Europe’s data protection watchdog has published an opinion on European Commission proposals to update and replace the rules governing Europol, the EU’s law enforcement agency.
The European Commission put forward the draft regulation on 24 June 2026, which would amend existing rules and repeal the current Europol Regulation, the European Data Protection Supervisor said in an opinion published on Thursday.
The proposals are intended to strengthen Europol’s legal framework in response to cross-border criminal threats and member states’ operational needs, with a focus on bolstering the agency’s role as an EU information hub, operational hub and technology and innovation hub.
The EDPS said it supports the overall objective of reinforcing Europol’s role in helping national law enforcement authorities and supporting cooperation between member states.
However, it said choices made by EU lawmakers would have “a lasting impact” on how the EU balances security with the protection of fundamental rights.
Concerns over data on people not linked to investigations
The EDPS said it is “particularly concerned” about the risks to the right to personal data protection if Europol is given broader scope to process personal data on individuals with no established links to criminal investigations or proceedings.
It added the proposals would allow Europol to retain data on large numbers of individuals with no established connection to criminal activity for an “extensive and unspecified” period, adding that the draft in its current form does not provide sufficient and effective safeguards in such situations.
The watchdog said it is calling for a clear and comprehensive legal framework with minimum safeguards and effective oversight and enforcement mechanisms for EU data protection law.
It noted that its opinion includes recommendations aimed at improving legal clarity and certainty, as well as “foreseeability, transparency and accountability” for any new data processing powers given to Europol.
The EDPS also said it provides advice on proposed rules for access to and searches of Europol systems, handling personal data obtained directly from private parties, supervision of Europol staff carrying out data processing in member states, cooperation with national supervisory authorities, and the security of Europol services and tools.
