The European Commission wants Europol to become the central system for police forces to trade and analyse data using the latest technologies, and Europe’s data protection supervisor says that plan poses "serious risks" to people’s privacy. The proposal, unveiled in June 2026, would hand the EU’s policing agency more power over information gathered across borders, all in the name of giving justice agencies more firepower against cross-border crime and terrorism.
Brussels Builds a Bigger Surveillance Machine
The Commission’s reform would change how Europol sifts through the data it collects. Current rules require data to be sorted into different categories before Europol can decide whether it can legally use it. The new plan would relax that requirement, which the Commission has described as a "key operational bottleneck" because Europol handles high volumes of unstructured data. That’s the language of the Brussels apparatus when it wants fewer brakes and more reach.
In an opinion published Thursday, European Data Protection Supervisor Wojciech Wiewiórowski said the proposal "creates serious risks, particularly regarding the processing of the personal data of individuals with no established criminal links." He warned that Europol could retain data on a "vast" number of people with no links to criminal activity "for an extensive and unspecified period of time." That’s not a narrow tool aimed at a few suspects. It’s a wider net, cast first and sorted later.
The EDPS, which supervises EU institutions including Europol and advises the Commission on the privacy implications of legislative reforms, acknowledged that Europe’s security architecture needs to be developed to protect against increasingly complex criminal threats. But even that cautious institutional language came with a warning: the proposed reform "must provide robust safeguards and real oversight." The demand is plain enough. The machinery keeps expanding. The safeguards are supposed to catch up after the fact.
The State’s Appetite for Data
Europol sits at the centre of this plan. The Commission wants it to become the hub where police forces across the EU trade and analyse information, using the latest technologies to do it faster and on a larger scale. The stated target is cross-border crime and terrorism. The practical effect, according to the privacy watchdog, is a system that could hold on to personal data from people who have no established criminal links at all.
That matters because the proposal does not just concern suspects already under investigation. Wiewiórowski’s warning goes straight to the people who get swept into state databases without ever being tied to a crime. The Commission’s answer is to call the existing rules a bottleneck. The people whose data gets processed, retained, and analysed are not the ones writing that memo.
The reform also reflects a familiar pattern in Europe’s security architecture: more centralisation, more technical capacity, more institutional confidence that bigger systems can solve the problems they help produce. The Commission says Europol needs the change because it deals with high volumes of unstructured data. The EDPS says the result could be serious risks to privacy and weak oversight over data held for an unspecified period.
Oversight After the Expansion
The watchdog’s opinion does not reject the idea that Europe’s security architecture should evolve. It does, however, insist that any reform must come with "robust safeguards and real oversight." That phrase lands with some force because the proposal itself is built around loosening current rules. The Commission wants fewer constraints on how Europol processes information. The EDPS wants the opposite: real limits before the machine gets any bigger.
For now, the plan remains a Commission proposal from June 2026, and the warning from Thursday stands as the clearest public rebuke so far. Europol’s growing role in data processing is being sold as efficiency and protection. The privacy watchdog’s language points to something else entirely: a centralised police system with more power to keep, sort, and use personal data on a vast scale, including from people with no criminal links. In Brussels, that gets called a bottleneck. Outside the glass, it looks a lot more like the state asking for a longer reach and fewer questions.