EDPS Complaint Against Europol — Legal Support

What Is the EDPS and Why Does It Matter?

How to File an EDPS Complaint Against Europol

EDPS Complaints and CJEU Litigation

Frequently Asked Questions

Can I file an EDPS complaint if I don’t know exactly what data Europol holds on me?

Yes. You can file a complaint based on reasonable grounds to believe Europol processes your data — such as unexplained banking restrictions, visa refusals referencing security concerns, or information from national authorities suggesting Europol involvement. The EDPS can investigate Europol’s databases even without you providing specific file references. In practice, many successful complaints begin with circumstantial evidence. The EDPS has independent investigative powers under Regulation 2018/1725 and can compel Europol to disclose whether data exists and its lawful basis.

What happens if Europol claims national security exemptions to block my complaint?

Europol frequently invokes Article 36(6) restrictions, claiming disclosure would harm ongoing investigations or national security. However, these exemptions are not absolute. The EDPS scrutinises whether the restriction is proportionate and time-limited. If Europol applies blanket refusals without case-specific justification, the EDPS can find the restriction unlawful. Importantly, even where access is legitimately restricted, the EDPS can still verify data accuracy and lawfulness through confidential review — meaning your rights are protected even when you cannot personally see the underlying data.

How long does an EDPS investigation into Europol typically take?

Most EDPS investigations conclude within 12 to 18 months, though complex cases involving multiple data sources or third-country transfers may extend to 24 months. The EDPS typically acknowledges complaints within one month and requests Europol’s response within two to three months. Delays often occur when Europol claims it must consult contributing Member States before responding. Requesting interim measures — such as suspension of data transfers — can accelerate review of urgent cases, particularly where ongoing harm such as asset freezing or travel bans is documented.

Will Europol be notified that I filed an EDPS complaint, and could this affect my case?

Yes, Europol is notified and invited to respond to your complaint. This is a formal administrative process, not anonymous. However, filing a complaint cannot lawfully prejudice your position — the EDPS monitors for any retaliatory data processing. In practice, filing often prompts Europol to review its files more carefully, occasionally resulting in voluntary corrections before the EDPS issues a decision. If you are concerned about sensitive ongoing proceedings, the timing and framing of the complaint can be strategically managed to minimise any perceived adverse signalling.

Can an EDPS decision against Europol help me in national court proceedings?

An EDPS finding that Europol processed your data unlawfully creates persuasive — sometimes binding — authority in national proceedings. Courts in EU Member States must consider whether evidence derived from unlawfully processed Europol data should be excluded or given reduced weight. In extradition and mutual legal assistance cases, an EDPS decision documenting data protection violations can support arguments that cooperation should be refused on human rights grounds. The decision also establishes an official record that can be cited in civil claims for damages under EU law.

How an EDPS Decision Strengthens Your Legal Position

An EDPS ruling that Europol processed your data unlawfully does far more than require deletion of a database entry. It creates an authoritative legal record — issued by the EU’s independent data protection supervisory body — that your personal data was handled in breach of Regulation (EU) 2016/794. This record carries weight across multiple parallel proceedings and legal systems.

• Extradition proceedings: National courts in EU Member States must consider whether evidence or intelligence derived from unlawfully processed Europol data should be excluded or given reduced weight. An EDPS decision documenting systemic processing violations can support arguments that extradition cooperation should be refused on human rights grounds under Article 6 ECHR.
• Interpol CCF proceedings: Where Europol data fed into an Interpol Red Notice or Diffusion, an EDPS finding of unlawful processing strengthens the CCF argument that the underlying information is tainted and the notice should be deleted.
• Civil damages: Article 65 of Regulation (EU) 2016/794 establishes Europol’s liability for unlawful data processing. An EDPS decision confirms the legal basis for a civil compensation claim before the Court of Justice of the European Union (CJEU).
• National criminal proceedings: Where a criminal case in your country of origin relied on Europol intelligence, an EDPS finding can support applications to exclude that intelligence as unlawfully obtained evidence.

EDPS Complaint Timeline: What to Expect Step by Step

The EDPS complaint process follows a structured timeline, though individual cases vary based on complexity and Europol’s responsiveness. Understanding each stage helps you and your lawyers plan around concurrent legal proceedings.

• Preparation (1–4 weeks): Your lawyers gather supporting documents, obtain any available Europol access request results, and draft the formal complaint identifying specific RPPD violations.
• Filing: The complaint is submitted in writing to the EDPS with all supporting documentation. The EDPS acknowledges receipt and registers the case.
• Admissibility assessment (4–8 weeks): The EDPS reviews whether your complaint is admissible — confirming you exercised your access rights first and that the subject matter falls within Europol’s data processing activities.
• Investigation phase (3–9 months): The EDPS requests Europol’s response, reviews processing records, and may request further documentation from both sides. This phase can be shorter if Europol agrees to voluntary corrective measures.
• EDPS decision: A formal decision is issued either closing the case (if Europol remedies the violation), upholding the complaint with corrective orders, or rejecting the complaint with reasons.
• Appeals: Either party may challenge the EDPS decision before the CJEU, though this is relatively rare in straightforward processing-error cases.

Who Files EDPS Complaints: The Most Common Europol Data Cases

EDPS complaints against Europol arise across a range of scenarios. The most common situations our clients face include:

• Unlawful retention after criminal proceedings concluded: Europol continues to hold personal data long after a criminal case is dropped, acquitted, or statute-barred. Regulation (EU) 2016/794 imposes strict necessity and proportionality requirements; retaining data without active ongoing proceedings often cannot be justified.
• Data originating from politically motivated prosecutions: Where Europol received data from a Member State or third country that used criminal law as a political tool, the underlying processing is tainted from the outset and fails Europol’s lawfulness requirements.
• Incorrect or inaccurate personal data: Europol databases sometimes contain factual errors — wrong identifiers, confused identities, or outdated information — that your access request reveals. The EDPS can order immediate correction or deletion.
• Excessive sharing with third countries: Europol is restricted in transferring personal data to non-EU countries. Unlawful transfers to states with inadequate data protection standards give rise to both an EDPS complaint and, in some cases, CJEU proceedings.
• Access request refusals: Where Europol improperly refuses to confirm or deny holding your data, or provides an incomplete access response, the EDPS can investigate and order full disclosure.