Impact on member states - implementation, enforcement, direct effect
Directives are not directly applicable: states transpose them, so approaches vary - the great challenge of EU privacy law. The Commission can take enforcement action for late or improper transposition, and some Directive provisions had direct effect. The GDPR, as a regulation, applies directly, but more than 50 opening clauses still let states supplement it - leaving room for variation (e.g. DPO thresholds, children's consent age).
EU directives are not directly applicable: they bind as to the result but leave form and method to member states, so national law varies in approach, structure and content. This creates practical headaches for multinationals facing conflicting rules on data retention, transfers and marketing. The GDPR, a regulation, applies directly - but its opening clauses reintroduce some variation.
| Aspect | EU Directive | EU Regulation (GDPR) |
|---|---|---|
| Directly applicable? | No - needs national transposition | Yes - applies automatically |
| Result vs method | Binds as to result; method left to states | Binding in full |
| Variation | High (different national laws) | Lower, but >50 opening clauses allow supplements |
| Direct effect | Some provisions could have direct effect | Applies directly throughout the EU |
- Enforcement: the Commission can act against late or improper transposition - e.g. it referred the UK to the CJEU (2010) and sued six states for late transposition; Luxembourg was found to have failed its obligations
- Direct effect: even unimplemented, certain Directive provisions could be relied on by individuals against the state; the CJEU held some had direct effect
- Opening clauses: more than 50 in the GDPR let states make supplementary national law (needed for political agreement)
- Examples of variation: Germany kept a DPO threshold (≥20 persons in automated processing); the children's consent age is 16 by default but states may set it lower, no less than 13
Harmonisation was the goal: a single law to cut the fragmentation of the Directive era. But more than 50 opening clauses mean organisations still face some inconsistent national requirements.