Europol reform: the Commission proposes to extend the Agency’s powers without strengthening procedural safeguards

On 24 June 2026, the European Commission presented a proposal for a Regulation on the European Union Agency for Law Enforcement Cooperation (Europol)[1].

The text would repeal Regulation (EU) 2016/794 of 11 May 2016 (the “Europol Regulation”), which currently governs the Agency, and replace it with a new legal framework[2].

Europol is the European Union’s hub for law enforcement cooperation. It contributes to the pooling of information, expertise and investigations between Member States.

The Agency thus gives Member States access to a comprehensive picture of current threats[3].

The proposed new measures aim to strengthen the European Union’s response to evolving cross-border criminal threats[4]. The Commission observes in this respect that “The European Union (EU) is facing a profound transformation in its security environment, as serious and organised crime and terrorism grow more transnational, technologically advanced, and interconnected”[5].

The proposal is structured around several pillars: automated and faster information sharing, strengthened operational support to Member States, a technology and innovation hub, and enhanced cooperation with Union agencies and bodies and with third countries[6].

In particular, Article 32 of the proposal, entitled “Purposes of information processing activities”, which would replace the current Article 18 of the Europol Regulation, would considerably extend the Agency’s powers. The extension would operate at two levels: the purposes of processing, on the one hand; the data subjects and the categories of data that may be processed, on the other.

First, whereas cross-checking may currently concern only information relating to specific persons (suspects, convicted persons and persons regarding whom the competent authorities have reasonable grounds to believe that they will commit an offence)[7], Article 32 would cover information “related to a criminal offence”, without reference to any category of persons[8]. Cross-checking would no longer be linked to a suspected person, but to an offence.

Second, the Europol Regulation currently in force sets out, in its Annex II[9], an exhaustive list of the categories of personal data and categories of data subjects whose data may be collected and processed for each of the purposes provided for by the Regulation. The processing of data falling outside those categories remains the exception. Personal data outside Annex II may be processed only in strictly circumscribed cases[10]. Article 18a provides for such processing, in particular, “where necessary for the support of an ongoing specific criminal investigation within the scope of Europol’s objectives”, at the request of a Member State, the European Public Prosecutor’s Office or Eurojust, and where Europol cannot proceed otherwise.

Article 32 would reverse this logic. Europol could process data outside Annex II for all the purposes set out in paragraph 2 of that Article, provided that such processing is “relevant and necessary”[11] and “proportionate”. None of these criteria is defined. The text no longer makes such processing conditional either on a request from a national authority or on support for a specific investigation. In the absence of any definition, the assessment of what is “relevant”, “necessary” or “proportionate” would fall to the Agency itself. The processing of data outside Annex II, currently a strictly circumscribed derogation, would thus become the rule, very considerably widening the range of data that may be exploited by Europol.

The proposal is not devoid of safeguards. Data outside Annex II would have to be deleted as soon as the purpose of the processing has been achieved, kept separate from other data as far as possible and reported to the Data Protection Officer[12].

These safeguards nevertheless remain internal to the Agency. None of them confers on data subjects any new right, whether to be informed of the processing of their data or to challenge it, that would offset the proposed extension.

As currently drafted, Article 32 would enable Europol to exploit masses of data concerning persons who are not under any suspicion. The usefulness of such information would be established only a posteriori, once it has been exploited.

The Commission expressly acknowledges this, describing it as “a shift from the logic of the previous regime”, under which processing outside the categories was the exception[13]. It justifies this choice on the grounds that the relevance of certain data or their connection to criminal activities “may only emerge progressively during operational analysis”[14], or that data “initially not considered relevant” may, “upon further processing, acquire operational significance”[15].

As it stands, the proposal gives rise to concerns about numerous infringements of the fundamental rights of data subjects, in particular the right to respect for private life, the right to the protection of personal data and the presumption of innocence, guaranteed by Articles 7, 8 and 48 of the Charter of Fundamental Rights of the European Union.

The Commission’s proposal will be examined by the European Parliament and the Council under the ordinary legislative procedure, with a view to the Agency’s next mandate, scheduled to begin on 1 January 2028. It will be for them to lay down the procedural safeguards which such an extension of Europol’s powers calls for in order to protect the fundamental rights of data subjects.