The European Commission adopted a legislative package on the digital euro on 28 June 2023. It included a proposal to establish a legal framework for a possible digital euro. More specifically, the proposal establishes the framework for the European Central Bank (ECB) to issue the digital euro, establishes the digital euro as legal tender, and sets out rules for its distribution via payment service providers (PSPs). On 17 October 2023, the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued a joint opinion on the proposal.

The EDPB and the EDPS were generally positive about the introduction of the digital euro. They commended the fact that digital users will still be able to choose between digital and cash payments and that the digital euro will not be "programmable money". The joint opinion also welcomed the proposal's commitment to high privacy and data protection standards for the digital euro as well as the inclusion of an "offline modality" to reduce the processing of personal data.

However, the EDPB and the EDPS expressed the following concerns about potential personal data protection issues in the proposal, which are in line with their previously articulated positions (since 2021):

• The modalities of the distribution of the digital euro;
• The necessity and proportionality of the single access point for the digital euro unique identifiers as well as how data protection by design and by default will be implemented in this context;
• The legal text on how Personal Service Providers (PSPs) are required to process personal data in order to effectively implement the holding limits;
• The pseudonymization of all transaction data vis-à-vis the ECB and the national central banks to ideally be included in the operative part of the proposal;
• The lack of foreseeability of the provisions relating to the general fraud detection and prevention mechanism (FDPM) that the ECB may establish in order to facilitate fraud detection and prevention by PSPs (e.g. tasks of the ECB, tasks to be performed by PSPs).
• The legal basis applicable to the processing operations, the allocation of responsibilities, and the types of personal data to be processed by each of the actors involved in the issuance and use of the digital euro.

The EDPB and the EDPS issued a reminder that they will both continue to monitor the implementation of the digital euro after the laws have been adopted, each within the purview of its respective roles.