A human rights organisation has filed a complaint to Europe’s data protection regulator, calling for it to ban the European police agency, Europol, from conducting data processing operations on “shadow IT” environments that are not compliant with European law.
The non-profit organisation, Front-Lex, which campaigns on European Union (EU) migration and borders, filed the complaint on behalf of three named human rights defenders (see box below), alleging that Europol unlawfully stored and processed sensitive personal information about the activists on unregulated IT environments in breach of EU law.
Front-Lex is pressing the European Data Protection Supervisor (EDPS) to halt Europol’s use of all unlawful parallel IT environments, and says it will take the case to the Court of Justice of the European Union (CJEU) within three months if the EDPS does not respond.
The same non-profit won a landmark legal victory in a case involving the European border agency, Frontex, last year, which opens the way for the current legal challenge. The European Court of Justice found in the case of Hamoudi v Frontex (see box below) that it was enough for asylum seekers to provide prima facie evidence, rather than conclusive proof, when alleging unlawful contact by the border agency, creating a precedent that applies to other European institutions.
The complaint filed today builds on an investigation by Computer Weekly, Correctiv and Solomon that revealed Europol unlawfully stored huge volumes of sensitive personal data on “shadow IT” systems – which fell outside the normal data protection and security controls deployed by the agency – for years.
A former senior Europol official told the investigation that one of the complainants, Dutch activist Frank van der Linde, had his data processed through one of these parallel IT environments, known internally as the “pressure cooker”. According to the complaint, Europol deliberately concealed the activity from the EDPS.
Parallel IT environments
The complaint states that Europol ran IT environments that lacked basic controls for accessing, logging or processing personal data, in parallel to Europol’s main IT system, known as the Operational Network (OPS NET).
Internal reports from 2019 seen by Computer Weekly and its partners in the investigation identified serious security failures with Europol’s Computer Forensic Network, which had been used to store almost all of the agency’s operational data.
Front-Lex also argues that the parallel networks allowed Europol to secretly process and store personal data, including data about individuals who were not suspected of any criminal offence, which the agency could not lawfully store on its regular network.
The campaign group also alleges that Europol submitted a “prior consultation” to the EDPS on the proposed and future use of parallel IT environments to retrospectively validate systems that had been in use for years and had been concealed from the data protection regulator.
It claims the EDPS failed in its duty to exercise due diligence over the “prior consultation” and failed to assess whether Europol was storing data on individuals lawfully and accurately. “This resulted in the EDPS’s failure to uncover those parallel systems and to identify the scales of Europol’s unlawful contact in those cases,” Front-Lex said.
The lack of control over who accesses data and what they can do with it in Europol’s parallel environments meant that any information stored about a person could be modified or kept in another form, without any explanation of how it was produced, “rendering futile” any request by individuals to access the data Europol holds on them.
It argues that individuals’ right of access to data held by Europol will remain “deprived of any practical effect” if EDPS fails to issue a temporary or permanent ban on Europol’s use of parallel shadow IT environments.
Innovative legal move
Iftach Cohen, lawyer and co-director of Front-Lex, described the case, which builds on the legal precedent set by Hamoudi v Frontex, as a “highly innovative” legal move. “When there is a structural imbalance in terms of collecting evidence, the judges are obliged to order the competent institution to disclose all relevant evidence,” he said.
A competent European Data Protection Supervisor would not have waited for Front-Lex to submit a complaint, but would have connected the dots and begun its own investigation, he added.
The investigation by Computer Weekly, Correctiv and Solomon revealed that Europol operated a shadow data repository containing vast amounts of sensitive personal information and used it for years beyond its lawful scope, according to internal documents and whistleblower accounts.
The police agency stored petabytes of crime-related data on a network that operated for years without scrutiny from regulators, despite significant privacy and security flaws, the investigation revealed.
Europol held data on human rights activists
The named complainants include Dutch activist Frank van de Linde; Natalie Gruber, an Austrian human rights defender who campaigned for the rights of migrants; and David Yambio, president of the Italian campaign group Refugees in Libya.
They are part of a larger group, including asylum seekers, migrants and human rights defenders, who are affected by the clandestine operation of Europol’s “parallel shadow environments” and by the EDPS’s continuing failure to monitor and ensure the agency’s compliance with EU data protection law, according to Front-Lex.
Yambio said he suspects that Europe’s border agency, Frontex, has been sharing information about him and his organisation with Europol. He believes that the information, which may include downloads of data from his mobile phone, may have been stored in Europol’s parallel systems.
Yambio said that personal data had been hacked from his phone following a spyware attack, which he attributes to Italy, and that information about him had been obtained unlawfully by Frontex from asylum seekers it “debriefed” when they arrived on the coast of Sicily.
“For as long as the EDPS allows these unlawful systems to remain in place, I remain exposed not only to further intimidation and attempts to criminalise me, but also unable to exercise my right of access to the information Europol is processing about me,” he said.
Gruber said she had lived with the consequences of a criminal investigation that never should have been brought. When the investigation collapsed, she says she was met with years of secrecy, delays and incomplete answers after trying to obtain her data from Europol.
“The revelations about Europol’s parallel data-processing systems only reinforced my concern that the agency has been shielding not only unlawful practices by member states, but also its own unlawful processing, from meaningful oversight,” she said.
Van der Linde said: “Constantly finding out that there is more data being processed about me frightens me a lot. Hopefully, the EDPS acts fast now, and the illegal data processing stops.”
EU plans to boost Europol data sharing
The complaint comes as the European Commission has unveiled plans to double Europol’s budget, develop advanced technological capabilities and give it new powers to collect and share personal data.
The proposals also include plans to rewrite Europol’s mandate to give it greater freedom to collect and share personal data, including data on people who have not been suspected of a crime.
S 004