What happens if Europol refuses to confirm or deny whether it holds data on me?

Europol may issue a ‘neither confirm nor deny’ response under Article 36(6) if disclosure would undermine ongoing investigations, compromise national security, or prejudice the rights of third parties. This response is itself informative — it typically indicates that data does exist but cannot be revealed. In such cases, you retain the right to request that the European Data Protection Supervisor (EDPS) verify the lawfulness of Europol’s data processing on your behalf. The EDPS will review the file and confirm whether your rights have been respected, even if specific details remain restricted.