Europol gears up to collect big data on European citizens after MEPs vote to expand policing power
The European Parliament has voted to give Europol wide powers to collect and process data on individuals, including people not suspected of any crime, in a move that significantly widens the power of the European police agency.
MEPs voted on 4 May to widen the mandate of Europol to collect personal data from tech companies, including telecoms and internet suppliers and social media firms, and to collect and analyse data from countries outside the European Union (EU).
The proposals also give Europol the go-ahead to develop algorithms and artificial intelligence (AI) systems capable of making automated decisions and developing predictive policing models.
The Parliament’s draft regulation effectively overturns an order by the European Data Protection Supervisor (EDPS) in January 2020 that required Europol to delete swathes of personal data it had collected and processed unlawfully.
MEPs voted by 480 in favour of a significant expansion of Europol’s role, with 142 against and 20 abstentions, in a move that will extend Europol’s use of big data and artificial intelligence in criminal investigations.
The proposed regulation introduces measures to protect the privacy of individuals, including the appointment of a fundamental rights officer at Europol and independent oversight by the EDPS.
But the move has been criticised by civil society groups, and some MEPs, which claim that it amounts to a “massive, unchecked expansion” of Europol’s powers and could represent a first step on the road to creating a European version of GCHQ or the US National Security Agency. “Europol will be allowed to collect and share data left, right and centre, without much restriction or control,” said Chloé Berthélémy, policy rights advisor at European Digital Rights (EDRi), a network of civil and human rights organisations in Europe. The draft legislation is in part a response to growing requests for Europol to analyse increasingly large and complex datasets to identify crimes in multiple countries inside and outside of the European Union. “Europol will be allowed to collect and share data left, right and centre, without much restriction or control” One example is an operation by the French and the Dutch police in 2020 to hack into the encrypted phone network EncroChat, sweeping up text messages from tens of thousands of phones along with details of users’ contacts, notes, videos and voice messages, their pseudonyms, and unique phone identifiers. The proposed new legislation will expand the range of data Europol can retain and process beyond its existing mandate, which restricts the police agency to processing data only on individuals who had a clear and established link to criminality. The draft legislation will also allow Europol to share data – which could include IP addresses, URLs and the content of communications – with companies, including financial institutions and online platforms. European member states provide Europol with datasets, which are understood to include passenger flight records, mobile phone locations and datasets of open source data which might include social media posts scraped from the internet. Europol will also be able to receive data from internet service and technology companies, such as Google and Facebook, including subscriber, traffic and content data that may be relevant to criminal investigations. It will take on an additional role to assess the strategic risks posed by foreign investors in emerging technologies in Europe, particularly those used by law enforcement and critical technology that could be used for terrorism
The draft law also gives Europol a mandate to research innovative technologies including AI technology and algorithmic decision-making, which, for example, could be used to predict which individuals are likely to be involved in criminal activity.
