EDPS Complaint Against Europol

The European Data Protection Supervisor (EDPS) is an independent supervisory authority responsible for ensuring that EU institutions, bodies, offices, and agencies — including Europol — comply with data protection obligations. The EDPS has the power to investigate complaints, conduct inquiries, impose corrective measures, and order institutions to bring their data processing activities into compliance.

For Europol specifically, the EDPS’s supervisory role is defined in Article 43 of EU Regulation 2016/794. The EDPS can order Europol to delete or correct data, restrict the use of data, notify affected parties, and impose administrative sanctions. EDPS decisions are binding on Europol.

Filing a complaint with the EDPS is free of charge and does not require legal representation — however, specialist legal assistance significantly increases the probability of a favourable outcome, particularly where complex legal arguments about the basis for Europol data processing are involved.

You may file an EDPS complaint if:

• Europol has failed to respond to your access request within three months
• Europol has refused to provide access to data without adequate legal justification
• Europol has refused to delete or correct data you believe is inaccurate or unlawfully processed
• Europol has shared your data with third countries or private entities without adequate legal basis
• Europol has processed your data for a purpose other than that for which it was collected
• Europol has retained your data beyond the permitted retention period
• You have reason to believe Europol is processing your data in violation of its own rules or EU law

An EDPS complaint must be submitted in writing to the EDPS, setting out the facts of the complaint, the nature of the alleged violation, and the remedy sought. The complaint must be accompanied by relevant supporting documentation, including any correspondence with Europol and evidence of the data processing at issue.

The EDPS will first assess whether the complaint is admissible — i.e., whether it falls within the EDPS’s jurisdiction and whether the complainant has standing to bring the complaint. Once accepted, the EDPS investigates by requesting information from Europol and reviewing Europol’s files. This process typically takes six to twelve months.

At the conclusion of its investigation, the EDPS issues a formal decision. If it finds that Europol has violated the complainant’s data rights, it can order Europol to take specific corrective action — including deletion of data, restriction of processing, or notification of affected parties.

An EDPS decision favourable to the complainant is legally binding on Europol. Europol must comply with the EDPS’s instructions within the timeframe specified. Importantly, the EDPS decision can also require Europol to notify all parties to whom the disputed data was transmitted — including EU member states and third-country partners — and to instruct them to take corresponding action.

If Europol fails to comply with an EDPS decision, the EDPS can bring enforcement proceedings. In addition, the complainant retains the right to bring an action before the Court of Justice of the EU to enforce their rights judicially.

Our lawyers have experience preparing EDPS complaints and representing clients throughout the investigation process. We ensure that complaints are procedurally correct, legally well-argued, and supported by appropriate evidence — maximising the probability of a favourable EDPS decision.

The EDPS complaint and CJEU judicial proceedings are not mutually exclusive — they can be pursued in parallel or sequentially, depending on the circumstances. In urgent cases, where data processing is causing immediate and concrete harm, judicial proceedings may be initiated without exhausting EDPS remedies first.

Our lawyers advise on the optimal strategy for each case, taking into account the urgency of the situation, the strength of the legal arguments, and the most efficient path to the desired outcome. In some cases, a well-drafted EDPS complaint resolves the matter without any need for litigation. In others, the EDPS process is used to build the evidentiary record for subsequent court proceedings.