EDPS flags serious privacy risks in EU Commission’s Europol data‑processing reforms
On 13 August 2026 the European Data Protection Supervisor warned that the Commission’s plan to expand Europol’s data‑processing powers creates serious privacy risks and could allow indefinite retention of data on people with no criminal links.
13 August 2026 – the European Data Protection Supervisor warned that the Commission’s plan to expand Europol’s data‑processing powers creates serious privacy risks and could allow indefinite retention of data on people with no criminal links.
EDPS opinion
The opinion, authored by EDPS head Wojciech Wiewiórowski, says the proposal “creates serious risks, particularly regarding the processing of the personal data of individuals with no established criminal links.”[Politico Europe]
Key changes to Europol’s data handling
The Commission’s June 2026 reform plan would relax the current requirement that data be sorted into distinct categories before Europol can use it. It would also permit the agency to retain data for an “extensive and unspecified period of time.”
| Aspect | Current regime | Proposed reform |
|---|---|---|
| Data categorisation before use | Required | Relaxed – categorisation not mandatory |
| Retention period | Limited by law, defined per category | Extensive, unspecified period |
| Scope of individuals covered | Only persons with established criminal links | Includes individuals with no criminal links |
| Source: European Data Protection Supervisor opinion, 13 August 2026 | ||
Implications and next steps
The EDPS warning adds pressure on EU institutions to tighten safeguards. If the European Parliament scrutinises the proposal in the coming weeks, the Commission may need to introduce stricter limits on data retention and re‑impose categorisation requirements.
Stakeholders argue that the reforms could boost cross‑border crime fighting, but the privacy concerns highlighted by the EDPS suggest a trade‑off that will shape the next round of EU policing legislation.
