EDPS Opinion 9/2026 on the Proposal for a Regulation establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities

Opinion 9/2026

on the Proposal for a Regulation establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 16 July 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities.

The Proposal would establish harmonised rules streamlining the reporting and collection of information on the tracking of expenditure of Union budget and on the measurement of the objectives achieved by the programmes and activities financed via the Union budget.

The EDPS welcomes the aim of the Proposal, fostering harmonization of information to be collected and, in some cases, published for transparency reasons. At the same time, to ensure a high level of protection of privacy and of personal data, as well as legal certainty, the EDPS recommends introducing clarifications and changes. In particular, the EDPS recommends:

- ensuring that the publication of personal data relating to a beneficiary takes place on the basis of criteria established either by EU or Member State law that include distinctions based on relevant criteria (such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof);

- giving practical effect to the principle of data minimisation by clarifying which data is to be processed and in which form, taking into account the different purposes pursued;

- to specify the types of special categories of personal data under Article 9 GDPR that would be processed for the purposes referred to in Article 19(4) of the Proposal, and - to further specify what are the “administrative and statistical registers” referred to in Article 19(5). Finally, the EDPS recommends further clarifying the roles of the Commission and of the competent authorities of the Member States as (joint) controllers for the processing of personal data envisaged by the Proposal.

2

Contents 4. Dedicated provision on the processing of personal data .. 6

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 July 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a budget expenditure tracking and performance framework and other horizontal rules for the Union programmes and activities .

2. The Proposal aims to: - make consistent the provisions for supporting principles across the EU budget, thereby reducing complexity for beneficiaries and increasing the coherence of EU action; - streamline and harmonise the system for monitoring EU spending and the performance of the budget, making it possible to aggregate data across programmes, increasing transparency and reducing costs for stakeholders; - harmonise and rationalise the reporting of performance information and the provision of information about funding opportunities across the EU budget, increasing transparency for stakeholders and facilitating access to EU funds for potential beneficiaries .

3. The Proposal is accompanied by five annexes, specifying: intervention fields and indicators ; lists of codes for the territorial dimension ; specific climate and environment spending 7 8 targets ; list of programmes and activities mainstreaming gender ; information, communication and visibility .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 February 2026, pursuant to Article 42(1) of EUDPR. The EDPS recommends including a reference to the present consultation in a recital of the Proposal.

2. General remarks

5. The EDPS welcomes the objectives of the Proposal, particularly the objectives of harmonising provisions across the EU budget as regards horizontal principles (such as gender equality) and streamlining EU budget performance monitoring through standardised performance indicators .

6. Recital 25 of the Proposal clarifies that the application of the Proposal would entail the processing of different categories of personal data relating to entities involved in the implementation of the Union budget so as to allow for, among others, the identification of those entities, calculation of appropriate performance indicators and evaluation of the achievement of objectives in the relevant sectors. Such processing may in particular be necessary for the purposes of carrying out their respective obligations in relation to monitoring and reporting, communication, publication, evaluation, financial management, verifications, audits and, where applicable, determining the eligibility of participants.

7. Against this background, the EDPS recommends including in recital 25 the reference to the applicability of EU data protection law, namely Regulation (EU) 2016/679 (‘the GDPR’) and the EUDPR , to any processing of personal data conducted in relation with the activities covered by the Proposal.

3. Publication of personal data

8. The EDPS notes that the Proposal provides for the setting up by the Commission of a dedicated publicly available website (the ‘Single Gateway’), having the functions listed at points (a)-(g) of Article 12(1). This includes providing information referred to in Article 38 and Article 142(1) of Regulation (EU, Euratom) 2024/2509 , which entails the processing of personal data such as the first and last name of the recipient of funds in case of a natural person and the name of persons in the context of publication of exclusion and financial penalties . The EDPS recommends clarifying in Article 12(1)(b) that the publication should occur in accordance with the criteria specified in paragraph (3) of Article 38 and paragraph (2) of Article 142 of Regulation (EU, Euratom) 2024/2509.

9. The Proposal requires Member States to ensure information, communication and visibility of support and achievements of the Union funds and communicate to citizens through a website . The EDPS welcomes the specification that publication of personal data must comply with the GDPR . However, the EDPS recommends deleting this reference and rather including this clarification in the recital recalling the applicability of GDPR and EUDPR as recommended in paragraph 7 of this Opinion. Instead, the EDPS recommends specifying in Article 18(5) of the Proposal that the information to be published should contain personal data only insofar as necessary and proportionate to the transparency objective pursued by the publication, on the basis of criteria to be established either by EU law or by Member States .

4. Dedicated provision on the processing of personal data

10. The Proposal contains a horizontal provision on the processing of personal data . The EDPS welcomes the specification according to which personal data can only be processed where necessary for the purpose of carrying out their obligations under the Proposal , as well as the indications provided regarding the categories of personal data to be processed.

11. The EDPS considers that Article 19(1) and (2) of the Proposal reflect the principle of data minimisation enshrined in Article 5(1)(c) of the GDPR. The EDPS recommends adding an explicit reference to this provision by way of a recital. In addition, the EDPS understands that Article 19(2) of the Proposal aims to provide an indication of which categories of personal data may need to be processed in order to pursue the different purposes outlined in Article 19(1). However, the EDPS understands that Article 19(2) is neither exhaustive (the wording includes “in particular”), nor normative (not each category of personal data mentioned in Article 19(2) will be necessary for each of the purposes mentioned in Article 19(1)).

12. Against this background, the EDPS recommends introducing the contents of Article 19(2) of the Proposal to a recital. Instead of the current paragraph 2, the EDPS recommends making a distinction between, on the one hand, processing for which anonymous or pseudonymised data may be sufficient for the purpose being pursued (such as the monitoring of contributions by means of EU coefficients or in the context the budget expenditure tracking and performance framework ) and, on the other hand, processing for which non pseudonymised personal data is necessary (such as verifications of eligibility or in case of audits on beneficiaries of funds ). Such a paragraph would give effective criteria to determine which data is to be processed and in which form (personal, anonymous or pseudonymised).

13. In this regard, the EDPS positively notes that the Proposal already provides that personal data must be provided to the third parties referred to in Article 11(5) of the Proposal only in pseudonymised format or in anonymised format where the disclosure of personal data is not necessary to achieve the objectives of the regulation .

14. The EDPS also welcomes the provisions of the Proposal on data retention , and on access restriction and logs .

15. However, the EDPS recommends specifying the types of special categories of personal data under Articles 9 of the GDPR and 10 of the EUDPR that would be processed only for the purposes referred to in Article 19(4) of the Proposal. The EDPS also recommends clarifying the articulation between this paragraph and Article 9 of the GDPR, by adding a Recital clarifying that the processing of data under this paragraph will take place under Article 9(2)(g) of the GDPR, which provides that the processing of personal data can take place for reasons of substantial public interest.

16. The EDPS also recommends further specifying what are the “administrative and statistical registers” referred to in Article 19(5), notably on the types of registers from which information, including personal data, would be re-used.

17. Regarding the setting up by the Commission of the Single Gateway, having the functions specified in Article 12(1)(a)-(g), including displaying information on the activities financed by the budget, the EDPS understands that the Commission, as entity determining both the purpose and means of the data processing , would be the controller.

18. The EDPS also notes that the Proposal does not designate as controller, joint controller or processor the Commission and the competent authorities of the Member States regarding the “electronic data exchange system between the Member States and the Commission referred to in Annex XVI to Regulation .../... [National and Regional Partnership Plans – SFC 2028]” .

19. Therefore, the EDPS recommends designating in Article 19 the Commission as controller for the processing of personal data provided in Article 12 of the Proposal, and to designate as controller, joint controller or processor the Commission and/or of the competent authorities of the Member States having regard to the “electronic data exchange system” referred to in Article 14(1) of the Proposal, taking into account their respective roles and involvement in the envisaged electronic data exchange system.

20. Article 19(8)-(10) of the Proposal, refer, respectively, to the implementation of the resources of the Fund in accordance with Article 62(1), first subparagraph, point (a), (b), and (c) of Regulation (EU, Euratom) 2024/2509 (“direct management”; “shared management”; “indirect management”). Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law . Against this background, the EDPS welcomes that the Proposal aims to clarify the roles of the actors involved . However, the EDPS considers that the reference to “data collected by Member States’ authorities and communicated to the Commission are processed for the Commission’s tasks” is not sufficiently clear to effectively determine the role of the Commission as controller (or as joint controller with the national entity or authority) . The EDPS therefore recommends clarifying the criteria to be followed to determine the role of the Commission as controller (or joint controller) when data is “communicated to the Commission and processed for the Commission’s tasks”.

5. Conclusion

21. In light of the above, the EDPS makes the following recommendations: (1) to add a recital to the Proposal referring to the consultation of the EDPS; (2) to add in recital 25 of the Proposal the reference to the applicability of the GDPR and of the EUDPR; (3) to add to Article 12(1)(b) of the Proposal that the publication should occur in accordance with the criteria specified in paragraph (3) of Article 38 and paragraph (2) of Article 142 of Regulation (EU, Euratom) 2024/2509; (4) to clarify in Article 18(5) of the Proposal that the information to be published should contain personal data only insofar as necessary and proportionate to the transparency objective pursued by the publication; (5) to ensure that the publication of personal data relating to a beneficiary takes place on the basis of criteria to be established either by EU law or by Member States which makes appropriate distinctions based on relevant criteria such as the periods during which those persons have received such aid, the frequency of such aid or the nature and amount thereof; (5) to give practical effect to the principle of data minimisation by clarifying which data is to be processed and in which form (personal, anonymous or pseudonymised), taking into account the different purposes pursued; (6) to specify the types of special categories of personal data under Article 9 GDPR that would be processed for the purposes referred to in Article 19(4) of the Proposal; (8) to specify in Article 19 of the Proposal the controller role of the Commission for the processing of personal data provided in Article 12 of the Proposal, and to specify the controller, joint controller or processor role of the Commission and of the competent authorities of the Member States having regard to the “electronic data exchange system” referred to in Article 14(1) of the Proposal; (9) to further clarify the criteria to be followed to determine the role of the Commission as controller (or joint controller) when data is communicated to the Commission and processed for the Commission’s tasks. Brussels, 17 April 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9