Presidential Veto Does Not Affect the Competences of the President of the Personal Data Protection Office Regarding the Transparency and Targeting of Political Advertising

President Karol Nawrocki has refused to sign the Act of 4 September 2026 on the authorities competent for and procedures relating to political advertising, and liability for breaches of the obligations in this area [1]. The Act was intended to ensure the full implementation of Regulation (EU) 2024/900 of the European Parliament and of the Council on the transparency and targeting of political advertising [2].

The vetoed Act identifies the authorities responsible for carrying out the tasks laid down in Regulation (EU) 2024/900 and supervising compliance with its provisions. It also provides for penalties for infringements and governs the procedures to be followed before these authorities. However, as regards the President of the Personal Data Protection Office, the provisions of the Act are merely intended to clarify and organise the existing legal framework, as the President’s powers derive directly from Regulation (EU) 2024/900, which has been directly applicable in all EU Member States since 10 October 2025.

Article 22(1) of Regulation (EU) 2024/900 expressly establishes the competence of data protection authorities, including the President of the Personal Data Protection Office, to monitor compliance with the requirements laid down in Articles 18 and 19 concerning targeting and ad-delivery techniques in the context of online political advertising, as well as compliance with the additional transparency requirements applicable to the use of these techniques. The EU legislature has also decided that Article 58 of the General Data Protection Regulation (GDPR) is to apply accordingly in this context and that the provisions of Chapter VII of that Regulation, concerning cooperation and consistency, are to apply in full. Furthermore, pursuant to Article 25(6) of Regulation (EU) 2024/900, the President of the Personal Data Protection Office is empowered, within the scope of their competence, to impose administrative fines in accordance with Article 83 of the GDPR.

It should nevertheless be borne in mind that Regulation (EU) 2024/900 establishes a broader range of obligations that fall outside the remit of the President of the Personal Data Protection Office. Further information on Regulation (EU) 2024/900 and the obligations arising from Articles 18 and 19 is available in the relevant announcement.

The European Data Protection Board is currently working on guidelines concerning Articles 18 and 19 of Regulation (EU) 2024/900. On 27 March 2026, the Board held a public consultation on this subject. A report on the consultation is available.