What legal standard does the European Data Protection Supervisor apply when reviewing Europol data complaints?

The EDPS reviews Europol data complaints under the lawfulness, accuracy, and necessity criteria established in Regulation 2016/794 and the Charter of Fundamental Rights. The applicable standard requires Europol to demonstrate that retained data remains necessary for operational purposes and is factually accurate. The EDPS does not reassess underlying criminal allegations but examines whether Europol’s processing complies with its legal framework. Decisions typically issue within 6–12 months of complaint submission. Where the EDPS finds violations, it can order deletion and issue binding recommendations — though enforcement against member state source data requires separate national proceedings.