Show the recitals of the Regulation related to article 99 keyboard_arrow_down
Hide the recitals of the Regulation related to article 99 keyboard_arrow_up
(171) Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force. Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application of this Regulation. Commission decisions adopted and authorisations by supervisory authorities based on Directive 95/46/EC remain in force until amended, replaced or repealed.
There is no recital in the Directive related to article 99.
The GDPR
Article 99 specifies that this Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. The Regulation was published on 4 May 2016 in the Official Journal of the European Union and will therefore enter into force on 25 May 2016.
However, the Regulation will only be applicable after the two years following its entry into force, i.e., from 25 May 2018 on.
The Regulation does not provide for a transitional regime, but, strangely, gives some transition principles in recital 171. Thus, any processing operations in progress at the time of the entry into force of the Regulation on 25 May 2016, will have to be brought into line within a period of two years.
It further provides that the consent given under the Directive should not be repeated, as it was given in accordance with the terms of the settlement so that the controller can continue such processing after the date of entry into force of the Regulation. We may wonder what the purpose of such a rule is. In a previous version, it was stated "Where such processing is in line with Directive 95/46/EC, it is not necessary that the data subjects agrees again to allow the controller to continue processing after the date of application of this Regulation". We see that the recital does not provide for anything new: the consent which was given by a data subject earlier and which was given consistent with the Regulation should not be repeated, which had been assumed.
Finally, Article 99 reminds the mandatory character of all the elements contained in the Regulation and its directly binding character in all Member States.
The Directive
-
Potential issues
The lack of a transitional regime is problematic, for example, when considering the impact analyses that must precede the implementation of certain processing operations or the prior consultation of the supervisory authority. Will the rendering of compliance with the existing processing operations result in the need for retroactive analyses or prior consultations? The second version of the Regulation provided explicitly for these scenarios, incorporating an exemption if the processing was consistent with the Directive, but this was erased in the final version.
Such seems to be the extreme consequences which the system of rendering the processing operations into compliance results in – and is provided for in one recital only. In addition to the questions that may be asked on the nature of such a “rule” that is provided for in the preamble only, how will such a regime be coordinated with the entry into force of the multiple new national rules designed to apply the Regulation in each national state.
