Article 93 — Committee procedure

Article 93 GDPR regulates the procedure through which the European Commission adopts implementing acts under the GDPR. Unlike Article 92 GDPR, which governsdelegated acts under Article 290 TFEU, Article 93 concernsimplementing acts adopted underArticle 291 TFEU.

The purpose of Article 93 is not to create substantive data protection rights or obligations. Rather, it establishes the institutional mechanism through which certain technical and uniform implementation measures under the GDPR are adopted.

Article 93 must be read together with:

• Article 291 TFEU (implementing powers),

• Regulation (EU) No. 182/2011 (the Comitology Regulation),

• Recital 168 GDPR (examination procedure),

• Recital 169 GDPR (urgency procedure),

• the various GDPR provisions empowering the Commission to adopt implementing acts.

1. Implementing Acts Under Article 291 TFEU

Under EU law there is an important distinction between:

The GDPR contains both types of powers.

Delegated Acts

Examples

include:

• Article 12(8) GDPR (privacy icons)
• Article 43(8) GDPR (certification requirements) These are governed by Article 92 GDPR.

Implementing Acts

Examples

include:

• adequacy decisions,
• standard contractual clauses,
• certification standards,
• codes of conduct procedures,
• binding corporate rule mechanisms. These are governed by Article 93 GDPR. The purpose of implementing acts is not to modify the GDPR but to ensure that its application remains consistent throughout the European Union.

2. Article 93(1): Commission Assisted by a Committee

Legal Text

The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

This provision requires the Commission to obtain assistance from a committee whenever it adopts implementing acts under the GDPR.

The committee operates under the framework established by Regulation (EU) No. 182/2011, commonly known as theComitology Regulation.

3. Purpose of the Committee

The committee mechanism ensures Member State involvement in the adoption of implementing acts.

Unlike delegated acts, where Parliament and the Council directly supervise the Commission, implementing acts are supervised primarily by Member States.

The committee consists of representatives from the Member States.

This reflects the logic of Article 291 TFEU:

Where uniform implementation of EU law is necessary, Member States should participate in overseeing the Commission's implementing powers.

4. Composition

Under Regulation 182/2011, the committee consists of:

• representatives of all Member States;

• chaired by a Commission representative.

The Commission participates but does not vote.

The Member State representatives are the voting members.

5. Delegated Acts v. Implementing Acts

Although both are non-legislative acts, important differences exist.

Delegated Acts (Article 92)

Control exercised by:

• European Parliament;

• Council.

Purpose:

• supplementing non-essential legislative elements.

Implementing Acts (Article 93)

Control exercised by:

• Member State representatives through a committee.

Purpose:

• ensuring uniform practical implementation.

Thus, Article 93 reflects a different constitutional control mechanism than Article 92.

6. Article 93(2): Examination Procedure

Legal Text

Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

This paragraph incorporates the examination procedure established by Article 5 of Regulation 182/2011.

It is the GDPR's standard procedure for implementing acts.

7. What Is the Examination Procedure?

The examination procedure is the most significant committee procedure under EU law.

Its objective is to ensure Member State oversight where:

• implementing measures have broad impact;

• implementing measures affect multiple Member States;

• uniform implementation is particularly important.

Many GDPR implementing powers fall into this category.

8. GDPR Provisions Using the Examination Procedure

Recital 168 lists the principal GDPR areas where implementing acts are adopted through the examination procedure.

These include:

Article 28(7)

Standard contractual clauses between:

• controllers and processors;

• processors and sub-processors.

Example

The Commission adopted standard contractual clauses for Article 28 processor agreements using implementing powers.

9. Article 40(9)

Codes of conduct.

Example

The Commission may determine the form and approval mechanisms for GDPR codes of conduct.

10. Article 43(9)

Certification mechanisms.

Example

Technical certification standards applicable across Member States.

11. Article 45(3)

Adequacy decisions.

Example

Determining whether:

• Japan,
• the United Kingdom,
• Switzerland,
• another country or territory provides an adequate level of protection.

12. Article 45(5)

Modification or withdrawal of adequacy decisions.

Example

If a country no longer provides adequate safeguards, the Commission may amend or revoke the adequacy finding.

13. Article 46(2)(c) and (d)

Standard protection clauses.

Example

The EU Standard Contractual Clauses (SCCs) used for international transfers.

14. Article 47(3)

Binding Corporate Rules.

Example

Common formats and procedures for multinational groups seeking BCR approval.

15. Article 61(9)

Mutual assistance between supervisory authorities.

16. Article 67

Electronic information exchange between:

• supervisory authorities;

• supervisory authorities and the EDPB.

17. How the Examination Procedure Works

The procedure generally follows five stages.

Step 1: Commission Draft

The Commission prepares a draft implementing act.

Step 2: Committee Meeting

The committee reviews the draft.

Step 3: Vote

Member States vote.

A qualified majority is required.

Step 4: Committee Opinion

The committee may issue:

• favourable opinion;

• negative opinion;

• no opinion.

Step 5: Commission Decision

The Commission acts according to the outcome.

18. Voting Threshold

The committee uses the standard EU qualified majority system.

A qualified majority generally requires:

• at least 55% of Member States;

• representing at least 65% of the EU population.

This prevents a small number of large States or a large number of small States from dominating the process.

19. Possible Outcomes

1. Favourable Opinion

The committee supports the draft.

Result:

✅ Commission adopts the implementing act.

20. Negative Opinion

The committee opposes the draft.

Result:

❌ Commission generally cannot adopt the draft.

It may revise and resubmit it.

21. No Opinion

No qualified majority either way.

Result:

⚖️ The Commission generally retains discretion and may decide whether to proceed, subject to the specific rules applicable.

This situation commonly arises where Member States are divided.

22. Recital 168: Why the Examination Procedure?

Recital 168 explains why the examination procedure is used.

The listed GDPR implementing measures affect:

• cross-border data transfers;

• certification;

• supervisory cooperation;

• contractual safeguards;

• codes of conduct.

All of these require consistent treatment across the EU.

Because inconsistent implementation could undermine the GDPR's uniform application, Member States participate directly in the process.

23. Article 93(3): Urgency Procedure

Legal Text

Where reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with Article 5 thereof, shall apply.

Article 93(3) introduces an exceptional mechanism known as the urgency procedure.

24. Purpose of the Urgency Procedure

Normally, an implementing act must undergo full committee review before becoming effective.

However, some situations require immediate action.

In such cases the Commission may adopt an implementing act before committee review.

The urgency procedure is therefore an exception to the ordinary examination procedure.

25. Conditions for Use

The urgency procedure may only be used where:

• imperative grounds of urgency exist; and

• the urgency is properly justified.

This threshold is intentionally high.

The Commission cannot use the urgency procedure simply because a matter is politically important or time-sensitive.

26. Recital 169: The GDPR Example

Recital 169 identifies the primary GDPR situation where urgency may arise.

Example

Suppose evidence suddenly demonstrates that:

• a third country,
• a territory,
• a sector within a third country,
• or an international organisation no longer provides an adequate level of protection. If immediate harm to EU data subjects could result, the Commission may need to act at once. In that situation the urgency procedure may be justified.

27. How the Urgency Procedure Operates

Step 1

Commission adopts implementing act immediately.

⬇

Step 2

Act enters into force immediately.

⬇

Step 3

Committee review occurs afterward.

⬇

Step 4

Committee delivers its opinion.

28. Duration

An urgent implementing act usually remains valid for a maximum period of six months unless the relevant legislative framework provides otherwise.

This ensures urgency powers remain temporary and are not used to bypass normal committee oversight indefinitely.

29. Relationship Between Articles 92 and 93

A common source of confusion is the distinction between Articles 92 and 93.

The distinction is constitutionally significant because the EU Treaties allocate different oversight mechanisms depending upon the nature of the Commission's powers.

30. Practical Significance

Article 93 has had considerably greater practical impact than Article 92.

Many of the most important GDPR instruments have been adopted using implementing powers, including:

• adequacy decisions;

• Standard Contractual Clauses (SCCs);

• certification-related measures;

• international transfer mechanisms;

• supervisory cooperation arrangements.

Therefore, although Article 93 is procedural, it plays a crucial role in shaping the functioning of GDPR compliance in practice.

Key Takeaways

• Article 93 governs implementing acts under Article 291 TFEU.

• The Commission must be assisted by a committee composed of Member State representatives.

• The ordinary procedure is the examination procedure under Regulation 182/2011.

• Important GDPR measures adopted through this route include:

• adequacy decisions,

• SCCs,

• certification mechanisms,

• codes of conduct,

• BCR procedures,

• supervisory cooperation arrangements.

• The committee votes using qualified majority voting.

• In urgent situations, Article 93(3) permits use of the urgency procedure, allowing immediate implementation before committee review.

• Recitals 168 and 169 explain when the examination and urgency procedures should be used.

• Unlike Article 92, oversight under Article 93 comes primarily from Member States through the committee, rather than from the European Parliament and the Council.