HomeHow to Remove Your Personal Data from Europol's Database: A Complete Guide
Learn how to request data erasure from Europol under Article 36 of Regulation (EU) 2016/794. Step-by-step process, EDPS appeals, and documentation requirements.
Article 36(3) of Regulation (EU) 2016/794 gives you the right to request that Europol erase, correct, or restrict your personal data if it’s inaccurate, no longer needed, processed unlawfully, or kept beyond the legal storage period. You can submit requests directly to Europol’s Data Protection Function in The Hague or through your national authority—and they must respond within three months. Our legal team has guided clients through Article 36 procedures across 17 EU member states, including appeals to the European Data Protection Supervisor when initial requests are denied.
Europol Regulation – Regulation (EU) 2016/794, as amended by Regulation (EU) 2022/991 (effective June 8, 2022), is the primary legal framework governing Europol’s operations and the rights of individuals whose personal data is processed in Europol databases, including the right to request erasure under Article 36.
Key Takeaways
- Article 36(3) guarantees your right to request erasure, rectification, or restriction of your data from Europol—at no cost
- Europol must respond within three months. Miss this window and you may have grounds to escalate the complaint
- Denied? You have three months to lodge a complaint with the European Data Protection Supervisor
- Submit requests in English or French with identity documentation, a clear statement of which remedy you seek, legal grounds, and supporting evidence
- A lawyer can represent you with a valid power of attorney—often worthwhile for complex cases involving multiple jurisdictions
What is the legal basis for removing personal data from Europol?
Article 36(3) of Regulation (EU) 2016/794 establishes your right to request rectification, restriction, or erasure of personal data held by Europol. The 2022 amendments left this core right untouched, even as they expanded Europol’s authority to process data for research and innovation projects. It applies across all data categories—operational files, analytical work products, index systems.
Four legal grounds support an erasure request. The data is inaccurate or incomplete. Europol processed it in violation of the Regulation’s substantive or procedural rules. The data is no longer necessary for its original purpose. Or the applicable storage period has expired with no legal reason to keep it longer.
Erasure is not the same as rectification or restriction. Rectification corrects inaccurate information while keeping the record active. Restriction marks data so it can only be used for specific purposes—typically storage and legal proceedings—without full deletion. Europol sometimes proposes restriction as a middle path when erasure would disrupt ongoing law enforcement operations.
Who can request data removal from Europol and under what conditions?
Anyone whose personal data appears in Europol’s systems qualifies as a data subject under Article 36. Citizenship and residency don’t matter. But submitting a request doesn’t automatically confirm Europol holds your data—you must genuinely believe it does and provide some basis for that belief.
A lawyer or agent can submit on your behalf with a valid power of attorney. That document must identify you clearly, specify representation authority, and be properly signed under the rules of the jurisdiction where it was executed. Europol rejects requests without proper authorisation paperwork.
Your data becomes eligible for removal when certain facts materialise. Criminal proceedings ended with an acquittal, dismissal, or decision not to prosecute. The investigating authority formally closed the case and told Europol to stop holding your data. The legal storage period expired with no grounds for extension. Or you can prove the data violated Europol’s quality standards or the requesting country’s procedural rules.
One complication: Europol doesn’t always control the data it receives. Member states send data and retain responsibility for accuracy and retention. When that happens, Europol may forward your request to the originating National Central Bureau instead of handling it directly—adding weeks to the process.
⚠️ Time is critical — every day matters
Get a free case assessment
Our team specialises in cases with an international element. We review applicable treaties, assess risks, and prepare an action plan.
This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organisation, or official authority.
Frequently Asked Questions
Is there a fee to request data removal from Europol?
No. Article 36 of Regulation (EU) 2016/794 makes access, rectification, restriction, and erasure completely free. Europol cannot charge you a single penny for receiving, processing, or responding to your request. You cover only postage or courier costs, plus legal fees if you hire a lawyer.
Do I need to know if my data is in Europolu0026#39;s database before requesting removal?
Not required. Still, filing an Article 36(2) access request first clarifies whether Europol actually holds data on you, what categories exist, and when it was entered—all valuable ammunition for a stronger erasure request. If you request erasure and Europol has nothing on you, the Data Protection Function will say so and close the file. You face no penalty for requesting erasure of data that doesn’t exist.
Can Europol keep my data even if I request removal?
Yes. Europol can refuse if it shows legitimate grounds for retention: ongoing investigations, active analytical projects, or lawful law enforcement purposes under the Regulation. When that happens, Europol may offer restriction instead—the data stays but cannot be used operationally. Once the legitimate ground disappears, renew your erasure request or escalate to the EDPS if Europol still refuses.
Whatu0026#39;s the difference between erasure, rectification, and restriction?
Erasure is complete deletion; the record vanishes. Rectification fixes wrong or incomplete fields while keeping the record active. Restriction keeps the data stored but marks it so Europol can use it only for narrow purposes—preserving evidence, protecting rights, safeguarding public interests—and blocks operational analysis and intelligence sharing. Use erasure when the data shouldn’t exist at all, rectification when specific fields are wrong, and restriction when you need the data preserved but want operational use stopped.
How do I prove that my criminal case has been terminated for the erasure request?
Official court judgments or orders dismissing the case, acquitting you, or declaring non-lieu (no case to answer) are strongest. Prosecutor letters confirming closure also carry weight. Statements from the court registry or investigating judge that proceedings ended are sufficient. If your case was informally dropped without paperwork, obtain a certificate of non-prosecution or an official letter from the prosecuting authority on letterhead. Without official documents, a statutory declaration detailing case history and outcome is weaker but may work, especially if other evidence supports it—such as statute of limitations expiry.
