The European Data Protection Supervisor has published an opinion on the European Commission’s proposal to amend the EU’s data protection rules for EU institutions and agencies.
The opinion covers planned changes to Regulation (EU) 2018/1725, known as the EU Data Protection Regulation (EUDPR), which governs how EU institutions, bodies, offices and agencies process personal data, the watchdog said in an opinion published on Wednesday.
According to the EDPS, the Commission’s proposal — issued on 23 June 2026 — would simplify and make more consistent the rules for processing “operational data” by EU Justice and Home Affairs agencies, including Europol, Eurojust and the European Public Prosecutor’s Office (EPPO), and to a limited extent Frontex.
Operational data refers to personal data used in day-to-day activities such as law enforcement and criminal justice work.
Supervision and cooperation
The EDPS said effective supervision and enforcement would be needed to ensure the rules are applied consistently, and it pointed to cooperation between national data protection authorities and the EDPS as central to that.
In its opinion, the EDPS recommended keeping the amended EUDPR consistent with the EU’s Law Enforcement Directive, which sets data protection rules for police and criminal justice authorities in member states.
The watchdog also called for clarification that it can order compliance when it finds an infringement of the EUDPR and that it can impose interim measures in urgent cases.
It recommended streamlining cooperation between the EDPS and national supervisory authorities, including mandatory cooperation for some “prior consultations” related to joint controllership — where two or more organisations jointly decide how and why personal data is processed.
The EDPS also suggested adapting Article 84 of the EUDPR to cover situations where operational data originate from member states, and bringing coordinated supervision of the Customs Information System (CIS) under the scope of Article 62 of Regulation (EU) 2018/1725, according to the opinion.
On existing cooperation agreements that allow Europol and Eurojust to exchange operational personal data with third countries, the EDPS said the data protection safeguards in those agreements should be fully aligned with current EU data protection frameworks.
The opinion noted the EDPS would need additional staff and funding to match what it described as a substantial expansion of tasks and data-processing capabilities across EU Justice and Home Affairs agencies.
