Which EU institution is vested with the competence to propose new data protection legislation on...

According to the CIPP/E study guide1, the European Commission is the EU institution that has the power to propose new data protection legislation on its own initiative, as well as amend or repeal existing laws. The European Commission is also responsible for implementing and enforcing the EU data protection framework, in cooperation with other institutions and national authorities.

References: 1: Free CIPP/E Study Guide - International Association of Privacy Professionals