Chapter XI: Final Provisions

Chapter XI contains the administrative provisions that conclude the GDPR, manage the transition from previous legislation, and establish review mechanisms to ensure the regulation remains effective over time.

Repeal of Directive 95/46/EC (Article 94):

The GDPR repeals Directive 95/46/EC (the Data Protection Directive) with effect from May 25, 2018. Key points:

• References to the repealed Directive are construed as references to the GDPR
• A correlation table mapping Directive provisions to GDPR articles is provided in Annex
• Processing that was lawful before May 25, 2018, remains lawful after that date if it continues to comply with GDPR requirements
• The legal basis for processing that existed under the Directive continues to be valid under the GDPR (provided it meets GDPR standards)

Relationship with Directive 2002/58/EC (Article 95):

The GDPR does not impose additional obligations on processing in connection with the provision of publicly available electronic communications services in public communication networks, except where such obligations are specifically required by the GDPR. Directive 2002/58/EC (the ePrivacy Directive) continues to apply to these matters, including:

• Confidentiality of communications
• Traffic data
• Location data
• Cookies and similar technologies
• Direct marketing communications via electronic means

The ePrivacy Directive and the GDPR are complementary - the ePrivacy Directive provides sector-specific rules for electronic communications while the GDPR provides the general framework for data protection. In case of conflict, the more specific provisions of the ePrivacy Directive prevail for the matters it covers.

Application to EU Institutions and Bodies (Article 96):

The GDPR does not apply to processing by Union institutions, bodies, offices, and agencies, which remain governed by Regulation (EC) No 45/2001. However, Regulation (EC) No 45/2001 was subsequently replaced by Regulation (EU) 2018/1725, which aligns EU institution data protection rules with the GDPR framework while accounting for the specific nature of EU administration.

Relationship with Previously Concluded Agreements (Article 97):

International agreements involving the transfer of personal data to third countries or international organizations that were concluded by Member States before May 24, 2016 (GDPR entry into force), and which comply with Directive 95/46/EC, remain in force until amended, replaced, or revoked. This provides legal continuity for existing international data sharing arrangements.

Review of Other EU Data Protection Instruments (Article 98):

The Commission must submit proposals, if appropriate, for amendments to other Union legal instruments on data protection to ensure uniform and consistent protection across the Union, particularly regarding:

• Regulation (EC) No 45/2001 (EU institutions - subsequently replaced by Regulation 2018/1725)
• Directive 2002/58/EC (ePrivacy - proposed ePrivacy Regulation pending)

Entry into Force and Application (Article 99):

Critical dates for the GDPR:

• Entry into Force: May 24, 2016 (twenty days after publication in the Official Journal)
• Date of Application: May 25, 2018 (two years after entry into force)

The two-year transition period between entry into force and application was designed to give:

• Organizations time to understand requirements and implement necessary technical and organizational measures
• Member States time to update national legislation and establish supervisory authority structures
• Supervisory authorities time to prepare guidance and coordinate approaches
• The European Data Protection Board time to establish operational procedures

Publication:

The GDPR was published in the Official Journal of the European Union on May 4, 2016 (OJ L 119, 4.5.2016). As a regulation (not a directive), it has direct effect and is directly applicable in all Member States without requiring national implementing legislation, though Member States may adopt specific provisions where the GDPR provides for such flexibility.

Review and Evaluation:

While not explicitly required by the GDPR itself, the Commission conducts periodic evaluations of the regulation's application and effectiveness. The first major evaluation report was published in June 2020, assessing the GDPR's first two years of application and confirming its effectiveness while identifying areas for improved guidance and consistency.

Significance:

Chapter XI ensures:

• Legal Continuity: The transition from Directive 95/46/EC to the GDPR occurred smoothly without creating legal vacuums or invalidating existing compliant processing.
• Coordination with Sector-Specific Rules: The relationship with the ePrivacy Directive (and future ePrivacy Regulation) is clarified to prevent conflicts and overlaps.
• Unified EU Approach: By requiring alignment of data protection rules for EU institutions and review of related instruments, the chapter promotes consistency across all EU data protection law.
• Adequate Preparation Time: The two-year implementation period was crucial for the GDPR's successful adoption, though many organizations found even this period challenging given the regulation's scope and complexity.

The GDPR's status as a regulation (rather than a directive requiring national transposition) was a deliberate choice to ensure maximum harmonization of data protection law across the EU, creating a true single market for data protection while setting a global standard that has influenced data protection legislation worldwide.