The GDPR

Article 99 specifies that this Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. The Regulation was published on 4 May 2016 in the Official Journal of the European Union and will therefore enter into force on 25 May 2016.

However, the Regulation will only be applicable after the two years following its entry into force, i.e., from 25 May 2018 on.

The Regulation does not provide for a transitional regime, but, strangely, gives some transition principles in recital 171. Thus, any processing operations in progress at the time of the entry into force of the Regulation on 25 May 2016, will have to be brought into line within a period of two years.

It further provides that the consent given under the Directive should not be repeated, as it was given in accordance with the terms of the settlement so that the controller can continue such processing after the date of entry into force of the Regulation. We may wonder what the purpose of such a rule is. In a previous version, it was stated "Where such processing is in line with Directive 95/46/EC, it is not necessary that the data subjects agrees again to allow the controller to continue processing after the date of application of this Regulation". We see that the recital does not provide for anything new: the consent which was given by a data subject earlier and which was given consistent with the Regulation should not be repeated, which had been assumed.

Finally, Article 99 reminds the mandatory character of all the elements contained in the Regulation and its directly binding character in all Member States.

The Directive

-

Potential issues

The lack of a transitional regime is problematic, for example, when considering the impact analyses that must precede the implementation of certain processing operations or the prior consultation of the supervisory authority. Will the rendering of compliance with the existing processing operations result in the need for retroactive analyses or prior consultations? The second version of the Regulation provided explicitly for these scenarios, incorporating an exemption if the processing was consistent with the Directive, but this was erased in the final version.

Such seems to be the extreme consequences which the system of rendering the processing operations into compliance results in – and is provided for in one recital only. In addition to the questions that may be asked on the nature of such a “rule” that is provided for in the preamble only, how will such a regime be coordinated with the entry into force of the multiple new national rules designed to apply the Regulation in each national state.

European Union

CJEU caselaw

C-579/21 (22 June 2023 ) - Pankki S

1.      Article 15 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Article 99(2) of that regulation,

must be interpreted as meaning that it is applicable to a request for access to the information referred to in that provision where the processing operations which that request concerns were carried out before the date on which that regulation became applicable, but the request was submitted after that date.

2.      Article 15(1) of Regulation 2016/679

must be interpreted as meaning that information relating to consultation operations carried out on a data subject’s personal data and concerning the dates and purposes of those operations constitutes information which that person has the right to obtain from the controller under that provision. On the other hand, that provision does not lay down such a right in respect of information relating to the identity of the employees of that controller who carried out those operations under its authority and in accordance with its instructions, unless that information is essential in order to enable the person concerned effectively to exercise the rights conferred on him or her by that regulation and provided that the rights and freedoms of those employees are taken into account.

3.      Article 15(1) of Regulation 2016/679

must be interpreted as meaning that the fact that the controller is engaged in the business of banking and acts within the framework of a regulated activity and that the data subject whose personal data has been processed in his or her capacity as a customer of the controller was also an employee of that controller has, in principle, no effect on the scope of the right of access conferred on that data subject by that provision.

Judgment of the Court 
Opinion of Advocate General 
 

Retour au sommaire Retour au sommaire