Opinion 4/2026 on the Proposal for a Regulation establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union

on the Proposal for a Regulation establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 19 November 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union.

The Proposal aims to facilitate military transport across Member States to support European security and defence, as well as to improve the capacity to respond to natural and man-made disasters while minimising and mitigating the impact of such transport on civilian transport.

The Proposal would establish a uniform framework for military mobility, consisting among others in uniform procedures for permissions of military transport, on resilience of transport infrastructures, on availability of transport and logistic capabilities for military transport operations. As the information exchanges foreseen by the Proposal would entail the processing of personal data, the EDPS welcomes the references to the applicable data protection legislation, as well as the rules concerning the confidentiality and security of information received.

The Proposal would also empower the Commission to adopt implementing acts establishing the following information exchange systems: i) European Military Mobility Enhanced Response System; (ii) Military Mobility Digital Information System. The EDPS recommends empowering the Commission to further specify the categories of personal data to be processed and their storage period, as well as the roles and responsibilities of the controller(s).

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 19 November 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union (‘the Proposal’).

2. The Proposal aims to facilitate military transport across Member States to support European security and defence, as well as the capacity to respond to natural and man-made disasters while minimizing and mitigating the impact of such transport on civilian transport . To fulfil this aim, the Proposal lays down a uniform framework for military mobility . The framework consists, among others, of: (1) uniform military transport permission procedures and rules ; (2) the establishment of a European Military Mobility 7 8 Enhanced Response System (EMERS) ; (3) rules on resilience of transport infrastructure ; and (4) rules on availability of transport and logistic capabilities for military transport operations .

3. The Proposal is accompanied by two annexes, specifying the list of types of military transport operations covered by standing military transport permissions ; the form to request/grant a standing military transport permission ; the form to notify a military transport permission under a standing military transport permission or to request/grant/modify an ad hoc military transport permission .

4. The objective of the Proposal is to establish an EU framework that enables, facilitates and accelerates the transport of military personnel, material and equipment across the territory of the European Union. The Proposal has been issued in the light of the Joint White Paper for European Defence - Readiness 2030 of March 2025 and the Defence Readiness Roadmap 2020 of 16 October 2025 .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 19 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to the present consultation in recital 67 of the Proposal.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, particularly the objective of fostering military mobility in the Union and across member States as enabler for European security and deterrence, also increasing the capacity to react to natural and man-made disorders, while minimising and mitigating the impact of such transport on civilian transport .

7. The information exchanges foreseen by the Proposal would entail the processing of personal data (for instance, relating to the names of owners or operators of military transport services as natural persons) . The EDPS therefore welcomes the reference to the applicability of the GDPR and of the EUDPR, as well as to Directive 2002/58/CE (‘ePrivacy Directive’) in the Proposal.

3. Specific remarks

8. Article 51 of the Proposal contains provisions on personal data protection. The first paragraph of this article reiterates that the Proposal shall be without prejudice to the obligations of Member States relating to their processing of personal data under the GDPR, as well as the ePrivacy Directive, and to the obligations of the Commission and, where appropriate other Union institutions, bodies, offices and agencies under the EUDPR.

9. The second paragraph confirms that the Member States, the Commission and, where appropriate, other Union institutions, bodies, offices and agencies may process personal data where necessary to comply with obligations in this Regulation or where necessary for the exercise of official authority or for tasks in the public interest entrusted to them in this Regulation. In this regard, the EDPS observes that once the obligations and tasks in the public interest are specified in the Proposal, Article 6(1)(c) or Article 6(1)(e) GDPR (or Article

10. The EDPS welcomes the provision according to which information received as a result of the application of the Proposal must be used only for the purpose for which it was requested . This specification is line with the principle of purpose limitation insofar as the processing of personal data is concerned .

11. Finally, the EDPS recalls that it expects to be consulted under Article 42(1) EUDPR on the implementing acts that may be adopted by the Commission to establish the Military Mobility Digital Information System, to be operated and maintained by the Commission , as well as on the implementing act establishing EMERS . The EDPS recommends to clearly define in those acts in particular the categories of personal data to be processed via these systems and their storage period, as well as the roles and responsibilities of the controller(s) .

4. Conclusions

12. In light of the above, the EDPS recommends empowering the Commission to further specify the categories of personal data to be processed and their storage period, as well as the roles and responsibilities of the controller(s) in the context of Military Mobility Digital Information System and EMERS. Brussels, 12 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI