EU data protection watchdog raises concerns over expanded Europol powers

The European Data Protection Supervisor has warned that expanded Europol powers could weaken privacy and fundamental rights. The watchdog says lawmakers need to add stronger safeguards before giving the agency broader authority to collect and process personal data.

Commission wants to strengthen Europol’s role

The European Commission presented its proposed Europol regulation on 24 June 2026.

The plan aims to help Europol fight cross-border crime and internal security threats across EU member states. It would further establish the agency as a central hub for law enforcement information, operations and innovation.

Supporters say criminal groups increasingly operate across borders and use digital tools to avoid detection. They argue that Europol needs stronger capabilities to help national authorities coordinate investigations and respond faster.

The Commission also proposed doubling Europol’s budget to €3 billion between 2028 and 2034. However, EU institutions must still approve both the budget and the wider legal changes.

EDPS raises privacy concerns

The European Data Protection Supervisor, or EDPS, accepts that law enforcement needs effective tools to address modern threats. However, it says expanded Europol powers must not come at the expense of data protection and fundamental rights.

According to the EDPS, the proposal could allow Europol to collect and process more personal information. This could include data belonging to people with no established connection to a criminal investigation or legal proceeding.

The watchdog also warned that the current draft does not set sufficient limits on data retention. It said Europol should not be able to keep information about people without proven criminal links indefinitely.

These concerns appear in the EDPS’s Opinion 18/2026 on the Commission’s proposal.

Stronger safeguards are needed

The EDPS says the proposed framework needs clear and enforceable safeguards before lawmakers approve it.

Those measures should include effective independent oversight, meaningful enforcement mechanisms and strict limits on how Europol processes personal data. They should also ensure that the agency complies with EU data protection rules when handling information from member states and other sources.

The regulator stressed that security measures must remain proportionate. Law enforcement agencies may need advanced technology to investigate serious threats, but those capabilities require limits that protect people who are not linked to criminal activity.

The debate over expanded Europol powers reflects a wider challenge for the EU. Policymakers must balance public security, technological development and citizens’ privacy rights.

Parliament and Council will decide

The European Parliament and the Council of the European Union must approve the Commission’s proposal before the changes can take effect.

If adopted, the new rules could give Europol more staff, funding and technological resources. The agency could take a larger role in helping member states investigate digital crime and other transnational threats.

However, the EDPS has made clear that the proposal needs changes. Lawmakers will need to decide whether the final framework gives Europol stronger operational tools while maintaining meaningful protections for personal data.