The European Commission's plan to turn Europol into a centralised hub for police data processing has triggered a sharp warning from the EU's privacy watchdog, who says the proposal poses "serious risks" to the privacy of people with no criminal connections.
The European Data Protection Supervisor Wojciech Wiewiórowski published an opinion Thursday raising alarm over reforms unveiled by the Commission in June that would fundamentally change how Europol handles the vast troves of data it collects from national police forces. The changes are part of a broader Commission strategy to give EU justice agencies more technological muscle to fight cross-border crime and terrorism.
The Regulatory Shift
At the heart of the proposal is a significant relaxation of current data-sorting rules. Under existing regulations, Europol must categorise data before determining whether it can legally process it. The Commission has called this a "key operational bottleneck," arguing that Europol struggles to manage high volumes of unstructured data under the current framework.
The proposed reforms would remove that requirement, allowing Europol to process data first and sort it later. That's where the privacy concerns begin. Wiewiórowski warned that the proposal would permit Europol to retain data on a "vast" number of people with no links to criminal activity "for an extensive and unspecified period of time."
Sovereignty and Oversight Questions
The EDPS opinion doesn't reject the need for stronger security tools. Wiewiórowski acknowledged that Europe's security architecture must evolve to counter increasingly complex criminal threats. But he stressed that the proposed Europol reform "must provide robust safeguards and real oversight."
That's the tension at the core of this debate. National police forces need to share intelligence to stop terrorists and organised crime networks that don't respect borders. But centralising that data in Brussels raises questions about who controls it, who can access it, and what happens to information on ordinary citizens who've done nothing wrong.
The EDPS is the data protection authority responsible for supervising EU institutions including Europol. It also advises the Commission on the privacy implications of legislative proposals. Its opinions aren't binding, but they carry weight in the European Parliament and Council, where the Europol reforms will now be debated.
Wiewiórowski's specific concern is the processing of personal data "of individuals with no established criminal links." That means people who haven't been charged, arrested, or even suspected of crimes could have their information stored indefinitely in Europol's systems simply because their data was swept up in a broader investigation.
Why This Matters:
This isn't an abstract debate about privacy versus security. It's a question of whether Brussels should be allowed to build a centralised database on European citizens without clear limits on retention, access, or oversight. The Commission's argument that current rules create bottlenecks is valid — police forces do need to share data quickly to stop serious crime. But the EDPS warning highlights a fundamental problem: the proposal doesn't specify how long Europol can keep data on people with no criminal links, who can access it, or what safeguards exist to prevent misuse. National governments should demand answers before handing over more power to an EU agency that already has a patchy record on data protection. Effective policing and respect for privacy aren't mutually exclusive. The challenge is ensuring Brussels doesn't use the fight against crime as cover for building surveillance infrastructure that exceeds what's necessary and proportionate.