EDPS complaint against Europol

Found data about you at Europol that shouldn’t be there? You can file a complaint with the European Data Protection Supervisor (EDPS) – but there’s a catch. You must first try Europol’s internal process through its Data Protection Function. After that fails or stalls, you have exactly two years from when you discovered the problem to lodge your complaint with the EDPS using their mandatory online form. Miss that deadline and your complaint disappears. Our legal team in Limassol and London has steered clients through EDPS proceedings and related litigation at the Court of Justice of the European Union across multiple EU member states.

EDPS complaint against Europol – a formal administrative complaint filed with the European Data Protection Supervisor alleging that Europol unlawfully processed an individual’s personal data in breach of Regulation (EU) 2016/794 (the Europol Regulation). The EDPS is the independent supervisory authority empowered to investigate and impose corrective measures on EU institutions including Europol.

Europol – the European Union Agency for Law Enforcement Cooperation, established under Regulation (EU) 2016/794, which processes vast quantities of personal data for cross-border law enforcement purposes. Europol stores data on criminal suspects, witnesses, victims and informants supplied by national police forces across member states and partner countries.

Key Takeaways

• The EDPS has brought pending legal proceedings against Europol before the Court of Justice regarding systematic data processing violations
• Front-Lex filed a public complaint in 2025 alleging Europol stored sensitive data on unregulated “shadow IT” systems
• Internal exhaustion first: you must complain to Europol’s Data Protection Function before the EDPS will even look at your case
• Your two-year clock starts the moment you became aware of the problem – not when Europol first violated your rights. Miss this deadline and you lose all rights
• Email complaints vanish into the void. Article 16 of the EDPS Rules of Procedure requires you to use their online form only

What is an EDPS Complaint Against Europol?

Two very different animals live under the word “complaint” here.

The EDPS itself can bring institutional legal proceedings against Europol when investigations reveal systemic abuse. Right now a pending case sits before the Court of Justice with the EDPS challenging specific aspects of how Europol implemented the revised Europol Regulation. This is the EDPS acting as cop, not you.

You, as an individual, file administrative complaints when Europol has mishandled your data. The violations that trigger this include storing sensitive biometric or political information without legal grounds, stonewalling your access requests, shipping information to non-EU countries without proper safeguards, or hoarding data years past the expiration date. In 2025, Front-Lex (a human rights non-profit) filed a complaint for three defenders, alleging Europol maintained rogue IT environments – so-called “shadow IT” – loaded with sensitive personal information far beyond any lawful scope.

Article 46 of Regulation (EU) 2016/794 gives the EDPS exclusive supervisory power over Europol: the authority can access all personal data, information and premises whenever reasonable grounds point to unlawful processing. National data protection authorities have zero jurisdiction over Europol’s own operations – this supervisory power belongs entirely to the EDPS.

When Can You File an EDPS Complaint Against Europol?

File when Europol has allegedly trampled your data protection rights under the Europol Regulation. Unlawful storage of your data. Refusal to show you what they hold. Failure to fix false information. Handing your data to countries outside the EU without safeguards. Keeping your information long past the legal expiration date. Any of these opens the door.

The two-year deadline in Article 16(4) of the EDPS Rules of Procedure runs from when you first became aware – not when Europol committed the violation. Say Europol denied your access request on 15 March 2024. Your deadline: 15 March 2026. Not a day later. This deadline cannot be extended, not even for good cause.

Still, the EDPS won’t touch your complaint until you’ve exhausted internal remedies. Europol’s Data Protection Function handles data subject requests and complaints. You submit your access request or grievance there first and either get an answer you don’t like, or get nothing within the statutory window. Only then has the EDPS grounds to investigate.

Article 36 of the Europol Regulation says that access requests submitted through a national authority must reach Europol within one month. Silence after that month passes means internal remedies are exhausted – you can now escalate to the EDPS.

How to File an EDPS Complaint Against Europol: Step-by-Step Process

Email and postal mail won’t work. The EDPS requires the official online complaint form, period. Article 16 of the EDPS Rules of Procedure makes this non-negotiable.

Step 1: Lodge an internal complaint with Europol’s Data Protection Function. Contact Europol via the channel on their website. State your request clearly and cite the legal basis: Article 36 for access, Article 39 for correction, Article 40 for deletion. Keep copies of everything.

Step 2: Wait for their response—or watch the clock run out. If they respond but it’s unhelpful, document why. If silence is their answer and the statutory period expires, you’ve exhausted remedies. Move forward.

Step 3: Build your evidence file. Gather all emails and letters with Europol, your original requests, their responses (or proof they didn’t respond), dates, specifics of what they processed illegally, and documentation showing the processing breaks the law. Weak evidence kills complaints fast.

Step 4: Fill out the EDPS online complaint form. Go to the EDPS website. Enter your details, describe what happened (with exact dates), explain which rights Europol violated, attach your documents, and confirm you exhausted internal remedies. Be precise – vague complaints get dismissed.

Step 5: Submit before the two-year deadline expires. The EDPS timestamp proves when your complaint arrived. Late means inadmissible. Full stop.

Step 6: The EDPS reviews your complaint for basic validity. They check: do they have jurisdiction? Did you exhaust remedies? Is there a real legal issue here? They may ask for more information. Answer fast.

Step 7: If they open an investigation, cooperate fully. The EDPS may contact you for additional evidence, inspect Europol’s servers, or demand internal documents. Your active participation strengthens everything.

This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organisation, or official authority.