Europol Data Deletion Request Lawyer

Article 36 of EU Regulation 2016/794 grants data subjects the right not only to access personal data held by Europol, but also to request its rectification, erasure, or restriction of processing. This right applies where the data is inaccurate, incomplete, stored beyond its lawful retention period, or processed in violation of Europol’s data protection rules.

The European Data Protection Supervisor (EDPS) supervises Europol’s compliance with these obligations and can order Europol to delete or correct data. Ultimately, if internal and supervisory remedies fail, individuals can seek judicial enforcement before the Court of Justice of the European Union.

Our lawyers have experience handling deletion requests across a range of scenarios — politically motivated law enforcement data, data submitted by third countries without adequate legal basis, and data that is factually inaccurate or relates to resolved or dropped proceedings.

Europol is required to delete or correct your data when any of the following applies:

• Inaccuracy: The data contains factual errors — wrong identity, incorrect dates, or misattributed actions.
• Unlawful processing: The data was submitted in violation of Europol’s data protection rules or the underlying criminal allegation lacks proper legal basis.
• Purpose limitation: The data is being used for a purpose other than the one for which it was originally submitted.
• Storage beyond retention period: Europol’s rules impose retention limits on different categories of data. Data held beyond these limits must be deleted.
• Politically motivated data: Data submitted to Europol by states pursuing politically motivated prosecutions against individuals may be challenged on the basis that it violates fundamental rights.
• Third-country data concerns: Data received from non-EU cooperation partners (USA, Israel, Ukraine, etc.) may lack adequate legal basis under EU data protection law.

Our lawyers assess all available grounds and pursue the strongest legal strategy for your case.

A Europol deletion request is submitted directly to Europol’s Data Protection Function, in writing, setting out the specific data concerned and the legal grounds for its deletion. The request must be accompanied by evidence supporting the grounds claimed.

Europol is required to respond within three months. If Europol agrees to delete or correct the data, it notifies the data subject and — crucially — also notifies any Europol member states or third-country partners that originally provided the data, instructing them to take corresponding action in their own systems.

If Europol refuses to delete or correct the data, the refusal must be reasoned and in writing. At this point, the matter can be escalated to the EDPS or pursued through judicial channels.

One of the most significant aspects of Europol data deletion is its cross-border effect. When Europol deletes data, it is obliged to notify all parties to whom it previously transmitted that data — including EU member state law enforcement agencies and third-country cooperation partners — and to request that they also delete the data from their own systems.

This means a single successful Europol deletion request can potentially result in data being removed from multiple national law enforcement databases simultaneously. This cross-border effect is one of the key advantages of challenging data at the Europol level rather than attempting to address each national database individually.

Not all data challenges result in complete deletion. In some cases, a more appropriate remedy is rectification (correcting inaccurate elements while retaining the rest), restriction of processing (preventing the data from being shared or acted upon while its lawfulness is under review), or annotation (flagging the data as disputed).

Our lawyers advise on the most appropriate remedy for your specific circumstances. In urgent cases — where the data is actively causing harm such as travel restrictions, banking difficulties, or extradition risk — we seek interim restriction of processing as a precautionary measure while the full deletion request is being processed.