Europe’s data protection supervisor has confirmed it is conducting a months-long “fact finding” exercise after an investigation by Computer Weekly and partner publications Correctiv and Solomon revealed Europol stored sensitive data for years in a data processing environment that failed to meet European Union (EU) security and data protection standards.
The investigation, based on anonymous testimonies of senior Europol officials and leaked documents, revealed how Europol created a data repository in its Computer Forensics Network (CFN), and used it to store huge volumes of sensitive personal data without full data protection and security safeguards.
Leaked emails have revealed that Europol officials were also aware of the use of a set of tools, known as the Pressure Cooker, set up by Europol’s Internet Referral Unit, for fast-track processing of data scraped from the internet.
The European Data Protection Supervisor (EDPS) confirmed it was investigating “to decide whether other (and which kind of) supervisory action is necessary” against Europol. It is understood to be focusing on the Pressure Cooker. Previously, the data protection supervisor, Wojciech Wiewiórowski, suggested in a press conference that most of the information revealed by the investigation was not new to the watchdog.
The EDPS has confirmed that Europol has only referred to the Pressure Cooker once in a single document, describing it as the nickname of an existing system. The watchdog has refused to release this document, a Europol ICT 2022 working plan, citing privacy and security exemptions under freedom of information regulations.
Europol claims in a statement published on its website that allegations that it used a processing environment outside the requirements of EU law and data protection rules were “incorrect”. It said it “proactively engaged” with the European Data Protection Supervisor over the compliance of its IT systems.
Former Europol officials said Europol’s decision to proactively expose compliance issues in 2019 was a damage control manoeuvre taken by the then incoming executive director of the agency, Catherine De Bolle, who did not want to inherit the liabilities identified in Europol’s CFN data storage network. De Bolle, Europol executive director at the time, declined to be interviewed, and left the position in May 2026.
Significant questions remain unanswered over the lack of data protection and security safeguards in Europol’s data network. As reported in internal Europol monitoring documents, by 2019, the CFN had severe security vulnerabilities including insufficient logging of administrative actions, the lack of a reliable mechanism to track who had accessed or modified sensitive data, unrestricted software installation, and a lack of effective password management.
Information stored in the CFN included phone records, financial transactions, geolocation data and identity documents – belonging in many cases to individuals who had never been suspected of any crime.
In February 2026, Wiewiórowski informed the Joint Parliamentary Scrutiny Group that the watchdog was closing its years-long monitoring of Europol’s irregular big data repositories – even though 15 of its 150 recommendations had not been implemented. The outstanding items, the EDPS noted, included matters of “particular importance”, including core security measures for the CFN.
In a separate response to written questions by MEP Saskia Bricmont in May, Europol disclosed that the EDPS had resolved only three of the 10 recommendations related to CFN. “For the other seven recommendations, specific safeguards have been taken forward and additional work is in progress,” Europol said.
This echoed the findings of Europol’s internal 2019 mitigation task force, which reported that the CFN was unfixable and that certain issues would be resolved only when Europol migrated its repository of data to a planned replacement system, which has yet to be fully delivered.
Europol said in a statement it would implement the seven remaining recommendations by migrating to a new IT environment, known as the New Forensic Environment.
“Much of this migration has already been completed, with four of the original 25 Analysis Projects still to transfer,” it said. “Their migration is scheduled for the first quarter of 2027, allowing the remaining recommendations to be fully implemented and the CFN to be decommissioned. Safeguards have been taken forward in the meantime.”
Europol published a statement on its website stating that the claims made in the investigation “are incorrect and are based on a misunderstanding of Europol’s operational setup and legal framework”.
Additional reporting by Lydia Emmanouilidou
