What legal grounds can I use to challenge Europol sharing my data with a non-EU country?

You can challenge transfers based on inadequacy of data protection in the receiving country, lack of appropriate safeguards, absence of a valid legal basis under the Europol Regulation, or disproportionate interference with your fundamental rights under Articles 7 and 8 of the EU Charter. Procedural grounds include failure to conduct required data protection impact assessments or absence of binding agreements with the third country. The European Data Protection Supervisor (EDPS) has oversight authority, and complaints typically receive initial assessment within 3–6 months.