CHAPTER X
Delegated acts and implementing acts
Author: Stephanie Schiedermair
- The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
- The delegation of power referred to in Art. 12 para. 8 and Art. 43 para. 8 shall be conferred on the Commission for an indeterminate period of time from 24 May 2016.
- The delegation of power referred to in Art. 12 para. 8 and Art. 43 para. 8 may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following that of its publication in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
- As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
- A delegated act adopted pursuant to Art. 12 para. 8 and Art. 43 para. 8 shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.
I. Introduction
The Comm is authorised by the GDPR to supplement the GDPR provisions via delegated acts. This authorisation is related to Art. 12 para. 8 (on the determination of ‘the information to be presented by the icons and the procedures for providing standardised icons’) and Art. 43 para. 8 (on the specification of ‘the requirements to be taken into account for the data protection certification mechanisms’). Art. 92, avoiding lengthy law-making procedures, is aimed at enhancing efficiency. Moreover, that the Comm enjoys the power to supplement the GDPR-provisions means that it is accountable and its powers need to be subject to limits. In this context, Art. 92 is also targeted at setting out these limits.
II. Legal background
The DPD did not authorise the Comm to opt for delegated acts (which were introduced by the Lisbon Treaty, in force since 2009, after the coming into force of the DPD). Still, Art. 25 paras. 4 to 6, Art. 26 paras. 3 and 4 and Art. 31 DPD offered the Comm some powers concerning international data transfers.
III. Analysis
1. Nature of delegated acts
Art. 92 para. 1 GDPR, in Chapter X of the GDPR, confers on the Comm the power to adopt delegated acts subject to specific conditions laid down in greater detail. Art. 92 GDPR therefore elaborates on Art. 290 para. 1 TFEU, which was newly introduced with the Lisbon Treaty and allows the Comm to be given the power, in legislative acts, to adopt acts of a non-legislative nature. Art. 290 TFEU replaces, together with Art. 291 TFEU, the previously applicable Art. 202 TEC, which formed the legal basis for the Comitology Decision and the comitology procedure. The executive legislative powers assigned to the Comm are designed to take pressure off the EP and off the Council by making the Comm responsible for dealing with detailed questions on particular provisions. Whereas the Comm draft provided for 26 powers to be granted to the Comm regarding the adoption of delegated acts and 23 powers regarding the adoption of implementing acts, the EP’s draft only left the Comm ten powers for delegated acts and one for implementing acts. The Council again went much further than the EP and removed virtually all the powers awarded to the Comm. During the trilogue procedure involving representatives of the Council, the EP and Comm, the Comm was only left with two powers to adopt delegated acts and eight to adopt implementing acts.
Delegated acts are not legislative acts in the formal sense of Art. 289 para. 3 TFEU, but they nevertheless constitute binding law. This means that breaches of delegated acts are covered by the GDPR sanction regime – as are breaches of implementing acts. These are acts of substantive legislation that are also referred to as tertiary EU law. As subordinated legal acts in the hierarchy of norms, delegated acts have to be consistent with all European primary law and also with all European secondary law. As a result, any content-related deviations from the requirements of primary or secondary law in delegated acts are ineffective. Pursuant to Art. 290 para. 1 subpara. 1 TFEU, delegated acts may only amend the empowering secondary legislative act – but may only do so to the extent that such measures do not relate to the binding framework for the delegated act or to essential provisions of the secondary legislative act in question. There is no hierarchy among the various delegated acts; rather, the general principles on the collision of legal norms apply (e.g., the “lex specialis” provision).
A distinction has to be made between delegated acts pursuant to Art. 290 TFEU and implementing acts as an instrument of the Comm pursuant to Art. 291 TFEU, which are aimed first and foremost not at taking pressure off the Union legislator but rather to ensure the consistent administrative execution of the basic act. There is no overlap in the scope of application of these two legal acts, as is already shown by the fact that the two provisions are associated with different procedures. Unlike delegated acts, the conditions for adopting implementing acts are not specified in further detail. Their form is based on the purpose set out in Art. 291 para. 1 TFEU, namely the need for uniform conditions for the implementation of legally binding Union acts. While the legislator grants the Comm quasi-legislative powers with the delegated acts, giving the Comm its own discretionary authority to make decisions, the power to adopt implementing acts pursuant to Art. 291 TFEU is of a purely executive nature. The implementing acts therefore tend to be limited purely to implementing arrangements.
[…]