Europol frequently invokes Article 36(6) restrictions, claiming disclosure would harm ongoing investigations or national security. However, these exemptions are not absolute. The EDPS scrutinises whether the restriction is proportionate and time-limited. If Europol applies blanket refusals without case-specific justification, the EDPS can find the restriction unlawful. Importantly, even where access is legitimately restricted, the EDPS can still verify data accuracy and lawfulness through confidential review — meaning your rights are protected even when you cannot personally see the underlying data.

Most EDPS investigations conclude within 12 to 18 months, though complex cases involving multiple data sources or third-country transfers may extend to 24 months. The EDPS typically acknowledges complaints within one month and requests Europol’s response within two to three months. Delays often occur when Europol claims it must consult contributing Member States before responding. Requesting interim measures — such as suspension of data transfers — can accelerate review of urgent cases, particularly where ongoing harm such as asset freezing or travel bans is documented.

Yes, Europol is notified and invited to respond to your complaint. This is a formal administrative process, not anonymous. However, filing a complaint cannot lawfully prejudice your position — the EDPS monitors for any retaliatory data processing. In practice, filing often prompts Europol to review its files more carefully, occasionally resulting in voluntary corrections before the EDPS issues a decision. If you are concerned about sensitive ongoing proceedings, the timing and framing of the complaint can be strategically managed to minimise any perceived adverse signalling.

An EDPS finding that Europol processed your data unlawfully creates persuasive — sometimes binding — authority in national proceedings. Courts in EU Member States must consider whether evidence derived from unlawfully processed Europol data should be excluded or given reduced weight. In extradition and mutual legal assistance cases, an EDPS decision documenting data protection violations can support arguments that cooperation should be refused on human rights grounds. The decision also establishes an official record that can be cited in civil claims for damages under EU law.

Data received from countries lacking adequate human rights protections — such as Russia, Turkey, or certain Gulf states — raises specific concerns under Europol’s international cooperation framework. Europol must verify that incoming data meets EU standards before processing it. If data was obtained through torture, politically motivated prosecution, or without judicial oversight, it may be inherently unlawful to retain. The EDPS can order deletion where Europol failed to conduct proper source assessments. This argument is particularly strong when the originating country has documented patterns of abusing international law enforcement channels.