EU privacy regulator warns that proposed expansion of Europol’s data retention powers risks creating mass surveillance of innocent individuals
Executive summary: The EDPS warned on August 13, 2026 that proposed EU reforms would allow Europol to retain data on large numbers of people without any criminal links, posing serious privacy risks. The change threatens to erode data protection safeguards in EU law enforcement, potentially enabling mass surveillance and setting a precedent for broader surveillance expansions.
Who is involved: European Data Protection Supervisor (EDPS), Europol, European Commission, EU member state justice and interior ministries.
Likely next: The EDPS opinion will feed into ongoing negotiations in the European Parliament and Council; amendments to strengthen safeguards are expected, though final adoption may face delays due to political divisions.
The European Data Protection Supervisor (EDPS) has issued a formal warning that legislative changes under consideration would permit Europol to retain personal data on individuals with no suspected ties to criminal activity. This marks a significant departure from current safeguards that limit data processing to those linked to investigations. The EDPS argues the shift undermines core GDPR principles of purpose limitation and data minimisation, potentially enabling function creep and erosion of civil liberties. While Europol frames the change as necessary for tackling cross-border crime, the watchdog stresses that any expansion must be accompanied by independent oversight, strict temporal limits, and transparent accountability mechanisms.
Timeline
- — Privacy watchdog warns of ‘serious risks’ over EU police agency surveillance (Politico Europe)
Analysis — what this means
Likely next events
- EDPS to submit formal opinion to EU legislators by September 15, 2026
- European Parliament LIBE committee to hold hearing on Europol data powers in October 2026
- EU Council to negotiate final text of Europol regulation revision by Q1 2027
Sectors affected
- Law enforcement technology
- Data privacy and cybersecurity compliance
- EU institutional reform
Regulatory implications
- EDPS recommends binding limits on data retention periods for non-suspects
- Call for mandatory prior authorization by national data protection authorities for bulk data processing
- Requirement for annual public transparency reports on Europol’s data holdings