EDPS Complaint Against Europol
The European Data Protection Supervisor has independent authority over Europol's data processing. We file EDPS complaints to challenge unlawful data retention, access refusals, and privacy violations.
📋 On This Page
The European Data Protection Supervisor (EDPS)
The EDPS is the independent supervisory authority responsible for monitoring Europol’s compliance with data protection law under Regulation (EU) 2018/1725. The EDPS has powers to investigate complaints, access Europol’s files, issue binding decisions, and refer cases to the CJEU. Filing an EDPS complaint is the primary route to challenge Europol’s data processing decisions.
When to File an EDPS Complaint
An EDPS complaint is appropriate where:
- Europol has refused or restricted a data access request without adequate justification
- Europol has refused to correct or delete inaccurate or unlawfully processed data
- Europol has shared data with third countries or organisations in violation of its rules
- Europol has retained data beyond applicable retention periods
- There are reasonable grounds to believe Europol is processing data in violation of fundamental rights
The EDPS Complaint Process
An EDPS complaint must be filed in writing, setting out the facts, the relief requested, and evidence of a prior request to Europol. The EDPS conducts a preliminary review and, if the complaint is admissible, investigates with powers to access Europol’s systems. The EDPS issues a decision that is binding on Europol.
We prepare all EDPS complaint documentation, liaise with the EDPS during the investigation, and advise on next steps following the EDPS decision.
The EDPS — Europol’s Independent Data Watchdog
The European Data Protection Supervisor (EDPS) is the EU’s independent data protection supervisory authority for EU institutions and bodies, including Europol. The EDPS was established under Regulation (EU) 2018/1725 on data protection for EU institutions. With respect to Europol specifically, the EDPS acts as the supervisory authority under Article 43 of the Europol Regulation, with powers to investigate, audit, and order remedial action against Europol for data protection violations.
The EDPS is based in Brussels and exercises its supervisory mandate independently of the European Commission, the EU Council, and EU member states. Its decisions carry significant legal weight — Europol is legally bound to comply with EDPS orders, and failure to do so can be referred to the CJEU. The EDPS has used its powers to order Europol to delete specific categories of data, to impose data retention limits, and to require enhanced data quality controls.
When to File an EDPS Complaint
An EDPS complaint is appropriate in the following circumstances: Europol has refused a data access request without adequate legal justification; Europol has failed to respond to a data access or deletion request within the required 3-month period; Europol has refused to delete data that meets the criteria for deletion under the Europol Regulation; Europol has shared data with third countries in a manner that violates the applicable legal framework; or Europol’s data processing has caused concrete harm — including border detentions, banking restrictions, or visa refusals — and Europol’s response has been inadequate.
The EDPS complaint procedure is distinct from an appeal against a Europol decision. A complaint is a request to the EDPS to exercise its supervisory powers — essentially an invitation to the regulator to investigate and order Europol to act. The EDPS investigates complaints and must provide a response within 6 months (with possible extension).
Coordinating EDPS Proceedings with Other Legal Challenges
In most Europol data cases, the EDPS complaint is one element of a broader legal strategy that also includes: the initial Europol data access and deletion request; national data protection authority challenges in member states that shared data with Europol; potential CJEU proceedings if the EDPS process does not produce a satisfactory outcome; and parallel challenges to related records in Interpol, national police databases, and financial screening databases. We manage all of these tracks as a coordinated strategy, ensuring that actions in one forum strengthen the position in others. For further reading, see our guide on full Europol defence services hub.
Frequently Asked Questions
A Europol data request (access or deletion) is made directly to Europol’s Data Protection Function — it is a request to Europol itself. An EDPS complaint is made to the independent supervisory authority that oversees Europol — it is a complaint about Europol’s conduct and an invitation to the regulator to investigate and order remedial action. The EDPS complaint is typically the next step after an unsatisfactory Europol response to a data request.
The EDPS typically acknowledges a complaint within a few weeks and provides a substantive response within 6 months. In complex cases or where Europol requires more time to respond to EDPS enquiries, the timeline may extend. The EDPS may also request additional information from the complainant during the investigation. EDPS decisions are published (in redacted form) and contribute to the developing body of Europol data protection law.
Yes. The EDPS has the power to order Europol to delete, correct, or restrict processing of personal data that was processed in violation of applicable data protection rules. Europol is legally required to comply with EDPS orders. If Europol fails to comply, the matter can be referred to the CJEU. In practice, Europol generally complies with EDPS orders, though sometimes after delay or negotiation over the scope of the required action.
The EDPS handles complaints with appropriate confidentiality. The complainant’s identity and specific data are protected. EDPS decisions are published but typically in redacted form that does not identify individual complainants or the specific data at issue. The EDPS is bound by its own data protection obligations and does not share complainant information with Europol or member states beyond what is necessary to investigate the complaint.
Generally, the EDPS complaint process should be exhausted before pursuing CJEU annulment proceedings in relation to Europol data processing. This is not an absolute jurisdictional requirement, but the CJEU generally expects complainants to have first pursued available administrative remedies. However, there is no requirement to wait for EDPS proceedings to conclude before initiating other legal challenges — such as national data protection authority complaints or challenges to related Interpol or national database records.
