Europol: Surveillance powers significantly expanded

Last Tuesday, an EU regulation came into force that allows Europol to evaluate the data of non-suspects on a large scale. In fact, a legalization – also of past mass surveillance – is taking place in this way.

Processing of personal data is made easier

The core of the new regulation is the significant expansion of Europol’s powers regarding the handling of personal data. Thus, the EU authority may henceforth process “personal data without the categorization of the data subject” if this appears necessary in the context of an investigation. In concrete terms, this means that the authority is no longer limited to the data of suspects when evaluating data. What is supposed to make police work easier also means a massive intrusion into the privacy of countless private individuals: Their data could be analyzed and used by Europol if it should happen to end up there.

This is not unlikely: The regulation also allows Europol to record, store and analyze data from large companies such as Facebook or Google, from banks and from airlines. This authority also explicitly applies to data from third countries, provided that data protection regulations exist in these countries.

Overall, the new regulation massively undermines the protection of personal data and the privacy of private individuals. Where previously only suspects in investigative proceedings had to fear encroachments on their data autonomy, this now applies to virtually all people in the EU as well as in various third countries.

Transitional regulation legalizes past data exploitation

A transitional arrangement indicates that Europol has already done this in practice in the past: EU member states, the EU prosecutor’s office and the EU judicial authority Eurojust can declare that the regulation can also be applied to older data files. This, in turn, was cause for criticism: unlawful data collections and processing from the past could be summarily legalized with the new regulation – and the corresponding data files could thus continue to be evaluated and stored.

The EU Data Protection Supervisor Wojciech Wiewiórowski pointed out as early as 2020 that Europol employees were clearly exceeding their competences and powers with mass data collection and evaluation. He also drew attention to the fact that victims and witnesses of crime, for example, were thus at risk of being “unlawfully associated with criminal activity throughout the EU.” This from Wiewiórowski is now legal – even retroactively.

Data protection commissioner has doubts about legality

Regarding the retroactive legalization, Wiewiórowski has also expressed doubts about its legality. Furthermore, Wiewiórowski sees his position as EU data protection commissioner undermined: Only at the beginning of the current year, he had ordered Europol to delete data collected from unsuspected persons within six months and not to process it further. This order has now lapsed. His control options with regard to Europol have thus shrunk enormously. Wiewiórowski also sees the new regulation as a restriction of fundamental rights. The problems mentioned had already been discussed when the regulation, which has now come into force, was presented. Meanwhile, the criticism of the new regulation joins other accusations against Europol. For example, in the context of the hack of Enchrochats, it was discussed to what extent the EU authority violated the principles of the rule of law with its actions.

Further developments, at least with regard to the retroactive legalization of illegally stored and analyzed data, remain to be seen.