On 3 January 2022, the European Data Protection Supervisor (EDPS) issued an order against Europol to delete data concerning individuals with no established link to a criminal activity. The "Decision on the retention by Europol of datasets lacking Data Subject Categorisation ('DSC')" follows from the EDPS' long-standing inquiry into large datasets stored at Europol without the needed categorisation as foreseen in the Europol Regulation (→ eucrim 3/2020, 169-170).

Large datasets lacking DSC refer to datasets which, because of their characteristics and notably their size, do not undergo the data classification process and extraction of data categories as provided for in the Europol Regulation and its Annexes. This is a recurrent problem since Europol receives complex and large datasets for analysis where a pre-categorisation of individuals linked to a criminal activity (e.g. suspects, witnesses, contact persons to criminals, etc.) is hardly possible. However, under the current rules, Europol is not allowed to keep data on individuals who have no established link to crime or criminal activity for a prolonged period of time.

With a view to contributions of categories of personal data and data subjects within the meaning of Art. 18(5) of Regulation 2016/794, the EDPS orders Europol the following:

• To proceed with data subject categorisation for each contribution within six months of the date of receipt;
• To erase datasets lacking DSC after expiry of the six-month period;
• Not to perform data processing operations with the personal data (other than that strictly necessary to proceed with such categorisation) before the DSC is completed;
• To proceed with DSC regarding existing datasets within twelve months;
• To notify (where applicable) the third parties, to whom datasets lacking DSC have been disclosed, of the erasure of the datasets;
• To provide quarterly implementation reports over the next twelve months.

Following this decision, on 11 January 2022, Europol published a statement claiming that the decision will impact Europol's ability to analyse complex and large datasets at the request of EU law enforcement. Europol's work frequently entails a period longer than six months, as does the police investigations it supports. Hence, the Agency will assess possible consequences and any negative impact of the decision and seek the guidance of its Management Board.

A possible revision of the current Europol Regulation (→ eucrim 4/2020, 279) will tackle the problem and probably prolong the time limits for Europol to assess large-scale datasets.