EDPS Opinion 8/2026 on the Proposal for a Regulation on digital networks (Digital Networks Act)

Opinion 8/2026

on the Proposal for a Regulation on digital networks (Digital Networks Act)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a framework of measures to facilitate the transport of military equipment, goods and personnel across the Union. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 21 January 2026, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council on digital networks, amending Regulation (EU) 2015/2120, Directive 2002/58/EC and Decision No 676/2002/EC and repealing Regulation (EU) 2018/1971, Directive (EU) 2018/1972 and Decision No 243/2012/EU (Digital Networks Act).

The Proposal would establish a framework for harmonised rules governing the provision of electronic communications networks and services in the internal market, while supporting the Union’s policy objectives of consumer welfare, industrial competitiveness, security and resilience, and sustainability. In doing so, the Proposal would replace certain existing EU legislative instruments that govern the connectivity ecosystem, namely the European Electronic Communications Code (EECC), the Body of European Regulators for Electronic Communications (BEREC) Regulation, the Radio Spectrum Policy Programme (RSPP), and replace and amend parts of the Open Internet Regulation (OIR) and parts of the Directive 2002/58/EC (ePrivacy Directive).

The EDPS welcomes the aim of the Proposal, fostering a single market for digital networks. To ensure a high level of protection of privacy and of personal data, as well as legal certainty, the EDPS recommends introducing a number of clarifications and changes. In particular, the EDPS recommends: - clarifying that processing of personal data of the end-user in the context of electronic communications services should not be seen as remuneration provided by the data subject for the provision of the electronic communication services; - further detailing possible measures to protect end-users against fraudulent activities; - ensuring that end-users are asked for consent before they are included in a printed or electronic public directory.

In terms of governance, the EDPS recommends designating supervisory authorities pursuant to the GDPR as competent for the supervision and enforcement of the provisions of the ePrivacy Directive inserted in the Proposal. In addition, the Proposal should explicitly enable the exchange of relevant information among national competent authorities and data protection authorities where it is necessary for the performance of their tasks.

Finally, the EDPS notes that the recitals to the Proposal envisage the possibility of processing of geospatial network data in combination with granular socio-economic and physical micro-data at the level of individual address points for the performance of regulatory tasks. In this regard, the EDPS recommends to further assess whether processing of data referring to household composition, age structure, and disposable income is truly necessary. If this is the case, the Proposal should clearly specify the relevant categories of data in the enacting terms of the Proposal and provide for appropriate data protection safeguards.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 21 January 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on digital networks, amending Regulation (EU) 2015/2120 , Directive 2002/58/EC and Decision No 676/2002/EC and repealing Regulation (EU) 2018/1971 , Directive (EU) 2018/1972 and Decision No 243/2012/EU (Digital Networks Act) (‘the Proposal’).

2. The Proposal aims to simplify and improve coordination of the regulatory framework, enabling providers to operate and innovate more effectively in the single market. The Proposal establishes a new policy framework for harmonised rules governing the provision of electronic communications networks and services in the internal market, while supporting 4 the Union’s policy objectives of consumer welfare, industrial competitiveness, security and resilience, and sustainability .

3. The Proposal would replace certain existing EU legislative instruments that govern the connectivity ecosystem: the European Electronic Communications Code (EECC) , the Body of European Regulators for Electronic Communications (BEREC) Regulation , the Radio Spectrum Policy Programme (RSPP) , parts of the Open Internet Regulation (OIR) and Directive 2002/58/EC (ePrivacy Directive) . The aim of merging these instruments into a Digital Networks Act in the form of a Regulation is to simplify and better coordinate the rules, thus fostering the single market .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 21 January 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to the present consultation in recital 415 of the Proposal.

2. General remarks

5. The EDPS welcomes the objectives of the Proposal, particularly the objective to promote access to fast, secure and resilient digital infrastructure across the EU .

6. This Opinion focus on the privacy and data protection aspects of the Proposal, but does not address other aspects of the Proposal, such as those concerning competition aspects or ‘net neutrality’.

7. The Proposal does not contain a general recital on the applicability of EU data protection law, but only refers to the protection of personal data and the GDPR in certain recitals 5 referring to specific provisions of the Proposal . As the provision of electronic communications will by nature entail the processing of personal data, the EDPS recommends inserting a general recital recalling the applicability of the GDPR and of the EUDPR , as well as of Directive 2002/58/EC (‘ePrivacy Directive’) to any processing of personal data conducted in relation with the activities covered by the Proposal.

8. The EDPS also recommends recalling in the same recital that any measure adopted to implement the Proposal must comply with the conditions and limits related to the protection of the fundamental right to privacy and to the protection of personal data, enshrined, respectively, in Article 7 and Article 8 of the Charter of fundamental rights of the European Union.

3. Remuneration for the provision of electronic communication services

9. The EDPS welcomes that the Proposal recalls that the protection of personal data is a fundamental right and that therefore personal data cannot be considered a commodity . However, the same recital of the Proposal specifies that ‘access, use, or otherwise processing of personal data in the context of the supply of electronic communications services should be treated in the same manner as remuneration, where the provider of a service requests and the end-user knowingly provides personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council directly or indirectly to the provider’.

10. The EDPS understands that, in line with the case law of the CJEU, remuneration also exists if the service provider is paid by a third party and not by the service recipient, as the concept of remuneration of a service supplied by a service provider within the course of its economic activity does not require the service to be paid for by those for whom it is performed .

11. However, the statement that processing of personal data should be treated ‘in the same manner as remuneration’ may be misunderstood as suggesting that the processing of endusers’ personal data may be considered as ‘counter-performance’ provided by end-users in the context of the supply of electronic communications services. Considering personal data as ‘counter-performance’ in this context is however not consistent and not compatible with 6 the notion of consent under the GDPR and would undermine the current legal grounds for lawful processing as set out in Article 6 of the GDPR .

12. Recital 11 goes on to state that the processing of personal data should also be treated in the same manner as remuneration in ‘situations where the end-user allows access to information without actively supplying it, such as personal data, including the IP address, or other automatically generated information, such as information collected and transmitted by a cookie or similar technologies’. In this regard, the EDPS notes that whether the data are provided ‘actively’ or not does not change the conclusion that the processing of personal data should not be considered as remuneration or counter-performance provided by endusers.

13. In addition, the EDPS recalls that the use of communication, traffic and location data is strictly regulated by the ePrivacy Directive, which lists the purposes for which such data may be processed . Advertisement is not one of the purposes listed under these provisions and may therefore only be delivered with the consent of the users .

14. Against this background, the EDPS recommends deleting from Recital 11 the wording suggesting that processing of personal data amounts to remuneration provided by endusers and to recall that any use of data protected under Articles 5, 6 and 7 of the ePrivacy Directive for advertising purposes would require valid consent of the individual concerned .

15. Furthermore, the EDPS remarks that the Proposal provides rules on contract duration and termination. Recital 270 of the Proposal refers to changes to “the contractual conditions [..] 7 in relation to [..] the processing of personal data on lawful grounds pursuant to Union Data protection law other than consent". The EDPS recalls that information about the processing of personal data should be provided in compliance with the EU data protection laws in the data protection notice, instead of being a matter of contractual specification.

16. Moreover, the EDPS considers that revenue generated through the processing of personal data -if fully compliant with data protection law- should be taken into account when assessing the appropriateness and level of price control obligations by national regulatory authorities .

17. Finally, the EDPS recommends clarifying that the provision of ‘universal services’ pursuant to Article 87 of the Proposal must not be made conditional on consent of the data subject to the processing of personal data that is not necessary for the provision of the internet access service (e.g., processing of personal data for the purpose of targeted advertising). Indeed, in such cases, user’s consent would not be valid under Article 7 GDPR, considering the possible lack of alternatives for the user, as well as the imbalance of power between the user and the provider.

4. Traffic management measures implemented by the providers of internet access services

18. As preliminary consideration, the EDPS recalls that Article 7 of the Charter of Fundamental Rights of the European Union protects the right to confidentiality of communications . Any interference with this right, including for traffic management purposes, is only permissible insofar as necessary and proportionate to the specific objective pursued.

19. Pursuant to Article 93(3) of the Proposal , providers of internet access services must treat all traffic equally, without discrimination, restriction or interference, and regardless of the sender or the receiver, the content accessed or distributed, the applications or services used or provided, or the terminal equipment used. The second sub-paragraph of this article specifies that this does not prevent providers of internet access services from implementing reasonable traffic management measures. The Proposal specifies that traffic management measures must be transparent, non-discriminatory and proportionate, not based on commercial considerations, but on objectively different technical quality of service requirements. The EDPS welcomes that Article 93(3) specifies that these measures must not 8 monitor the specific content of the traffic and must not be maintained for longer than necessary .

20. The EDPS further welcomes that Article 93(4) of the Proposal explicitly states that any traffic management measure may entail processing of personal data only if such processing is necessary and proportionate to achieve the objectives set out in Article 93(3) and complies with the GDPR as well as the ePrivacy Directive .

21. The EDPS notes that the current Open Internet Regulation (OIR) provides, in its recitals, useful guidance on what constitutes a reasonable traffic management measure . The EDPS welcomes that most of the specifications in recitals 9-16 of the OIR are now introduced in Article 93 of the Proposal, as these specifications provide useful guidance about whether certain measures may be considered proportionate. The EDPS recommends adding to the recitals of the Proposal those parts of the recitals 9-16 of the OIR that are not fully reflected in Article 93 of the Proposal .

22. Article 93(6) of the Proposal would empower the Commission to adopt implementing acts detailing the conditions referred to in Article 93. The EDPS recommends adding, to the last sentence in Article 93(6), ‘after having consulted BEREC, in accordance with Article 4(1)(b) of Regulation (EU) 2018/1971’. The EDPS also recalls that, given the impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, such implementing acts fall within the scope of Article 42 of the EUDPR.

23. Recital 263 of the Proposal specifies that "[p]roviders of internet access services should inform consumers in a clear manner how traffic management practices deployed might have an impact on the quality of internet access services, consumers’ privacy and the protection of personal data, as well as about the possible impact of services other than internet access services to which they subscribe, on the quality and availability of their respective internet access services". Considering the impact that the traffic management measures may have on privacy and data protection, the EDPS in principle welcomes this specification. At the same time, the EDPS recalls that providers of internet access services should in any case inform data subjects about the processing of personal data entailed by their traffic management measures in accordance with the GDPR . The EDPS therefore recommends clarifying what information - in addition to information to be provided under the GDPR - should be provided on the potential impact on consumer’s privacy and the protection of personal data . 9

5. Measures protecting end-users against fraudulent activities

24. Article 103 of the Proposal, on the protection of end-users against fraudulent activities, requires providers of internet access services and of publicly available interpersonal communication services to cooperate with national competent authorities to identify effective measures to prevent fraudulent activities, while ensuring full compliance with Union legislation on personal data protection.

25. The EDPS welcomes the reference to Union legislation on personal data protection, since these measures will more than likely entail the processing of personal data. Such processing must therefore fully comply with the GDPR and the ePrivacy Directive.

26. The EDPS notes that, as per Article 103(1) of the Proposal, the relevant measures would be ‘identified’ in the context of a cooperation between the national competent authorities and the providers. This provision however does not specify whether the identified measure is ultimately imposed by the national competent authority or simply chosen by the providers following their cooperation with the competent authority. On the other hand, Article 103(4) of the Proposal provides that the measures will be ‘adopted’ by the competent national authorities taking into account the guidelines adopted by BEREC under paragraph 3 of this provision.

27. In the interest of legal certainty, the EDPS recommends clarifying whether measures identified or adopted by the national competent authorities under Article 103(1) and Article 103(4) of the Proposal are binding upon providers. This is also important from the perspective of compliance with the GDPR, which requires that any processing of personal data occurs with a lawful legal basis . 5.1. Definition of fraud and scope of the measures to prevent fraudulent activities

28. Any legislative or other act that entails processing of personal data must be clear and precise and its application must be foreseeable to persons subject to it . To this end, the objective(s) and purpose(s) of the processing that would result from a legislative or other act should be clearly specified .

29. A clear identification of purpose is a necessary precondition to determine whether data processing complies with data protection law. The purpose must be detailed enough to (1) determine what kind of processing would (or would not) result from the legislative measure 10 and (2) enable an assessment of whether the envisaged processing is necessary to achieve the objectives pursued .

30. In this context, the EDPS welcomes that recital 284 of the Proposal provides examples of fraudulent activities. However, the EDPS considers that the Proposal should further delineate, in the enacting terms, the purpose(s) and scope of the measures that may be adopted or identified pursuant to Article 103 of the Proposal. Further clarity could be provided by defining the notion of “fraud”, “fraudulent activities” or “prevention of fraud” specific to the context of the Proposal in its Article 2. In the absence of clearly circumscribed criteria, there is a risk that fraud detection measures may lead to disproportionate restrictions affecting lawful communications . 5.2. Guidelines and delegated acts on measures to prevent fraud

31. Article 103(3) of the Proposal tasks BEREC to issue, following consultation of the European Data Protection Board (EDPB) and ENISA, guidelines on technical and legal measures protecting end-users against fraudulent activities, including measures by national regulatory authorities or competent authorities to block numbers and services pursuant to Article 52(2) of the Proposal to prevent fraud.

32. Article 103(5) of the Proposal empowers the Commission to adopt delegated acts concerning the measures necessary to ensure the effectiveness, coordination and complementarity of fraud preventing measures within the Union ‘supplementing paragraph 3 of this Article’.

33. The EDPS considers that the relationship between the guidelines and the delegated acts is unclear, which could give rise to overlap or inconsistency between the guidelines adopted by BEREC and the measures adopted by the national regulatory authorities under Article 103(4) of the Proposal. Therefore, the EDPS recommends clarifying the relationship between the guidelines mentioned in Article 103(3) , on the one hand, and the delegated acts referred to in Article 103(5), on the other hand. The EDPS also recalls that, in case of impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, the EDPS must be consulted by the Commission on these delegated acts pursuant to Article 42 of the EUDPR. 5.3. Fundamental rights’ safeguards

34. Finally, the EDPS notes that Article 100 (‘fundamental rights’ safeguard) of the current European Electronic Communications Code (EECC) is not retained in the Proposal. Given 11 the relevance of the provisions of this Article, including as regards fraud prevention measures, the EDPS recommends reinstating the content of Article 100 EECC in the Proposal.

6. Modifications to the ePrivacy Directive

35. The Proposal deletes Articles 7 (itemised billing), 8 (presentation and restriction of calling and connected line identification), 10 (exceptions regarding calling line identification), 11 (automatic call forwarding) and 12 (directories of subscribers) of the ePrivacy Directive . The EDPS notes that Article 7 of the ePrivacy Directive is replaced by Article 95(6), last paragraph, of the Proposal; Article 8 of the ePrivacy Directive is replaced by Article 108 of the Proposal; Article 10 is replaced by Article 109 of the Proposal; Article 11 is replaced by Article 110 of the Proposal.

36. The EDPS regrets that the Commission proposes to remove certain provisions from the ePrivacy Directive instead of modernising the ePrivacy Directive and replacing it by a single regulation laying down clear and specific legal rules concerning the processing of personal data and the protection of privacy in the electronic communications sector .

37. The EDPS notes that Article 12 of the ePrivacy Directive (on directories of subscribers) is deleted and not replaced by an article in the Proposal. The deletion of this provision without equivalent in the Proposal would leave the processing of personal data of users in a directory without the protection of the current Article 12 of the ePrivacy Directive, without any justification. The EDPS considers that the Proposal should maintain a specific provision on the processing of personal data of users in public directories.

38. As noted by recital 307 of the Proposal, it is appropriate for ensuring a high level of protection of the right to privacy and to protection of the personal data that end-users who are natural persons are asked for consent before their personal data are included in a directory. Since the current text of Article 12(2) of the ePrivacy Directive has led to different interpretations and implementations , the EDPS recommends inserting a clear provision in the enacting terms ensuring that natural persons are asked for consent before their personal data are included in a directory. In the interest of legal certainty, the EDPS also recommends providing a definition of ‘public directory of end-users’ in the enacting terms of the Proposal . 12

39. Furthermore, the EDPS recommends reinserting the additional requirements provided under Article 12 of the ePrivacy Directive in the enacting terms of the Proposal and amending recital 307 of the Proposal so as to take into account the changes in the enacting terms.

40. The EDPS understands that the national regulatory authorities mentioned in Article 115 of the Proposal would also be the competent authorities for the provisions of the Proposal that would replace Articles 7-12 of the ePrivacy Directive. Provisions related to the protection of privacy should not be applied in isolation, since they are intertwined with personal data processing and the GDPR. In the interest of simplification and to ensure a high level of protection of personal data, national authorities responsible for enforcement of the GDPR should be entrusted with the oversight of these provisions of the Proposal related to the processing of personal data .

41. The EDPS notes that the Proposal does not provide for a general right to lodge a complaint or judicial redress by the person concerned. Therefore, the EDPS recommends adding to the Proposal specific provisions on administrative and judicial redress for individuals, and to amend Article 197 to explicitly provide individuals with a right to appeal decisions of national competent authorities.

7. Data processing for the performance of regulatory tasks

42. Article 183 of the Proposal, replacing with modifications Article 22 EECC, requires national regulatory authorities or other competent authorities to conduct geographical surveys of network deployments. Recital 388 of the Proposal provides that national regulatory authorities may require the processing of geospatial network data in combination with granular socio-economic and physical micro-data at the level of individual address points. The same recital also specifies that, where processing of personal data is necessary to pursue those tasks, such processing is carried out pursuant to Article 6(1)(e) and Article 6(3) of the GDPR. Moreover, recital 386 specifies that “data concerning household composition, age structure, and disposable income could be relevant for assessing demand elasticity and potential barriers to the adoption of broadband services.”

43. The EDPS notes that the processing of personal data at the individual address level, and notably the types of data specified in recital 386 of the Proposal, may entail a significant interference with the fundamental rights to privacy and to the protection of personal data. 13

44. The EDPS welcomes that Recital 388 of the Proposal refers to the promotion of the use of a "Secure Processing Environment" (SPE) to aggregate data before any public reporting to ensure full compliance with the principles of statistical confidentiality laid down in Regulation (EC) No 223/2009 .

45. However, the EDPS notes that Article 183 does not make any reference to data referring to household composition, age structure, and disposable income, nor does it provide for any specific safeguards for the processing of personal data.

46. Against this background, the EDPS recommends : (i) reassessing whether data referring to household composition, age structure, and disposable income are necessary for the purposes of Article 183 of the Proposal; (ii) if this is the case, to include further justifications in the recitals to the Proposal and to specify the relevant categories of data in the enacting terms of the Proposal; (iii) specifying that any data processing for the purposes specified in Article 183 of the Proposal must occur only for these purposes and with anonymised data or, if personal data is necessary for these purposes, with pseudonymised data; (iv) specifying in Article 183 of the Proposal data protection safeguards that are in line with 54 55 Regulation (EC) 223/2009 as amended by Regulation (EU) 2024/3018 , as well as with Regulation (EU) 2025/2458 .

8. Governance

47. The EDPS welcomes that Article 167(3) of the Proposal recalls that the EUDPR applies to the processing of personal data by the Office for Digital Networks (ODN) . A similar provision is recommended having regard to the Radio Spectrum Policy Body (‘RSPB’), established under Article 131 of the Proposal. 14

48. The EDPS welcomes that Article 122(11) of the Proposal provides that BEREC must, where appropriate, consult and cooperate with relevant national authorities, including those competent for data protection. The sharing of information with data protection authorities may be relevant, for example, in the context of enforcement of the provisions of the Proposal related to traffic management measures or to measures against fraudulent activities. Therefore, the EDPS recommends making specific reference in Article 171 of the Proposal to data protection authorities among the authorities with whom the exchange of information may occur.

9. Conclusion

49. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal recalling the applicability of the GDPR and of the EUDPR, as well as of the ePrivacy Directive; (2) to amend the wording in recital 11 of the Proposal as specified in Section 3 of this Opinion; (3) to clarify in recital 263 of the Proposal what information should be provided on the potential impact on consumer’s privacy and the protection of personal data; (4) adding to the recitals of the Proposal those parts of the recitals 9-16 of the OIR that are not fully reflected in Article 93 of the Proposal; (5) to add, to the last sentence in Article 93(6) of the Proposal, “after having consulted BEREC, in accordance with Article 4(1)(b) of Regulation (EU) 2018/1971ₚ; (6) to clarify the legal nature of the measures identified or adopted by the national competent authorities under Article 103(1) and Article 103(4) of the Proposal; (7) to further delineate, in the enacting terms, the purpose(s) and scope of the measures that may be adopted or identified pursuant to Article 103 of the Proposal, for example by defining the notion of “fraud”, “fraudulent activities” or “prevention of fraud” ; (8) to clarify the relationship between the guidelines mentioned in Article 103(3) and the delegated acts referred to in Article 103(5) of the Proposal; (9) to reinstate the content of Article 100 of the European Electronic Communications Code (EECC) in the Proposal; (10) to insert a clear provision in the enacting terms of the Proposal ensuring that natural persons are asked for consent before their personal data are included in a directory and to provide for a definition of ‘public directory of end-users’ ; (11) to render supervisory authorities designated pursuant to the GDPR competent for the supervision and enforcement of the provisions of the ePrivacy Directive inserted in the Proposal related to the processing of personal data; 15 (12) add to the Proposal specific provisions on administrative and judicial redress for individuals, and to amend Article 197 to explicitly provide individuals with a right to appeal decisions of national competent authorities; (13) having regard to data processing for the performance of regulatory tasks: (i) to assess whether data referring to household composition, age structure, and disposable income are necessary for the purposes of Article 183 of the Proposal; (ii) if this is the case: to include further justifications in the recitals to the Proposal and to specify the relevant categories of data in the enacting terms of the Proposal; (iii) specifying that any data processing for the purposes specified in Article 183 of the Proposal must occur only for these purposes and with anonymised data or, if personal data is necessary for these purposes, with pseudonymised data; (iv) specifying in Article 183 of the Proposal data protection safeguards that are in line with Regulation (EC) 223/2009 as amended by Regulation (EU) 2024/3018, as well as with Regulation (EU) 2025/2458; (14) to recall the applicability of the EUDPR in Article 131 of the Proposal, concerning the processing of personal data by the Radio Spectrum Policy Body (‘RSPB’); (15) to make specific reference in Article 171 of the Proposal to data protection authorities among the authorities with whom the exchange of information may occur. Brussels, 18 March 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 16