It's very simple to be compliant - just don't process PII that isn't core to your business process for serving given user (marketing isn't considered core process unless it's literally the service you provide the affected user)

It's not that the European Commission cannot, it's that they won't (wonnot? ). The EU is made up of different institutions that want different things.

This is not GDPR. Regulation (EU) 2018/1725 is about how the European Parliament, Council and other bodies, offices of it has to handle information.

It would be similar to a federal law in the US that dictate that no information stored in the tax office, police databases or social security administration may be shared or stored outside the US. US citizens may expect that when dealing with the US government, information stored about them stays inside the US.

In the context of internal security and national sovereignty, it make sense to have dedicated regulation. It similar to how lawyers/doctors has more strict regulation regarding personal information that other professions.