Brussels wants to double the agency’s staff and widen its data powers. Rights groups say it has written the surveillance before drawing the safeguards.
The European Commission moved to give Europol a markedly bigger job. In a proposal set out as part of its drive to harden the bloc against organised, internet-based, and financial crime, Brussels wants to convert the EU’s police agency from a clearing house for national forces into something closer to an operational force in its own right, with more staff, more money, and a wider reach into data.
The headline numbers are blunt. The Commission has floated doubling Europol’s personnel and earmarked roughly €3bn for the agency over the next budget period, alongside almost €12bn for the border force Frontex.
The overhaul would beef up the agency’s support to member states through Operational Task Forces and Joint Investigation Teams, deepen its strategic partnerships with non-EU countries and private firms, and add what the Commission frames as stronger oversight and accountability mechanisms to keep the expansion in check.
The plan sits inside the Commission’s wider internal-security agenda, the so-called ProtectEU strategy, which promised Europol “an ambitious overhaul” of its mandate to make it “a truly operational police agency.”
A public consultation ran from late October until January, and the Commission signalled to MEPs that the proposal would land in the second quarter of 2026.
The text now begins the ordinary route through the European Parliament and the Council, where the detail, and the fight, will be.
Much of the substance is digital. The Commission wants Europol built into a centre of operational expertise in digital forensics, and alongside it sits a technology roadmap on encryption meant to identify ways for law enforcement to reach encrypted data lawfully, with funding for next-generation decryption flagged for the end of the decade.
Brussels also intends to explore better cross-border cooperation on lawful interception by 2027.
The encryption question is the one most likely to draw blood, given how bitterly the bloc has fought over message-scanning rules and how loudly privacy advocates have warned that any backdoor is a backdoor for everyone.
That is the crux of the objection. Digital-rights organisations read the package as the latest step in a pattern, not a break from it.
European Digital Rights, with the Protect Not Surveil coalition, has argued the reform would expand Europol’s powers with as few fundamental-rights safeguards as possible, handing the agency access to vast databases of personal data without, in their telling, matching accountability.
The concern is not only campaigners’. The European Data Protection Supervisor, the EU’s own privacy watchdog, has previously admonished Europol over its handling of Europeans’ personal data, including a row over a vast cache of information it had retained on people never linked to any crime.
The biometric dimension has its own edge: lawmakers approved a regulation widening the agency’s capacity to process biometric data, a move critics say risks normalising facial-recognition databases.
Brussels has, characteristically, built the machinery before settling what restraint on it should look like.
The timing keeps awkward company. The reform arrives as Europe’s own surveillance industry has repeatedly outpaced the rules meant to constrain it, from spyware scandals to leaked licences showing how loosely the bloc’s export controls have been applied.
The same EU that wants Europol reaching deeper into data has struggled to police the firms selling interception tools to repressive governments.
None of this guarantees the proposal passes intact. It is a starting position, and the Parliament has form in trimming home-affairs files it judges to have overreached, much as it has wrangled over scope and timing on the bloc’s AI Act.
Commissioner Magnus Brunner, who holds the home-affairs brief, has framed the redesign as giving national forces technological muscle they lack alone.
What comes next is procedural: the proposal goes to co-legislators, the EDPS will deliver an opinion, and the negotiation over data access, biometric powers, and oversight will run through trilogue.
The numbers are easy to report. The harder question is who watches the agency once it can see this much.
