The European Commission is proposing to give Europol, the EU's law enforcement agency, sweeping new powers to collect personal data and deploy artificial intelligence systems with fewer legal safeguards than currently required. Under a regulation proposed in June 2026, Europol would be able to search for and store data on people not linked to any investigation, bypass procedural protections, and access experimental AI tools with exemptions from transparency requirements.

What's Changing in Europol's Data Powers?

Currently, Europol can only store limited personal data in its operational system when it relates to specific categories like suspects or victims, and only in connection with existing investigations. The new proposal would fundamentally alter this approach by allowing Europol to engage in what regulators call "fishing for data." This means the agency could collect large datasets and filter them afterward to decide what is relevant, rather than collecting only data it already knows is pertinent to a case.

The Commission describes these current safeguards as "administrative burdens" that slow down the agency's work. However, the European Data Protection Supervisor, Europol's own oversight authority, has raised alarms about this approach. In May 2026, former Europol officials revealed that the agency has been running "shadow systems" for years, parallel databases that sit outside the agency's main computer systems and allow it to avoid data protection and IT design requirements altogether.

The Commission

How Would AI Be Deployed in European Policing?

The proposal includes plans to expand Europol's use of artificial intelligence systems in law enforcement operations. Europol has already obtained exemptions from the EU AI Act's monitoring, oversight, and transparency requirements when deploying high-risk AI systems. According to a recent advisory opinion from the European Data Protection Supervisor, Europol currently uses automated "scripts" to select and process data from the internet for investigations, but the agency only logs modifications made by these automated systems "to the extent it is possible," meaning some automated processing goes entirely untracked and unexplained.

This lack of transparency contradicts a 2019 ruling by the Court of Justice of the European Union, which requires that automation be explainable and identifiable when it modifies information related to criminal investigations. The Commission's push to expand these practices suggests that Europol's AI systems will continue operating with minimal oversight.

Steps to Understand the Regulatory Landscape

• Deregulation Packages: Since late 2024, European Commission President Ursula von der Leyen has launched several legislative "simplification" packages designed to weaken minimum standards across social, digital, and environmental legislation, including the AI omnibus adopted in June 2026 and the digital omnibus proposed in November 2025.
• Europol's New Role: The proposal would transform Europol from a facilitator of cooperation between police authorities into what von der Leyen envisions as a "truly operational police agency" with its own investigative powers and access to massive datasets without traditional restrictions.
• Private Sector Integration: Europol would become a central "hub" for private companies to share information and receive funding for developing digital policing tools, including technology for subverting encryption and scaling up automated profiling systems.
• Funding Expansion: The agency would gain access to major research funding mechanisms like Horizon Europe, which has a budget of 175 billion euros for 2028 to 2034, allowing it to finance and participate in research projects for new digital technologies.

What Are the Concerns About This Expansion?

Privacy advocates and civil society organizations worry that the proposal represents a dangerous erosion of protections against discriminatory and invasive surveillance. The strategic litigation NGO Front-LEX has filed an ongoing complaint asking the European Data Protection Supervisor to ban Europol's "shadow systems" entirely, arguing they violate fundamental data protection principles.

The timing of this push is significant. For years, law enforcement agencies have justified demanding access to personal data on security grounds. Now, as organizations worldwide rush to obtain data for training artificial intelligence systems, the Commission is using "modernized law enforcement" as the new justification for turning over massive amounts of personal information to police authorities.

The proposal also includes plans to build a cloud infrastructure and "Police Shared Data Space" that would allow member states, Europol, and partner organizations to work directly on the same operational data from their own systems. This would eliminate the current requirement for member states to dispatch officers to Europol's headquarters in The Hague to access data. Instead, law enforcement authorities across Europe would upload any data relating to crimes within Europol's scope of competence directly to this shared cloud system.

The European Commission argues that these changes are necessary to keep pace with technological change and make Europol the EU's leader in AI-driven policing. However, critics contend that the proposal prioritizes speed and technological capability over fundamental rights protections, creating a system where artificial intelligence can process vast amounts of personal data with minimal human oversight or transparency.