The GDPR and the data processing of the competent authorities in performing their duties under the ECSPR

Article 36 ECSPR refers to the application of the GDPR when the competent authorities carry out the functions and duties provided for in the ECSPR. Equally, personal data protection applies to the processing of data by ESMA, when involved. In the exercise of the powers listed in the ECSPR competent authorities have to process personal data following the rules of the GDPR. ESMA must comply with Regulation 2018/1725. The GDPR and Regulation (EU) 2018/1725 are legislations of general application. It is unclear why the ECSPR includes such a specific provision. A similar provision has not been added in the ECSPR for the processing of personal data undertaken by other subjects such as platforms. Nevertheless, in a crowdfunding operation the GDPR applies as a law of general application for personal data processing any time natural persons are involved. This contribution explores the main duties necessary to protect personal data under the law.