Opinion 6/2026 on the Commission Proposal for a Regulation as regards the further development of capital market integration and supervision within the Union

on the Regulation on the further development of capital market integration and supervision within the Union

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1095/2010, No 648/2012, No 600/2014, No 909/2014, 2015/2365, 2019/1156, 2021/23, 2022/858, 2023/1114, No 1060/2009, 2016/1011, 2017/2402, 2023/2631 and 2024/3005 as regards the further development of capital market integration and supervision within the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 4 December 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1095/2010, No 648/2012, No 600/2014, No 909/2014, 2015/2365, 2019/1156, 2021/23, 2022/858, 2023/1114, No 1060/2009, 2016/1011, 2017/2402, 2023/2631 and 2024/3005 as regards the further development of capital market integration and supervision within the Union.

The EDPS welcomes the objectives of the Proposal, in particular in relation to the centralisation of supervision of EU laws at EU level (in this case, within the European Securities and Markets Authority). The EDPS recalls that objectives related to regulatory simplification are not incompatible - and, in fact, should be pursued together with - robust protections for individuals in the EU, as investors and as data subjects under EU data protection legislation.

The EDPS positively notes that the Proposal acknowledges that the information collected by ESMA may include personal data only if it is relevant and necessary for the exercise of ESMA’s tasks, in compliance with the applicable EU rules on the protection of personal data. As the Proposal would empower ESMA to enter into administrative arrangements and arrangements for the exchange of information with third countries and international organisations, the EDPS recalls that he should issue an authorisation to ESMA under the EUDPR before ESMA can enter into such administrative arrangements or agreements based on Article 48(3)(b) EUDPR.

The Proposal would require ESMA to set up a platform to facilitate the collection, storage, access to and processing of information as provided under the ESMA Regulation and other Union acts mandating the use of this platform. The EDPS understands that ESMA would process personal data in the platform as a processor under EU data protection law, but notes that it is not clear who it would be processing personal data on behalf of. Therefore, the EDPS recommends clarifying the role and obligations under EU data protection law of ESMA and of the entities submitting and accessing information in the data platform.

The EDPS recalls that information submitted via the European Single Access Point should only contain personal data where this is required by Union or national law or constitutes a necessary element of the information about the entity’s economic activities. When accessing it, ESMA must comply with specific obligations stemming from Union law. The EDPS recommends recalling the relevant requirements in a Recital of the Proposal.

Lastly, the EDPS considers it important to empower the Commission to lay down, via delegated or implementing act, requirements for obliged entities that must assess and report to ESMA on the good repute of the persons mentioned in the regulations that would be amended by the Proposal, including by specifying the personal data to be processed in that context.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 4 December 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 1095/2010 (‘ESMA Regulation’) , No 648/2012 (‘EMIR’) , No 600/2014 (‘MiFIR’) , No 909/2014 (‘CSDR’) , 2015/2365 (‘SFTR’) , 2019/1156 (‘CBDR’) , 2021/23 (‘CCPRRR’) , 2022/858 (‘DLTPR’) , 2023/1114 (‘MiCA’) , No 1060/2009 (‘CRA Regulation’) , 2016/1011 (‘Benchmarks 4

2. The objective of the Proposal is to remove barriers stemming from the lack of harmonisation of EU rules and supervisory approaches resulting in the fragmentation and underperformance of EU capital markets. The Proposal aims to integrate EU capital markets and improve the functioning of the EU single market in financial services for the benefit of investors, businesses and the wider EU economy. This would entail making supervision more effective, conducive to cross-border activities, and responsive to emerging risks, by strengthening and increasing the supervisory convergence tools of the European Securities and Markets Authority (’ESMA’). The Proposal would also adapt the existing financial services rulebook to accommodate new technologies, like Distributed Ledger Technologies (‘DLT’), thereby implementing the Commission’s Digital Finance Strategy .

3. The Proposal fits within the goal of pursuing regulatory simplification, to make crossborder activities more cost-effective. This would be achieved by moving certain provisions from directives to regulations; narrowing the scope for nationally imposed measures; refining empowerments for the adoption of delegated and implementing acts; and streamlining supervisory arrangements.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 4 December 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 108 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

5. The EDPS recalls that he was consulted and issued Opinions on some on the legislative proposals that led to the adoption of the Regulations that the Proposal would amend.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, in particular in relation to centralizing supervision of EU laws at EU level (in this case, within ESMA). The EDPS recalls that objectives related to regulatory simplification are not incompatible - and, in fact, should be pursued together with - robust protections for individuals in the EU, as investors and as data subjects under EU data protection legislation.

7. The EDPS notes that Regulation (EU) 2016/679 (‘GDPR’) would apply when personal data would be processed in the context of the Proposal. There would also be cases where EU bodies covered by the Proposal such as ESMA would be subject to the EUDPR (e.g., when assisting a national competent authority in carrying out an on-site inspection). The EDPS would thus recommend including a reference to the application of both the GDPR and EUDPR in a Recital of the Proposal.

3. ESMA’s supervisory tasks

8. Article 1(26) of the Proposal would add a new Chapter IIa to the ESMA Regulation, to define the powers of ESMA over financial market participants under ESMA’s supervision. Within that Chapter, Articles 39b, c, and d would specify the information that ESMA may request from market participants and obtain during investigations and on-site inspections.

9. Article 8(22) of the Proposal would insert a new Chapter 6 in Title VII of the DLTPR, thereby granting supervisory responsibilities, powers and competences to ESMA with respect to crypto-asset service providers. Similar amendments are foreseen under the other frameworks that would be amended by the Proposal to grant supervisory powers to ESMA over the obliged entities under those frameworks.

10. The EDPS welcomes that Recital 13 of the Proposal clarifies that the information collected by ESMA may include personal data, to the extent that it is relevant and necessary for the exercise of ESMA’s tasks, and that the processing of such data should comply with the applicable EU rules on the protection of personal data, in particular the principles of necessity, proportionality and purpose limitation.

11. The EDPS welcomes that new Article 39i of the ESMA Regulation would limit the issuance of public statements by ESMA identifying the person responsible for a breach where this publication is deemed necessary by ESMA to protect the stability of the financial markets or to ensure the effective enforcement of the ESMA Regulation, provided that the publication is limited to what is strictly necessary to ensure those objectives and properly justified. In the same vein, the EDPS welcomes that Article 39k would not entitle ESMA to disclose personal data when publishing fines and periodic penalty payments.

12. Article 9(22) of the Proposal, amending Regulation (EU) 2023/1114 on crypto-assets, would introduce Article 138d allowing ESMA to conclude administrative agreements on the exchange of information with third countries in relation to supervisory responsibilities, powers and competences of ESMA with respect to crypto-asset service providers. The EDPS welcomes that the information disclosed would be subject to professional secrecy and the reference to the fact that ESMA shall apply the EUDPR with regards to transfers of personal data to third countries.

13. The EDPS also welcomes that Article 1(23) of the Proposal would empower ESMA to enter into administrative arrangements with third country regulatory and supervisory authorities and international organisations for the purpose of fostering international supervisory cooperation, including through the exchange of information and/or staff. The EDPS notes that such an arrangement shall include provisions governing professional secrecy and take due account of applicable data protection legislation.

14. However, the EDPS recommends clarifying in Article 1(23) of the Proposal that the ESMA shall apply the EUDPR in case personal data is transferred under the administrative arrangement to third countries, also with a view to ensure consistency with the provisions of Article 9(22) of the Proposal. It is also recommended to make clear, both under Article 1(23) and Article 9(22) of the Proposal, that a prior authorisation of the EDPS should be obtained by ESMA before the signature of the administrative arrangement or agreement in case the transfer is based on Article 48(3)(b) EUDPR.

4. Data platform

15. Article 1(25) of the Proposal would impose an obligation on ESMA to set up a platform to facilitate the collection, storage, access to and processing of information as provided under the ESMA Regulation and other Union acts mandating the use of this platform.

16. According to the Proposal, this data platform would contribute to high-quality data governance consistent with ‘FAIR’ principles (Findable, Accessible, Interoperable, Reusable) and include the supervisory technology and other tools to enhance analysis and monitoring capabilities of the relevant authorities and information.

17. Recital 12 of the Proposal provides that the ‘Agency’ (which the EDPS presumes refers to the ‘Authority’, i.e., ESMA) would be acting a processor of personal data. In that capacity, ESMA would be expected to implement appropriate technical and organisational measures to ensure the security, availability, maintenance and development of the software and IT infrastructure of the platform. ESMA should also limit its processing of personal data in the platform to what is necessary to facilitate the collection, storage, access to and processing of the information submitted in accordance with the Union acts mentioned in paragraph 12 of this Opinion.

18. The EDPS understands that ESMA would process personal data in the platform as a processor under EU data protection law, but notes that it is not clear who it would be processing personal data on behalf of. Therefore, the EDPS recommends clarifying the role and obligations under EU data protection law of ESMA and of the entities submitting and accessing information in the data platform in Article 1(25) of the Proposal, in line with Article 3(12) EUDPR for the role of processor and Article 3(8) for the role of controller. The EDPS also recommends clarifying the roles and responsibilities of entities submitting and accessing information in the data platform under the GDPR and the EUDPR.

5. European Single Access Point

19. Article 3(17) of the Proposal would replace Article 23a of the MiFIR in what concerns accessibility of information via the European Single Access Point (‘ESAP’) established under Regulation (EU) 2023/2859 .

20. The EDPS notes that the information transmitted via the ESAP would need to indicate whether it contains personal data. The EDPS recalls that entities submitting information via the ESAP should remove personal data therefrom, except where the personal data are required by Union or national law or constitute a necessary element of the information about the entity’s economic activities.

21. In addition to its obligations under the EUDPR, the EDPS recalls that ESMA must also comply with the obligations laid down in Article 11(3) of Regulation (EU) 2023/2859 in relation to personal data it accesses via the ESAP. For the sake of clarity, the EDPS recommends recalling these obligations by way of a recital.

6. Good repute

22. Article 2(15) of the Proposal would add Articles 22a to 22e to the EMIR, thereby conferring powers to the ESMA over significant central counterparties (‘CCPs’). Article 22c(5) would mandate ESMA to refuse or subsequently withdraw the appointment of the person or persons referred to in Article 27 of the EMIR if it is not satisfied that the person is of sufficiently good repute.

23. The EDPS recommends empowering the Commission to lay down, via a delegated or implementing act, requirements for CCPs to assess and report to ESMA on the good repute of the persons referred to in Article 27 of the EMIR, including by specifying the personal data to be processed in that context. While such an empowerment already exists under MiCA , an equivalent empowerment should be granted to the Commission in relation to the requirements stemming from: a. novel Article 2d(1) of the MiFIR as proposed by Article 3(3) of the Proposal in relation to the members of the management body of a market operator and the members or participants of investment firms; c. the amended version of Article 5(5) of the DLTPR as proposed under Article 8(6) of the Proposal in relation to participants in DLT settlement systems.

7. Conclusions

24. In light of the above, the EDPS makes the following recommendations: (1) to include a reference to the application of the GDPR and EUDPR in a Recital of the Proposal; (2) to clarify in Article 1(23) of the Proposal that ESMA shall apply the EUDPR in case personal data is transferred under the administrative arrangement to third countries; (3) to clarify that, both under Article 1(23) and Article 9(22) of the Proposal, a prior authorisation of the EDPS should be obtained by ESMA before the signature of the administrative arrangement or agreement in case the transfer is based on Article 48(3)(b) EUDPR; (4) to clarify the roles and responsibilities under the GDPR and the EUDPR of ESMA and of the entities submitting and accessing personal data in the data platform proposed under Article 1(25) of the Proposal; (5) to recall the obligations of ESMA and of the entities submitting information via the ESAP under the EUDPR and Regulation (EU) 2023/2859 in relation to personal data they access and submit via the European Single Access Point; and (6) to empower the Commission to lay down via a delegated or implementing act requirements for obliged entities under the Union acts that would be amended by the Proposal to assess and report to ESMA on the good repute of the persons mentioned in those acts, including by specifying the personal data to be processed under those acts. Brussels, 29 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI