Expanded Europol Powers Must Not Come at the Expense of Robust EU Data Protection and Legal Safeguards – The latest warning from the European Data Protection Supervisor lands in a familiar but increasingly important policy space: how far should law enforcement powers expand when data systems grow more complex and more intrusive? In its new opinion on the European Commission’s proposed Europol regulation, the EDPS supports stronger security cooperation in principle, but argues that broader powers must come with equally strong legal safeguards, oversight, and limits on personal data processing.
What the EDPS is warning about
The EDPS is responding to a European Commission proposal that would replace the current Europol Regulation and strengthen Europol’s role as an information hub, operational hub, and technology and innovation hub.
That may sound administrative, but the privacy consequences are substantial. According to the EDPS, the proposal would expand Europol’s tasks and data-processing capabilities, increasing both the volume of personal data processed and the complexity of how that data is handled.
The sharpest warning concerns people with no established links to criminal investigations or proceedings. EDPS Supervisor Wojciech Wiewiórowski said:
“Modern security threats demand sophisticated responses, but we cannot sacrifice fundamental rights in pursuit of security.”
He added that the proposal creates “serious risks” regarding the processing of personal data belonging to individuals with no established criminal links.
Why this matters beyond Brussels
This is not only a technical EU governance issue. It goes to the centre of how democratic systems justify surveillance, intelligence-sharing, and law enforcement data use.
More power usually means more data
If Europol becomes a stronger coordination and technology body, it will almost certainly process:
* more personal data
* more sensitive categories of data
* more cross-border information
* more data involving people not accused of any crime
That does not automatically make the proposal wrong. But it does increase the burden on legislators to ensure legal clarity, narrow purpose limits, and real accountability.
Vague powers create predictable problems
The EDPS is especially concerned about how Europol would decide whether it is “relevant and necessary” to process the personal data of individuals with no established connection to criminal activity.
That phrase matters. If the threshold is vague, the power can expand in practice far beyond what lawmakers may intend on paper.
The EDPS says the proposal in its current form fails to provide sufficient safeguards and effective oversight mechanisms. That is not a drafting quibble. It is a warning that powers may outpace protections.
The core safeguards the EDPS wants
The EDPS is not arguing against law enforcement cooperation as such. In fact, it explicitly recognises that Member States face increasingly sophisticated cross-border crime and internal security threats.
Its position is narrower and more important: if Europol’s powers expand, the legal framework must remain precise, foreseeable, and enforceable.
The EDPS recommends stronger safeguards around:
* purpose limitation
* storage limitation
* legal certainty on when data processing is allowed
* effective oversight and enforcement
* supervision of processing activities
* cooperation with national supervisory authorities
* security of Europol services and tools
In plain terms, the message is that security policy cannot rely on broad trust alone. It needs hard rules, narrow boundaries, and visible supervision.
