Recital 26a
Also numbered 26aITRE–LIBE amendments 206 and 207 (CJ72-AM-786820, pages 123–125) propose a different recital 26a. The tracker keeps it as a separate provision: Recital 26a (new).
Changes since18 June 2026ST 10677/26, Recital 26a
Same wording as in the Council text of 18 June 2026. Every text of this provision
Text as printed
Same wording since 10 June · Changes since the Commission proposal
While Member State are required to designate one or more competent authorities to be responsible for the application and enforcement of Regulation (EU) 2023/2854 (competent authorities), uncertainty persists about the role of supervisory authorities responsible for monitoring and enforcement of Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 under Regulation (EU) 2023/2854.
Regulation (EU) 2023/2854 recalls that Regulation (EU) 2016/679 applies to the processing of personal data by private and public authorities of the Member States and Regulation (EU) 2018/1725 applies to the processing of personal data by all Union institutions and bodies when these organisations are data holders, data users or third parties under this regulation. It further stipulates that the powers and competences of supervisory authorities under Regulation (EU) 2016/679 and (EU) 2017/1725 remain unaffected by Regulation (EU) 2023/2854. In addition, the current rules of Regulation (EU) 2023/2854 state that these authorities are responsible for monitoring the application of Regulation (EU) 2023/2854 insofar as the protection of personal data is concerned and impose fines for the infringement of this regulation.
To clarify the role and responsibilities of the supervisory authorities responsible for monitoring and enforcing Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 when personal data are processed pursuant to this regulation and to increase legal certainty, it is necessary to amend Regulation (EU) 2023/2854 by deleting Articles 37(3) and 40(4) and (5) of that Regulation.