Clearly the exisiting regulation 45/2001 has a little more wiggle room. FTA:

> This leak would normally constitute a breach of the General Data Protection Regulation (GDPR) if other organisations had done it themselves. However, a spokesman the commission said, based on “legal reasons”, European institutions are separate from the GDPR.

Yes, at the time. In October, that regulation was replaced by Regulation (EU) 2018/1725, which adapted it to the principles of the GDPR. So essentially you had a gap of a few months, during which that event occurred.