The European Data Protection Supervisor (EDPS) has ordered Europol to delete a major reserve of data gathered from criminal investigations.

Europol, the law enforcement agency for the European Union, works with the police authorities in EU member states to combat serious and organised crime.

The EDPS began an investigation in 2019 over concerns about how Europol was storing and processing information. It warned that Europol has been storing datasets without undergoing a Data Subject Categorisation going back years.

According to an investigation by the Guardian, the data amounts to around four petabytes (the step up from terabytes) on at least 250,000 EU residents.

Because the data is uncategorised, they could potentially include people with no proven connection with a crime. This jeopardises the concerned individuals’ fundamental privacy rights and may result in people being wrongfully linked to crimes.

Europol regulations mean it can only process data about individuals with a clear and established link to a crime, such as suspects and witnesses. Without the ability to prove a justifiable cause to store the data, Europol will now be required to delete any uncategorised data.

With the conclusion of the investigation, the EDPS has given Europol twelve months, starting from January 4th, to either process and categorise the backlog of data or delete it.

In addition, any new data being acquired by the group must be processed within six months or be deleted.

According to the data watchdog, the group admonished Europol in September 2020 over how it stored large volumes of data with no Data Subject Categorisation.

After raising these concerns, Europol brought in some in measures to regulate how it stored information. These included technical measures to separate and store datasets in a secure environment to keep unverified data from being shared with law enforcement bodies and used for analysis.

Recommended

• 15 Scottish tech companies to watch in 2022
• Could AI be the key to help patients access the right medication?
• Cows fitted with VR goggles in a bid to increase milk yields

However, the EDPS warned that these measures only reduce, not remove, the risks to the individuals’ privacy rights and that its requests to define an appropriate data retention period to filter and extract personal data permitted for analysis under the Europol Regulation had not been followed.

As such, Europol was in contravention of its data use regulations by keeping data for longer than necessary.

European Data Protection Supervisor Wojciech Wiewiórowski said: “Europol has dealt with several of the data protection risks identified in the EDPS’ initial inquiry. However, there has been no significant progress to address the core concern that Europol continually stores personal data about individuals when it has not established that the processing complies with the limits laid down in the Europol Regulation.

“Such collection and processing of data may amount to a huge volume of information, the precise content of which is often unknown to Europol until the moment it is analysed and extracted – a process often lasting years.

“A six-month period for pre-analysis and filtering of large datasets should enable Europol to meet the operational demands of EU Member States relying on Europol for technical and analytical support, while minimising the risks to individuals’ rights and freedoms.”

Wiewiórowski added: “Furthermore, understanding the operational needs of Europol and the amount of data collected so far, I have decided to grant Europol a period of 12 months to ensure compliance with the Decision for the datasets already in Europol’s possession.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We will keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

Click here to subscribe.