EU regulations versus directives: why GDPR applies everywhere at once

Two pieces of EU law touch Czech residents every day, and they have very different legal shapes. The General Data Protection Regulation, which tells a Czech webshop how to treat your personal data, applies in Czechia exactly as in Portugal, because it is a regulation. The Consumer Rights Directive, which gives you 14 days to return an online order, does not apply directly: Czechia had to write its own rules to deliver the same result, and they sit in the Civil Code and consumer protection legislation. Lawyers learn the difference between the two in their first week, and it explains a good deal about why EU law looks the way it does.

The legal acts in the treaty

Article 288 of the Treaty on the Functioning of the European Union lists five types of act the institutions can adopt, three binding and two not.

A regulation has general application. It is binding in its entirety and directly applicable in all member states.

A directive is binding, as to the result to be achieved, upon each member state to which it is addressed, but leaves to the national authorities the choice of form and methods.

A decision is binding in its entirety. If it specifies those to whom it is addressed, it is binding only on them.

Recommendations and opinions have no binding force.

The three binding types have different jobs. Regulations suit areas needing uniform rules: competition, customs, data protection, air passenger rights. Directives suit areas where legal systems differ and a common outcome must be fitted to national law: consumer protection, company law, employment rules. Decisions handle individual matters, such as approving a state aid scheme or addressing one company.

What "directly applicable" means

A regulation need not be copied into Czech law, and Czech legislators are generally not supposed to copy it, because that could blur its EU origin and the Court of Justice's role in interpreting it. It enters into force on the date it specifies or, failing that, on the twentieth day after publication in the Official Journal of the EU. From then on a Czech court or authority must apply it, and it takes priority over conflicting Czech law. That priority is the subject of EU law supremacy and national courts.

National law still has a role. Many regulations leave matters to member states or ask them to designate authorities, set penalties or fill gaps. The GDPR is the best-known case. It applies directly in Czechia, but the country also adopted a national act on personal data processing, which names the Office for Personal Data Protection as supervisory authority and covers what the regulation leaves open. The result is a hybrid, and a lawyer reads both.

What transposition involves

A directive sets a transposition deadline, usually in its last article. The period varies and is often around two years. By then each state must adopt measures that achieve the result. In Czechia that usually means amending a statute or passing a new act in the ordinary legislative process, though a technical directive may be transposed by government decree.

The legislative path is described in our explainer on the Czech Parliament, and the institutions in how the EU works.

When a state does not comply

If a state misses the deadline, or transposes incorrectly, the Commission can start an infringement procedure under Article 258 of the treaty. It sends a letter of formal notice, then a reasoned opinion, and may bring the matter to the Court of Justice. Where the case concerns a failure to notify transposition measures, the Commission can ask the Court to impose financial penalties at the first stage, under Article 260(3). If the Court finds against a state and the state still does not comply, penalties can follow. The Commission publishes its infringement decisions regularly, and those for Czechia can be looked up in its infringement database.

The Court of Justice has also built doctrines that protect individuals when a directive is not properly transposed. Once the deadline has passed, an individual can in some circumstances invoke a directive against the state (vertical direct effect), where its provisions are clear, precise and unconditional. It cannot be invoked directly against a private party (no horizontal direct effect). National courts must interpret national law, as far as possible, in line with the directive. And if a state's failure to transpose causes loss, the individual may be entitled to compensation under the principle of state liability set out in the Francovich case of 1991. How national courts handle these doctrines is discussed in Czech Constitutional Court and EU law.

The Czech vocabulary

Czech legal and press texts use fixed words: a regulation is nařízení, a directive směrnice and a decision rozhodnutí. A Czech statute that implements a directive usually says so in a clause and often lists the acts in an annex. When a ministry calls a bill a "transposition", it is carrying out a directive. When it says a bill "adapts" Czech law to a regulation, it is adding the national rules the regulation leaves to the member state. Article 288, in Czech.

Delegated and implementing acts add another layer. A legislative act can empower the Commission to adopt detailed rules, usually as regulations or decisions published in the Official Journal. Much of the technical detail businesses deal with, from product labelling to customs codes, sits in these acts rather than in the main legislative text.

Why the EU uses both

The choice is political as much as legal. A regulation brings uniformity and speed and removes the risk of divergent national versions. A directive leaves room for different legal systems and traditions. In recent years the institutions have reached for regulations more often in digital markets, data and financial services, partly because a patchwork of national rules was seen as a barrier to the single market.

In practice, if a rule comes from a regulation, the EU text is the law and the reading starts there. If it comes from a directive, the Czech act is the law and the directive is the guide to interpreting it. A footnote or preamble in the Czech statute usually names the directive it implements.

Frequently asked questions

Is GDPR a directive or a regulation?

A regulation, Regulation (EU) 2016/679. It applies directly in all member states.

Does a regulation need to be turned into Czech law?

No. It applies directly, though national law may add rules where the regulation allows or requires it.

What happens if Czechia is late with a directive?

The Commission can start infringement proceedings, and individuals may be able to rely on clear provisions against the state.

Can I rely on a directive against a private company?

Not directly. But national courts must interpret national law in line with the directive as far as possible.