The EU’s central law enforcement agency is on track to gain sweeping new powers to process biometric data and share personal information with countries outside the EU. Critics from rights groups say the move could pave the way for biometric surveillance across Europe.
The European Parliament’s civil liberties Committee (LIBE) approved on Wednesday, 5 October, a political deal expanding Europol’s powers to combat migrant smuggling and human trafficking. The text, finalised after negotiations with the Council, passed by a vast majority. It had 59 votes in favour, 10 against and four abstentions. It won support from the EPP, S&D, Renew and ECR; the Greens and the Left opposed it.
Originally proposed by the European Commission in 2023, the regulation revises Europol’s legal mandate to allow the agency to process biometric data and exchange personal information with third countries in the name of dismantling cross-border smuggling networks. It also reinforces the European Centre Against Migrant Smuggling, adding €50m in funding and 50 new staff.
Biometric surveillance concerns
Brussels justifies the need to reform given the gravity of the crime in question. It described smuggling as “disrespect for human life and dignity of people in the pursuit of profit”, undermining both “the fundamental rights of the people concerned” and “the migration management objectives of the Union”.
On the opposite side, civil society organisations say the reform goes well beyond this purpose. They claim it extends Europol’s operational reach into biometric surveillance and cross-border data flows. Caterina Rodelli, EU policy analyst at Access Now, told EU Perspectives that the proposal “will strengthen the marriage between the surveillance industry and security governmental bodies”. “It provides an additional legal basis for more procurement of surveillance technology, and it makes EU institutions a great partner in this expanding market,” she added.
What concerns the analyst most is how these systems will operate largely outside public scrutiny. “These agencies will benefit from transparency derogations as per the AI Act (which exempts migration authorities from registering their use of high-risk AI systems). They will therefore have more freedom to deploy biometric identification systems away from public scrutiny,” Ms Rodelli said.
You might be interested
The high-risk AI factor
The connection between the Europol file and the EU’s AI Act is central to the debate. The regulation classifies biometric identification as “high-risk” and bans certain uses, such as real-time remote facial recognition in public spaces. Yet it also leaves wide exemptions for law enforcement and migration authorities. “There is interplay with the AI Act but not necessarily clashes,” Ms Rodelli explained. “The AI Act already presents various loopholes that allow for a more loose use of ‘high-risk’ AI by law enforcement and migration authorities, including Europol.”
The AI Act already presents various loopholes that allow for a more loose use of ‘high-risk’ AI by law enforcement and migration authorities, including Europol — Caterina Rodelli, EU policy analyst at Access Now
In practice, law enforcement/migration authorities do not have to register their use of such systems in the EU’s public database. Critics of these exceptions, including Access Now and other 150 civil society groups, have published a critical joint statement. It claims that the AI Act “fails migrants and people on the move”. The groups also claim the legislation “develops a separate legal framework for the use of AI by law enforcement, migration control and national security authorities, provides unjustified loopholes and even encourages the use of dangerous systems for discriminatory surveillance on the most marginalised in society”.
Data protection
The discussion also revives old questions about data retention and accountability related to Europol. In 2022, the EDPS (European Data Protection Supervisor) ordered Europol to delete large datasets containing information on individuals with no established link to crime.
The EDPS’s opinion on the current proposal reflects similar concerns. The supervisor called for the mitigation of data protection, safeguards around biometric data, and greater clarity in cooperation with Frontex. Explicit division of responsibility between Europol and member states when sharing personal data during joint operations is also desirable.
Backed by a broad political majority, the reform marks what rights advocates call a decisive moment in Europe. It exemplifies how the Union’s response to migration and cross-border crime increasingly relies on technological capacity and data exchange. This shift, critics warn, could erode the boundaries between policing, privacy, and democratic oversight.
The European Parliament will hold its plenary vote on the proposal on 24 November 2025.
