 of the GDPR outlines the mechanisms through which the European Commission can adopt additional rules and specifications to supplement the GDPR framework. These acts help ensure consistent application and interpretation of the GDPR across EU member states.

Article 92: Exercise of the delegation

Article 92 specifies the conditions under which the European Commission is empowered to adopt delegated acts. Key points include:

Delegation period: The Commission is delegated powers under specific GDPR articles (Article 12(8) and Article 43(8)) indefinitely from May 24, 2016.

Revocation of delegation: The European Parliament or Council can revoke the delegation of power at any time. Revocation decisions take effect upon publication but do not invalidate delegated acts already in force.

Notification and adoption: Once a delegated act is adopted, it must be notified simultaneously to the European Parliament and Council.

Entry into force: Delegated acts enter into force unless the Parliament or Council objects within a specified period (initially three months, extendable by another three months).

Example: Suppose the GDPR mandates that specific technical measures for data encryption must be defined through delegated acts to ensure consistency across member states. The Commission adopts a delegated act specifying encryption standards. If neither the Parliament nor the Council objects within the prescribed period, these standards become enforceable.

Article 93: Committee procedure

Article 93 outlines the committee procedure through which the European Commission is assisted in adopting delegated acts:

Committee assistance: The Commission is assisted by a committee established under Regulation (EU) No 182/2011.

Application of regulations: References in Article 93 link to specific articles of Regulation (EU) No 182/2011, which governs the functioning of committees assisting the European Commission.