Luxembourg backs a data-driven Europol as privacy test moves to EU lawmakers

LUXEMBOURG — Luxembourg is pressing the European Union to make Europol better at connecting information held in separate national investigations, placing the small borderless state behind one of the most consequential expansions of European police-data cooperation in years.

The public record shows a focused position rather than a Luxembourg-authored technical blueprint. At a Justice and Home Affairs Council on 5 March, Home Affairs Minister Léon Gloden called for a robust, “data-driven” Europol with the analytical capacity to process large volumes of information and identify links between cases. Agence Europe independently reported that Gloden said “organised crime is a common problem” requiring a joint response.

That position now intersects with a much more detailed European Commission proposal, published on 24 June, to replace the current Europol regulation. Luxembourg supports the direction of travel, but the Commission drafted the legislation and Parliament and the Council must still approve it.

What Luxembourg actually asked for

Luxembourg’s stated priorities were stronger analytical capacity, more effective data exchange for national investigations and clearer institutional roles. Gloden argued that Europol should remain the EU body responsible for police cooperation, while Frontex should concentrate on protecting the external border. The Luxembourg government also presented a stronger Europol as an alternative to cumbersome controls at internal Schengen borders.

The Commission proposal translates the broader European demand for fewer information gaps into specific systems. It would make Europol a central information and analysis hub, create a shared digital workspace for cross-border cases and strengthen national Europol units as the principal interface between the agency and domestic authorities.

At an informal ministerial meeting in Dublin on 16 July, attended by Gloden, ministers also backed greater cooperation with trusted third countries and private-sector partners. The Irish presidency’s account described political convergence, not an adopted law or a detailed Luxembourg proposal.

No Member State can effectively confront these threats alone.

Irish minister Jim O’Callaghan, who chaired the meeting, said public-private partnerships could help investigators exchange strategic and operational information and prevent criminal networks from using legitimate businesses to conceal activity or launder proceeds.

What access would look like — and its limits

The Commission’s draft would not simply merge every national police database. It proposes several controlled channels serving different purposes:

• A Europol cross-checking service would identify links among people, objects, criminal activity and investigations. Member states would have to upload qualifying data systematically and without undue delay when it concerns crimes within Europol’s mandate and is relevant to cross-border cooperation.
• A European Police Shared Data Space would allow authorised national authorities and Europol to open Joint Operational Analysis Cases, jointly analyse evidence and communicate in a secure workspace.
• A sovereign Europol cloud and an EU Police Digital Identity would provide authenticated access, while SIENA would continue to carry bilateral and multilateral exchanges.
• Access would be differentiated by role and operational need, rather than giving every investigator unrestricted visibility over all material.

The draft couples those powers with purpose limitation, necessity and proportionality tests, data compartmentalisation, access logs and audit trails. It also preserves independent supervision by the European Data Protection Supervisor and provides for a Data Protection Officer, a Fundamental Rights Officer and impact assessments for high-risk processing. The European Parliament’s legislative tracker records lawmakers’ calls to preserve strong data-protection safeguards and reinforce democratic oversight.

For third-country exchanges, the proposed regulation would retain the requirements of the EU data-protection regime. Europol would have to record transfers and their legal grounds; recipients generally could not pass personal data onwards without prior explicit authorisation; and Europol could not process information clearly obtained through an obvious violation of human rights. The Dublin outcome did not publish the criteria ministers discussed for designating a country as a trusted partner, leaving an important safeguard unresolved at political level.

Not an EU FBI, and not yet law

The proposal would materially change Europol’s legal mandate if adopted: it would repeal and replace Regulation 2016/794, expand automated data exchange and give investigators shared analytical infrastructure. But it would not turn Europol into a federal police force with a general power to arrest people or replace national investigators.

Commissioner Magnus Brunner put the political boundary bluntly: “We don’t want Europol to become a European FBI.” The Commission instead describes an agency that supplies information, technology and operational support while member states retain primary responsibility for investigations and coercive police powers.

Nor did the Dublin meeting itself change the law. It was an informal presidency meeting intended to test political positions. The formal Europol proposal is now before Parliament and the Council, where its data-access rules, oversight and third-country provisions can be amended.

Judicial cooperation follows a separate track

Police cooperation is only one part of the June package. The Commission separately proposed a new Eurojust regulation and an update to the European Investigation Order, the procedure used by judicial authorities to obtain evidence in another member state. Those files are intended to improve coordination from investigation through prosecution, but they are distinct legislative proposals.

Luxembourg’s initiative therefore does not by itself change how prosecutors request evidence, how courts authorise investigative measures or how Eurojust coordinates cases. Its immediate significance is political: Luxembourg has endorsed stronger European capacity to find connections hidden across national systems. Whether that can be done without weakening privacy and due process will be decided in the safeguards written into the final EU laws.