Which EU institution is vested with the competence to propose new data protection legislation on its own initiative?

According to the CIPP/E study guide1, the European Commission is the EU institution that has the

power to propose new data protection legislation on its own initiative, as well as amend or repeal

existing laws. The European Commission is also responsible for implementing and enforcing the EU

data protection framework, in cooperation with other institutions and national authorities.

Reference: 1: Free CIPP/E Study Guide - International Association of Privacy Professionals

Reference: https://www.tandfonline.com/doi/full/10.1080/13600834.2019.1573501