EDPS Opinion 17/2026 on the Proposal for a Regulation amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies

Opinion 17/2026

on the Proposal for a Regulation amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3) ‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and the Council amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 23 June 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (EUDPR).

The Proposal aims to simplify and ensure consistency of the data protection framework applicable to processing of operational data by EU Justice and Home Affairs (JHA) agencies and bodies, including Europol, Eurojust, the European Public Prosecutor’s Office (EPPO), and, to a limited extent, Frontex.

The EDPS welcomes the overall objective of this Proposal, notably to harmonise, complete and streamline the current data protection framework regarding processing of operational data by EU institutions, offices, bodies and agencies active in the area of freedom, security and justice and to clarify his powers vis-à-vis such agencies. This is an important step towards a comprehensive alignment of the data protection framework for the EU institutions, offices, bodies and agencies active in the area of freedom, security and justice, which the EDPS has repeatedly called for.

The EDPS underlines that achieving the objective of a coherent and streamlined legal framework, and ensuring its consistent application, requires effective supervision and enforcement. In this context, clear rules on the exercise of supervisory and enforcement powers, together with effective cooperation between national DPAs and the EDPS are essential to ensure the effective and uniform application of the framework. This is all the more important in the area of criminal justice and law enforcement, given the complex and highly sensitive nature of personal data processing by Union and Member States competent authorities. This Proposal presents an important opportunity to address the identified challenges for the effective and consistent enforcement of data protection rules in a comprehensive and horizontal manner.

Having this in mind, the EDPS recommends in particular (i) maintaining consistency between Chapter IX EUDPR and the Law Enforcement Directive; (ii) to clarify that his powers include ordering compliance whenever an infringement of the EUDPR is identified, as well as the legal possibility to impose interim measures in urgent cases; (iii) to streamline cooperation between the EDPS and national supervisory authorities; (iv) to provide for mandatory cooperation for prior consultations related to joint controllership; (v) to adapt Article 84 EUDPR to provide for scenarios where operational data originate from Member States; and (vi) to bring the coordinated supervision of the Customs Information System (CIS) under the scope of Article 62 of Regulation (EU) 2018/1725. Furthermore, with regard to the existing cooperation agreements allowing exchanges of operational personal data between Europol and Eurojust and third countries, the EDPS recommends ensuring that the data protection safeguards included therein are in full alignment with the current EU data protection frameworks. Finally, the Opinion also underlines the need for additional allocation of both human and financial resources to the EDPS, corresponding to the substantial expansion of the tasks and data-processing capabilities of Union JHA Agencies.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 23 June 2026, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data’ (‘the Proposal’).

2. The objective of the Proposal is to simplify and ensure consistency of the data protection framework applicable to processing of operational data by EU Justice and Home Affairs (JHA) agencies and bodies, including Europol, Eurojust, the European Public Prosecutor’s Office (EPPO), and, to a limited extent, Frontex. This goal is intended to be reached by aligning the relevant rules across EU bodies and agencies. The other primary objectives of the Proposal are to streamline the powers of the European Data Protection Supervisor and to enhance legal certainty .

3. The Proposal is part of a bigger legislative package aimed at strengthening the Union’s capacity to prevent, detect, investigate and prosecute serious cross-border crime, which also includes proposals to strengthen the mandates of Europol and Eurojust and a recast of the Directive on European Investigation Order. In this regard, the EDPS notes that the proposed revisions of the Europol and Eurojust Regulations are actually at the core of the current Proposal . The EDPS has been formally consulted on all these proposals and will issue relevant opinions. In particular, the Proposal aims to identify all common denominators of data protection rules applicable to Europol and Eurojust, and regroups them in the EUDPR, thereby reducing fragmentation and duplication. This should allow the founding acts of Union bodies, offices, and agencies active in the area of law enforcement and criminal justice to maintain only those tailored-made data protection rules, developed to reflect their respective specific operational needs and nature .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 June 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes reference to this consultation in Recital (69) of the Proposal. The EDPS also positively notes that it was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS welcomes and supports the overall objective of the Proposal, notably to harmonise, complete and streamline the current data protection framework regarding processing of operational data by EU institutions, offices, bodies and agencies active in the area of freedom, security and justice (hereinafter also “EU JHA agencies”) and to clarify his powers vis-à-vis such agencies. This is an important step towards a comprehensive alignment of the data protection framework for the EU institutions, offices, bodies and agencies active in the area of freedom, security and justice, which the EDPS has repeatedly called for .

6. The EDPS also welcomes the steps taken by the Proposal towards strengthening the existing framework, for instance the new wording of Article 45 on the Data Protection Officer, of Article 87a on record-keeping for operational personal data as well as the introduction of additional safeguards in Article 88 of the EUDPR on logging. At the same time, he considers that additional improvements are needed for the Proposal to fully achieve its stated objectives.

7. The EDPS underlines that achieving the objective of a coherent and streamlined legal framework, and ensuring its consistent application, requires effective supervision and enforcement. Clear rules on the exercise of supervisory and enforcement powers, together with effective cooperation between national DPAs and the EDPS are essential to ensure the effective and uniform application of the framework.

8. This is all the more essential in the area of criminal justice and law enforcement, given the complex and highly sensitive nature of personal data processing by Union and Member States competent authorities and the risks for all the persons concerned. As the EUDPR will now also serve as the horizontal legal framework governing the processing activities carried out by Europol, Eurojust and the EPPO, it is of critical importance that effective supervision be guaranteed.

9. Therefore, the Proposal should establish a clear legal framework that governs the exercise of the EDPS powers and that enables effective cooperation between the EDPS and national supervisory authorities in the exercise of their respective tasks and powers. The specific recommendations included in this Opinion build on the EDPS’ practical experience to date, as well as his contribution to the first evaluation of the EUDPR and subsequent recommendations .

10. In addition, with the same objective of ensuring coherence and alignment of the legal framework, the EDPS recalls that, in line with Recital 10 EUDPR, the rules for the protection and the free movement of operational personal data processed by the competent Union bodies, offices or agencies should be consistent with Directive (EU) 2016/680. Preserving this uniformity is essential to safeguard the coherence of the Union data protection framework and to ensure the consistent interpretation and application of the relevant rules.

3. Alignment with the Digital Omnibus

11. The EDPS notes that the Proposal also aims to align the provisions on processing of operational 10 11 data with the Digital Omnibus proposal , when relevant . According to recitals 41 and 45 of the Digital Omnibus Proposal, both the EUDPR and the Directive (EU) 2016/680 (“LED”) should be brought into alignment with the changes made to GDPR as soon as possible. However, until the amendments proposed by the Digital Omnibus have been adopted, the final text of those amendments remains uncertain. Moreover, the timeline for the possible amendment of the LED remains unknown .

12. As Chapter IX of the EUDPR is meant to mirror the LED, the EDPS considers it of utmost importance to maintain consistency between the two. Otherwise, there is a risk of fragmentation of the legal framework and of divergence between Chapter IX and the LED. Such divergence would be to the detriment of legal certainty and the coherent application of the relevant rules. For example, in the context of joint operations falling within the scope of both Chapter IX EUDPR and the LED, different rules could apply depending on whether the processing of data is carried out by the Member States' competent authorities or by the EU institution or agency concerned. This would not only create operational complexity but also risks undermining the uniform application of the legal framework.

13. The EDPS therefore recommends aligning the provisions on processing of operational data with the Digital Omnibus proposal together with corresponding changes to the LED.

14. Should the co-legislators nevertheless wish to proceed with already aligning Chapter IX with the Digital Omnibus at this stage, the EDPS recalls the recommendations made in the EDPB- EDPS Joint Opinion on the Digital Omnibus , in particular on automated individual decisionmaking, including profiling, and on the right of access.

15. The EDPS also notes that the amendments in the Proposal aimed at bringing the EUDPR in line with the Digital Omnibus do not extend to the establishment of a common template for notifying a personal data breach and a list of circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. In this regard, the EDPS reiterates the recommendation that the EDPS be provided with the competence to establish both the template and the list .

4. Ensuring effective enforcement

16. Article 95a of the Proposal aims to establish a coherent framework for the supervision of Union bodies, offices and agencies active in the area of law enforcement and criminal justice. The EDPS very much supports the objective of streamlining its supervisory tasks and powers. Effective supervision and enforcement are essential to ensure the alignment and coherence of the legal framework, as well as the consistent application of data protection rules.

4.1. Compliance orders

17. According to the Court of Justice of the EU , the powers of supervisory authorities must be interpreted in light of their fundamental task of ensuring compliance with EU data protection law. Accordingly, each data protection authority must have genuine powers to take effectual action against infringements of EU data protection law, even where the applicable legislation does not expressly provide for a specific corrective power. This follows from their mandate to monitor and enforce compliance with data protection rules, as well as from the principle of effectiveness (effet utile) of EU law.

18. Article 95a(3)(j) of the Proposal provides that the EDPS may order the controller or processor to bring processing operations into compliance with this Regulation and, where applicable, with data protection rules laid down in the founding act of the Union body, office or agency, where appropriate, in a specified manner and within a specified period.

19. The description of the EDPS’ power to order compliance should encompass any infringement of the EUDPR, without being limited to specific processing operations, as suggested by Article 95a(3)(j) of the Proposal. Compliance orders may also be warranted, for example, in relation to record keeping obligations (Article 31) the designation and position of the DPO (Article 43-45 EUDPR), and any other requirements that do not constitute processing operations within the meaning of Article 3(3) EUDPR.

20. While the EDPS considers that its current powers are not limited to processing operations only, it would nevertheless be preferable for those powers to be expressly provided for in the applicable legislative framework. This would enhance legal certainty, transparency and the foreseeability of supervisory action, while clearly defining the scope of the supervisory authority's intervention and thereby contributing to the consistent and effective application of data protection law.

21. This clarification would also ensure the internal coherence of the enforcement framework. Under Article 95a(3), point (l), of the Proposal, the power to impose administrative fines is conditional upon the prior issuance of a binding order. Clarifying that Article 95a(3), point (j) of the Proposal includes the power to order compliance whenever an infringement of the EUDPR is identified would therefore provide a clear legal basis for the subsequent exercise of the fining power and remove any uncertainty as to the interaction between these provisions.

22. For the same reasons and for the sake of consistency, the EDPS also recommends amending Article 58(2), point (e) EUDPR accordingly. This would additionally help to ensure a coherent and comprehensive framework governing the processing of operational personal data by Union institutions, bodies, offices and agencies in a consistent manner.

4.2. Interim measures

23. The EDPS notes that the effectiveness of enforcement of the fundamental right to protection of personal data and to privacy often depends on the timely availability of interim measures to safeguard these rights. This underscores the possibility to adopt interim measures on an urgent basis where there are reasonable grounds to conclude that an EU institution, office, body or agency has infringed the EUDPR or any other legislation conferring supervisory competence on the EDPS.

24. Therefore, in view of ensuring an efficient and prompt enforcement of the applicable data protection law and preventing possible risks for the fundamental rights of the affected data subjects, the EDPS recommends adding in Article 95a of the Proposal such possibility for interim measures.

4.3. Streamlining cooperation

26. The EDPS welcomes the explicit recognition of the need for close cooperation with the national supervisory authorities in the exercise of their respective tasks and powers under Article 95a(1) of the Proposal, as it contributes to the consistent and coherent application of the EU data protection framework.

27. Ensuring effective and efficient means of cooperation between the EDPS and national supervisory authorities is crucial to ensuring the effectiveness of the EUDPR and the coherent application of Union data protection law . As this Proposal seeks to streamline the data protection framework applicable to the processing of operational personal data by JHA agencies, it should also streamline the cooperation between the EDPS and national supervisory authorities. In this regard, the EDPS recalls the previously identified practical obstacles that exist because of the lack of comprehensive rules governing cooperation between national supervisory authorities and the EDPS . In short, these practical obstacles are attributable to the fact that: - provisions governing cooperation between national supervisory authorities and EDPS typically only provide for a general vaguely worded duty of cooperation, without a clearly defined procedure and/or deadlines; - because of a restrictive interpretation of the notion of ‘supervisory authority’ in relation to the EDPS, specific provisions governing cooperation between national supervisory authorities are considered not to be applicable to the cooperation between national SAs and the EDPS; - the EDPS and national supervisory authorities cannot make use of common IT tools that enable secure exchange of information and facilitate the initiation of requests for mutual assistance or joint operations.

28. Streamlining cooperation between the EDPS and national supervisory authorities would greatly facilitate coordinated supervision and enforcement under the EUDPR, the LED, the GDPR and other relevant Union legal acts, including the Europol and Eurojust Regulation. . Moreover, further developing and clarifying the horizontal provisions in the EUDPR on the cooperation and coordination between the EDPS and the national supervisory authorities would also remove the need for additional detailed provisions on the matter in the founding 21 22 legal acts of the Union JHA agencies, in particular Europol and Eurojust , thus contributing for the achievement of the policy objective of the Proposal for more consistent and streamlined data protection framework.

29. In light of the above, the EDPS recommends clarifying the modalities of cooperation between national supervisory authorities and the EDPS. In particular, the amended EUDPR should ensure that: - all data protection supervisory authorities cooperate actively to ensure effective supervision and consistent enforcement of all the Union’s data protection rules; - all data protection supervisory authorities carry out such cooperation in accordance with Article 50 LED, Articles 61, 62, 64(2), and 66(3) GDPR, as well as Articles 61 and 62 EUDPR; - the EDPS is, for purpose of cooperation with national supervisory authorities in accordance with Chapter VII EUDPR, also considered as a “supervisory authority” within the meaning of Chapter VII of the LED and Chapter VII of the GDPR; - the EDPS is able to cooperate and exchange information with the other data protection authorities, including in the JHA area, by using a secure common electronic information and communication system.

30. The EDPS notes that the above recommendations have been supported also by the European Data Protection Board (“EDPB”) in the EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 .

4.4. Mandatory cooperation in specific cases

31. Still with the aim of streamlining cooperation between the EDPS and the national data protection supervisory authorities, the EDPS notes that, based on his practical experience, certain specific cases would benefit from mandatory cooperation. Therefore, he considers that Article 61(1) EUDPR, which lays down a horizontal requirement for the EDPS to cooperate with national supervisory authorities to the extent necessary for the performance of their respective duties, should be further developed with dedicated mechanisms in specific cases where cooperation could be deemed mandatory, as further detailed below.

32. First, in the context of prior consultations pursuant to Article 90 EUDPR and the corresponding Article 28 LED, there is a specific need to ensure consistency of the opinions issued by the EDPS and the national supervisory authorities in relation to processing operations falling under the joint controllership of EU bodies acting in the scope of Chapter 4 or Chapter 5 of Title V of Part III TFEU and Member States competent authorities.

33. In the light of this, the EDPS recommends including under Article 90 EUDPR an express requirement for the EDPS and the concerned national supervisory authorities to cooperate, within the scope of their respective competences and within the framework of their responsibilities, in prior consultation processes related to processing operations falling under joint controllership of EU bodies and Member States national authorities.

34. In the same vein, the EDPS notes that Article 84 EUDPR on the exercise of rights by the data subjects and verification by the EDPS, currently does not contain rules for the scenarios where operational data originate from Member States, which is a very common feature in the area of criminal justice and law enforcement where the Union agencies like Europol act as information hubs.

35. Therefore, the EDPS recommends further developing Article 84 EUDPR by providing that where the operational data concerned are originating from one or more Member States, the EDPS and the national supervisory authority of the Member State that provided the data should, each acting within the scope of their respective competences, ensure that the necessary verifications or a review on the lawfulness of the processing of the data have been carried out correctly. In this context, the national supervisory authorities should inform the EDPS of the outcome of their verifications within an appropriate deadline (not be shorter than one month and not longer than three months).

4.5. Coordinated supervision of the Customs Information System

36. Finally, the EDPS regrets that the Proposal does not take the opportunity to amend Council Regulation (EC) 515/97 so as to bring the coordinated supervision of the Customs Information System (CIS) under the scope of Article 62 of Regulation (EU) 2018/1725. Such an amendment would enhance consistency by transferring the activities of the last remaining Supervision Coordination Group to the Coordinated Supervision Committee (CSC) under the European Data Protection Board (EDPB). In this context, the EDPS recalls the CIS SCG and EDPB joint letter which further details the underlying reasons of this request and recommends including such amendment accordingly . He also calls on the co-legislators to introduce a specific amendment to that purpose.

5. International transfers

37. The EDPS positively notes the introduction of a comprehensive section governing rules for transfers of operational personal data to third countries and international organisations by inserting new Articles 94, 94a, 94b, 94c, 94d, and the effort to streamline the relevant framework by aligning it with the framework established under the LED.

38. He further welcomes the clarification as to what are the ‘legally binding instruments’ that EUIs may use for the purpose of providing appropriate safeguards when transferring personal data outside of the EEA, i.e.: (i) international agreements pursuant to Article 218 TFEU, (ii) cooperation agreements allowing exchanges of operational personal data between Eurojust and third countries which were concluded before 12 December 2019 or IOs; and (iii) cooperation agreements allowing exchanges of operational personal data between Europol and third countries or IOs which were concluded before 1 May 2017.

39. He however notes that the Proposal does not address the need to align the ‘legacy’ agreements referred to in points (ii) and (iii) with the applicable data protection legal framework, which entered into force after their conclusion. Under this framework, transfers of personal data for law enforcement purposes may only take place where robust and effective safeguards are ensured, including, inter alia, effective independent supervision, enforceable and effective data subject rights (such as the right to information and judicial redress), as well as effective oversight and administrative and judicial remedies. It is therefore important to ensure that these agreements provide for the level of protection required by current EU data protection law.

40. While recognising that not all legacy agreements can be revised and amended at once, the EDPS would like to remind that for instruments negotiated prior to the entry into force of the current data protection legislation and their continued application should be conceived as temporary and adaptation-oriented from the outset, not as a perpetual exemption.

41. In light of the above, the EDPS recommends ensuring that these agreements are reviewed and, where necessary, renegotiated to ensure full alignment with the current EU data protection framework .

6. Enhancement of the supervisory capacity of the EDPS

42. As already highlighted in this Opinion, the Proposal is part of a bigger JHA package of criminal justice and law enforcement initiatives aimed at strengthening the Union’s capacity to prevent, detect, investigate and prosecute serious cross-border crime, in particular through new enhanced mandates of Europol and Eurojust.

43. The EDPS notes that the proposed extension of Europol’s and Eurojust’s tasks would not merely entail a quantitative increase in the volume of personal data processed. It would also likely involve more complex processing operations, additional information flows, increased exchanges with national authorities and potentially third countries, as well as a greater need to assess compliance with the applicable data protection safeguards. These developments would inevitably require more intensive and specialised supervision by the EDPS.

44. Effective supervision cannot be ensured without adequate resources. The EDPS’ supervisory responsibilities are a necessary counterpart to the expansion of the JHA agencies’ operational powers. If Europol and Eurojust are entrusted with additional tasks involving the processing of personal data, the EDPS must be equipped with the corresponding human and financial resources to exercise his supervisory mandate effectively, independently and in a timely manner. The EDPS therefore underlines the need for an additional allocation of both human and financial resources to the EDPS.

7. Conclusions

45. In light of the above, the EDPS makes the following recommendations: (1) to refrain from aligning Chapter IX of the EUDPR with the Digital Omnibus proposal absent corresponding changes to the LED; (2) to clarify that Article 95a(3), point (j), of the Proposal includes the power to order compliance whenever an infringement of the EUDPR is identified, and to align Article 58(2), point (e) of the EUDPR accordingly. (3) to provide in Article 95a of the Proposal for the legal possibility for the EDPS to adopt interim measures in urgent cases and to align it with Article 58(2) EUDPR; (4) to provide for clear procedures for cooperation between the EDPS and national supervisory authorities in cases involving the application of the EUDPR, the LED, GDPR and other relevant Union legal acts (such as the Europol and Eurojust Regulation); (5) to provide for mandatory cooperation between the EDPS and national supervisory authorities in case of prior consultations related to joint controllership; (6) to adapt Article 84 EUDPR to provide for scenarios where operational data originate from Member States; (7) to bring the coordinated supervision of the Customs Information System (CIS) under the scope of Article 62 of Regulation (EU) 2018/1725; (8) to ensure that the cooperation agreements allowing exchanges of operational personal data between Eurojust and third countries or international organisations concluded before 12 December 2019, and the cooperation agreements allowing exchanges of operational personal data between Europol and third countries or international organisations concluded before 1 May 2017 are reviewed and, where necessary, brought in line with the applicable data protection law. (9) to recall, by way of a recital, the need for appropriate resources to ensure effective supervision of Union institutions, offices, bodies and agencies, also taking into account to the expansion of the JHA agencies’ operational powers. Brussels, 11 August 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13