Chapter X: Delegated Acts and Implementing Acts

Chapter X establishes the mechanisms by which the European Commission can supplement and implement the GDPR through secondary legislation. This ensures the regulation can remain current and be applied uniformly across all Member States despite technological and practical developments.

Delegated Acts (Article 92):

The Commission is empowered to adopt delegated acts to supplement the GDPR in the following areas:

• Criteria and Requirements for Certification Mechanisms (Article 42(1)): Detailed requirements for data protection certification schemes to ensure consistency across the EU.
• Information to be Presented by Icons (Article 12(7)): Standardized icons that provide data subjects with a meaningful overview of processing in an easily visible, intelligible, and clearly legible manner.
• Standard Contractual Clauses for Transfers (Article 46(2)(d)): Model contractual clauses for data transfers to third countries or international organizations.
• Certification of Binding Corporate Rules (Article 47): Requirements and procedures for approving binding corporate rules for international data transfers within corporate groups.

Exercise of Delegation:

• The power to adopt delegated acts is conferred on the Commission for an indeterminate period from May 24, 2016 (the date the GDPR entered into force).
• The European Parliament or Council may revoke the delegation at any time. A revocation decision terminates the delegation of power specified therein and takes effect the day following publication or on a later date specified in the decision.
• Before adopting a delegated act, the Commission must consult experts designated by each Member State in accordance with principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.
• The Commission must notify the European Parliament and Council immediately upon adoption of a delegated act.
• A delegated act only enters into force if neither the European Parliament nor the Council has objected within three months of notification, or if both have informed the Commission they will not object. This period may be extended by three months at the initiative of either institution.

Urgency Procedure:

When imperative grounds of urgency so require, particularly to ensure data subject protection, the Commission may adopt delegated acts through an urgency procedure. The act enters into force immediately and applies as long as no objection is raised within the period specified. If either the European Parliament or Council objects, the Commission must repeal the act immediately.

Implementing Acts (Article 93):

The Commission may adopt implementing acts to ensure uniform conditions for applying the GDPR in the following areas:

• Standard Forms and Procedures (Article 28(6)): For controller-processor contracts and other contractual relationships.
• Standard Contractual Clauses (Article 28(7)): Concerning controller and processor contractual arrangements.
• Standard Formats for Data Portability (Article 12(8)): Including electronic formats for exercising the right to data portability.
• Notification Forms and Procedures (Article 33(5)): For personal data breach notification to supervisory authorities, including standard forms.
• Standard Forms for Communication to Data Subjects (Article 34): Concerning personal data breach communications.
• Standard Arrangements for Joint Controllers (Article 26(1)): For determining respective responsibilities of joint controllers.
• Standard Procedures and Formats (Article 30(4)): For maintaining records of processing activities.
• Standard Forms for Prior Consultation (Article 36(5)): With supervisory authorities for high-risk processing.
• Requirements for Consistency Mechanism (Article 63): Practical arrangements for information exchange and procedures.
• Standard Forms and Procedures for Mutual Assistance (Article 61(6)): Between supervisory authorities.
• Arrangements for Information Exchange (Article 61(7)): By electronic means between supervisory authorities and between authorities and the European Data Protection Board.

Committee Procedure:

• The Commission is assisted by a committee (the GDPR Committee) composed of representatives of Member States and chaired by a Commission representative.
• The committee delivers its opinion by the majority laid down in Article 5(1) of Decision 1999/468/EC (qualified majority).
• Where reference is made to the examination procedure, Article 5 of Regulation (EU) No 182/2011 applies.
• Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act, except in duly justified cases relating to issuing or revoking adequacy decisions for third countries.

Significance:

Chapter X provides essential flexibility for the GDPR to:

• Adapt to Change: Technology and processing practices evolve rapidly. Delegated and implementing acts allow the Commission to update technical requirements without requiring full legislative amendments.
• Ensure Uniformity: Standard forms, procedures, and contractual clauses promote consistent GDPR application across all 27 Member States, facilitating cross-border processing and reducing compliance complexity.
• Maintain Democratic Oversight: The procedures require consultation and provide for parliamentary and council oversight, ensuring that Commission acts remain accountable and aligned with legislative intent.
• Enable Rapid Response: The urgency procedure allows quick action when necessary to protect data subjects.

Examples of delegated and implementing acts adopted under these provisions include Standard Contractual Clauses for data transfers (updated in 2021), adequacy decisions for third countries (such as the EU-U.S. Data Privacy Framework), and standardized forms for various GDPR procedures.