Europol's deepening aversion to transparency

Buried deep in Europol’s most recent programming document lies a somewhat abstruse yet extraordinary admission of the agency’s aversion to external scrutiny.

“The agency is exposed to the risk of not accomplishing its mandate…resulting from new legislative and policy initiatives, as well as not meeting the demand from [member states]”, reads the over 200-page-long document setting out Europol’s priorities for the next three years. 

Among the main reasons listed is the “increase in the complexity and volume of demands from supervisory stakeholders,” which “reduces implementation pace and binds significant resources”.

The reference is to the annual “audit activities” by external oversight bodies like the European Court of Auditors and the EU’s chief privacy watchdog, the European Data Protection Supervisor (EDPS).

Another obstacle, writes The Hague-based agency, is the “increasing volume” of access to information and data subject requests from EU citizens, which “consume significant resources”. 

External scrutiny, Europol seems to be implying, is simply too burdensome, obstructing its ability to get on with the task of combating cross-border crime.

For the past four years, we have worked together to shed light on the role of an agency that sits at the core of the EU’s emerging surveillance apparatus.

Terabytes of sensitive personal data

We have reported on the EDPS’ repeated warnings that Europol’s harvesting of terabytes of information, including sensitive personal data of EU citizens and third-country nationals with no evident links to criminal activities, poses serious risks for fundamental rights and privacy.

Through our investigation into the proposed, and deeply controversial, regulation to fight children sexual abuse (CSAM) online, we revealed how Europol was seeking “unlimited” access to personal data.

Much of our work in probing the internal workings of an opaque EU agency like Europol relies on the EU’s access to documents procedure that allows citizens to request precious information and undisclosed files.

But, in our experience, Europol routinely obstructs access to key documents through procedural delays, heavy redactions, or blanket rejections on ‘public security’ grounds. 

In February, after the outgoing European Ombudsman, Emily O’Reilly, urged Europol to release a draft data protection impact assessment for an envisaged AI-powered classifier of children sexual abuse material, Europol simply disregarded the recommendation.

This is just one of seven complaints we have filed with the ombudsman due to Europol’s disregard for its transparency obligations.

Those range from email exchanges with the US-based foundation Thorn concerning CSAM to advice issued by its own, quasi-autonomous, Fundamental Rights Officer regarding Europol’s nascent artificial intelligence (AI) tools. Six of these complaints are still pending. 

We have also encountered more brazen attempts by Europol to pre-empt scrutiny.

In September 2024, one of our team members was barred from the annual Europol Data Expert Network (EDEN) conference. In December, we filed a series of questions to Europol’s press office regarding the agency’s rapidly expanding AI programme.

A month later, we learned that “after careful consideration”, Europol decided not to respond. The level of detail, Europol said, exceeded “the scope of a media enquiry” and did not meet “the broader needs of our European and global media audience”. 

It escapes us how Europol defines its audiences’ needs. But determining who has the right to ask questions seems to be part of how the agency conceives of its “media relations” — a relationship where detailed questions are met with an invitation to change jobs.

“We kindly ask you to consider whether this approach aligns more closely with advocacy than journalism,” ends Europol’s reply. 

Europol’s career advice aside, there may be another reason why the agency is not keen on close scrutiny.

This became apparent in the case of Europol’s screenings for conflicts of interest when its former employees take jobs in the private sector. During a rare EU Parliament hearing in 2023, provoked by our investigation, Jean-Philippe Lecouffe, the agency’s deputy director, dismissed our reporting as mere “assumptions”, telling MEPs you cannot ask staff “to open a pizzeria after leaving Europol”.

Europol’s conduct, he argued, was solid and realistic. Yet, the European Ombudsman’s inquiry, concluded in February, uncovered serious flaws in the screenings and an admission from Europol that it needs to revise its existing processes.

Surveillance and secrecy  

We do not question the idea that some information held by Europol may be too sensitive for public disclosure. But we are alarmed by Europol arrogating to itself the right to develop surveillance tools, which are likely to dramatically transform the landscape of policing across the EU, in almost complete secrecy.

Indeed, it is not only journalists who struggle to access essential information about Europol’s activities. Even members of the Europol Joint Parliamentary Scrutiny Group — an oversight body that brings together MEPs and national parliamentarians — have complained to us about being kept in the dark.

Yet, despite this opacity, political support for Europol is growing in Brussels and EU capitals.

"We are going to make Europol a truly operational police agency," European Commission executive vice president Henna Virkkunen said in April, when unveiling latest plans to revamp Europol — with more funds, more personnel, more powers to collect personal data, and closer collaboration with national police and other EU agencies like Frontex and Eurojust.

Under the guise of combating smuggling, a 2023 proposal to expand Europol’s operational foothold in the migration domain is being pushed through Brussels’ corridors, with a key vote taking place at the European Parliament’s civil liberties committee this week.

Meanwhile, Europol’s director, Catherine de Bolle, has been spearheading contentious efforts for law enforcement agencies to gain access to encrypted communication. 

In democracies, more powers granted to law enforcement bodies, whose day-to-day activities impinge upon the rights and freedoms of ordinary citizens, should be matched by more transparency and oversight.

Our recent experience suggests the very opposite, however. As its mandate extends, Europol’s aversion to transparency and its evasion of uncomfortable questions should be of concern to all.

This year, we turn 25 and are looking for 2,500 new supporting members to take their stake in EU democracy. A functioning EU relies on a well-informed public – you.