Europol Data Deletion Request

You may file a data deletion request with Europol if your personal data is unlawfully processed, no longer required for the purpose it was collected, or the storage period has expired. The request must be submitted in English or French to Europol’s Data Protection Function, which must respond within three months. Independent legal teams specialising in EU data protection and law enforcement cooperation can prepare and submit the request on your behalf, ensuring all grounds are documented and procedural requirements met. Our offices in Limassol and London have handled data-subject access and erasure requests across European Union member states since the entry into force of Regulation (EU) 2016/794.

Europol is the European Union Agency for Law Enforcement Cooperation, established by Regulation (EU) 2016/794 to support and strengthen action by the competent authorities of the member states and their mutual cooperation in preventing and combating serious crime affecting two or more member states, terrorism and forms of crime which affect a common interest covered by a Union policy.

Key Takeaways

• Europol must acknowledge receipt of a deletion request and reply within three months of receipt.
• The request must be written in English or French and submitted to [email protected] with the subject line "Data Subject Access Request".
• If Europol refuses deletion or fails to reply within three months, you have three months to lodge a binding complaint with the European Data Protection Supervisor (EDPS) — miss this window and your right to challenge the decision expires.
• A valid identity document (passport or national ID), a detailed description of the data to be deleted, and the legal grounds for erasure are mandatory.
• Recent enforcement: the EDPS ordered Europol to delete information related to individuals with no proven link to crime, confirming the agency’s obligation to erase data not meeting strict legal thresholds.

Understanding Europol and Your Data Rights

Europol is the European Union Agency for Law Enforcement Cooperation. Distinct from Interpol (the International Criminal Police Organization), it facilitates criminal intelligence exchange between EU member states, processes large-scale datasets, and supports cross-border investigations. Europol holds personal data on individuals suspected of involvement in serious crime, terrorism, and organised criminal networks. Crucially, it is not a law enforcement body with powers of arrest or prosecution—it acts as an information hub.

Individuals whose data Europol holds enjoy rights under Regulation (EU) 2016/794 and the Charter of Fundamental Rights of the European Union. You can access, rectify, and erase your personal data. Yet these rights face specific limitations set out in the Europol Regulation, reflecting the agency’s operational mandate and the need to protect ongoing investigations.

Europol’s processing is supervised by the European Data Protection Supervisor (EDPS), an independent body that investigates complaints, conducts audits, and issues binding decisions requiring Europol to delete or correct data. In recent years the EDPS has ordered Europol to delete information relating to individuals with no proven link to crime, signalling stricter enforcement of data minimisation principles in law enforcement contexts.

What Data Does Europol Hold and When Can It Be Deleted?

Europol processes two categories: operational data (information on suspects, convictions, crime patterns, and criminal networks) and administrative data (contact details of national liaison officers, case references, and metadata). Operational data originates from EU member states’ National Units, third countries under international agreements, and open-source intelligence. The agency does not collect data directly from individuals or conduct its own field investigations.

Deletion is legally justified when:

• Data is factually inaccurate or unlawfully processed. Examples: data entered in breach of the purpose limitation principle, or without proper authorisation from a National Unit. If Europol cannot verify the accuracy, it must delete.
• Data is no longer required for its original purpose. An investigation concludes, charges are dropped, or you are acquitted. Europol won’t know unless you tell it—deletion is not automatic.
• Storage period has expired. Europol must periodically review all personal data and delete it if retention lacks operational justification or legal obligation. But Europol often extends retention indefinitely without explicit justification, making challenge through deletion requests or EDPS complaints necessary.

Europol does not automatically delete data following an acquittal or case closure. You or your legal representative must submit a formal erasure request with supporting evidence: court judgments, prosecutor decisions, or documentation proving the investigation no longer involves you.

Deletion Ground	Example Evidence	Typical Europol Response Time
Factually inaccurate data	Court judgment, identity verification document showing mistaken identity	3 months (maximum statutory deadline)
No longer required (case closed)	Final acquittal judgment, prosecutor’s decision to close investigation, confirmation from National Unit	3 months
Unlawfully processed	Evidence that data was entered without proper authorisation, breach of purpose limitation	3 months
Storage period expired	Request for review showing no operational justification for continued retention	3 months (may require EDPS complaint if Europol refuses)

Under Regulation (EU) 2016/794, Europol must delete personal data that is no longer necessary for the purpose for which it was collected, and the EDPS has the power to order deletion where the agency’s own review process fails to comply.

This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organisation, or official authority.