Investigative organization Europol must now delete data of individuals not linked to criminal activity after six months. The European Data Protection Supervisor (EDPS) decided, according to a statement published on Monday.
EDPS was investigating Europol's processing of large data sets (1). The regulator launched that investigation in 2019 on its own initiative, due to concerns about the large amounts of data Europol was processing.
Europol assists European Union member states in the fight against serious crime and therefore receives a lot of data from European police forces. According to the Europol Regulation temporarily in order to distinguish between data of suspected and non-suspected persons (2). The service may then retain data on suspects, but must delete data on non-suspects within six months. Until now, the service also kept data from non-suspects for longer than six months. This is therefore against the rules, the EDPS concludes.
According to British newspaper The Guardian Europol's database comprises at least four petabytes . Much of that involves data on non-suspects and so the international police organization must now delete it. The organization has one year to do so (3).
Back in 2020, the EDPS also slammed Europol for unnecessary data storage. The partnership took some measures then, but not enough according to the EDPS.
(1) EDPS orders Europol to erase data concerning individuals with no established link to a criminal activity - EDPS (https://edps.europa.eu/press-publications/press-news/press-releases/2022/edps-orders-europol-erase-data-concerning_en)
(2) Supervision of Europol - EDPS (https://edps.europa.eu/data-protection/our-role-supervisor/supervision-europol_en)
(3) A data 'black hole': Europol ordered to delete vast store of personal data - The Guardian (https://www.theguardian.com/world/2022/jan/10/a-data-black-hole-europol-ordered-to-delete-vast-store-of-personal-data)
