The EU Agency for Law Enforcement Cooperation (Europol) is a central plank of the EU’s broader internal security architecture. Law enforcement cooperation and policies are still developing, with a special focus on countering terrorism, cybercrime and other serious and organised forms of crime. The main goal is to achieve a safer Europe for the benefit of everyone in the EU, in compliance with fundamental rights and data protection rules, as requested several times by Parliament.

Legal basis

Articles 33 (customs cooperation), 87, 88 and 89 of the Treaty on the Functioning of the European Union (TFEU).

Objectives

Effective police cooperation is a key plank in making the EU an area of freedom, security and justice based on respect for fundamental rights. Cross-border law enforcement cooperation – involving the police, customs and other law enforcement services – is designed to prevent, detect and investigate criminal offences across the EU. In practice, this cooperation mainly concerns serious crime (such as organised crime, drug trafficking, money laundering, euro counterfeiting, human trafficking and cybercrime) and terrorism. Europol is the EU’s law enforcement agency.

Achievements

A. Beginnings

Police cooperation among the Member States began in 1976 through what was known as the ‘Trevi Group’, an intergovernmental network of representatives from justice and home affairs ministries. The Treaty of Maastricht then set out matters of common interest that gave legitimate grounds for police cooperation (terrorism, drugs and other forms of international crime). It also established the principle of creating a ‘European police office’ (Europol), which initially took shape as the Europol Drugs Unit. The Europol Convention was signed on 26 July 1995, though the office did not officially begin its work until 1 July 1999, on the basis of the enhanced powers granted by the Treaty of Amsterdam (signed on 2 October 1997). However, police cooperation had already progressed before the advent of Europol. With the creation of the Schengen Area in 1985, which at first involved only a handful of Member States, cross-border police cooperation had already become a reality (see also 4.2.4). With the entry into force of the Treaty of Amsterdam, the Schengen acquis – including its police cooperation aspects – was incorporated into EU law, though it fell under the ‘third pillar’ of intergovernmental cooperation. The same intergovernmental approach was used for police cooperation measures adopted by a small group of Member States under the Prüm Treaty, which contained provisions on the exchange of DNA, fingerprints and vehicle registration details. The Prüm Treaty was fully introduced at the EU level by Council Decision 2008/615/JHA of 23 June 2008.

B. Current institutional framework

The institutional framework has been considerably simplified by the Treaty of Lisbon (TFEU), with most police cooperation measures now adopted under the ordinary legislative procedure (codecision) and subject to judicial review by the Court of Justice of the EU. Nevertheless, even leaving to one side the specific features of the area of freedom, security and justice (i.e. opt-outs for Ireland and Denmark (Protocols 21 and 22 annexed to the TFEU) and a privileged role for national parliaments (Protocols 1 and 2)),police cooperation, together with judicial cooperation in criminal matters, has not been entirely woven into the European Union framework and retains some of its original features:

  • The Commission shares its power of initiative with the Member States, provided they represent a quarter of the members of the Council (Article 76 TFEU);
  • Parliament is merely consulted on operational cooperation measures, which are adopted unanimously by the Council. In the absence of unanimity on the Council, it is possible for nine or more Member States to work together on the basis of enhanced cooperation. In this scenario, the European Council suspends the process in order to seek consensus (‘emergency brake’ mechanism under Article 87(3) TFEU).

C. Main legislative acts on police cooperation adopted under the ordinary legislative procedure

  • Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA (known as the ‘Cybercrime Directive’). Member States were required to incorporate this directive into national law by 4 September 2015.
  • Regulation (EU) 2015/2219 of the European Parliament and of the Council of 25 November 2015 on the European Union Agency for Law Enforcement Training (CEPOL) and replacing and repealing Council Decision 2005/681/JHA, applicable since 1 July 2016.
  • Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. Member States were required to incorporate the directive into national law by 25 May 2018.
  • Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems (NIS) across the Union. Member States were required to incorporate this directive into national law by 9 May 2018.
  • Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA. Member States were required to incorporate this directive into national law by 8 September 2018.
  • Directive (EU) 2021/555 of the European Parliament and of the Council of 24 March 2021 on control of the acquisition and possession of weapons.
  • Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011, applicable since 11 December 2018.
  • Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU, applicable from 28 December 2021 at the latest.
  • Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816.
  • Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences, and repealing Council Decision 2000/642/JHA. Member States were required to incorporate this directive into national law by 1 August 2021.
  • Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2021 on addressing the dissemination of terrorist content online, applicable from 7 June 2022.
  • Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation, applicable from 28 June 2022.
  • Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive). Member States were required to incorporate this directive into national law by 18 October 2024.
  • Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (CER Directive). Member States were required to incorporate this directive into national law by 18 October 2024.
  • Directive (EU) 2023/977 of the European Parliament and of the Council of 10 May 2023 on the exchange of information between the law enforcement authorities of Member States and repealing Council Framework Decision 2006/960/JHA. Member States are required to incorporate this directive into national law by 12 December 2024.
  • Regulation (EU) 2023/2131 of the European Parliament and of the Council of 4 October 2023 amending Regulation (EU) 2018/1727 of the European Parliament and of the Council and Council Decision 2005/671/JHA, as regards digital information exchange in terrorism cases, applicable from 31 October 2023.
  • Regulation (EU) 2024/982 of the European Parliament and of the Council of 13 March 2024 on the automated search and exchange of data for police cooperation (the Prüm II Regulation), applicable from 25 April 2024.

D. Police cooperation agencies and other related bodies

1. European Union Agency for Law Enforcement Cooperation (Europol)

Europol is an agency whose main goal is to make Europe safer. It supports the Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. Europol also works with many non-EU partner states and international organisations. Europol serves as a support centre for law enforcement operations and as a hub for information on criminal activities.

Large-scale criminal and terrorist networks pose a significant threat to the internal security of the EU. The biggest security threats come from terrorism, international drug trafficking, money laundering, organised fraud, the counterfeiting of euros and trafficking in human beings.

Europol has set up several specialised units to respond to these threats:

  • the European Cybercrime Centre, which strengthens the law enforcement response to cybercrime in the EU and thus helps to protect European residents, businesses and governments from online crime;
  • the European Migrant Smuggling Centre, which supports the Member States in targeting and dismantling the complex and sophisticated criminal networks involved in migrant smuggling;
  • the European Counter Terrorism Centre, an operations centre and hub of expertise that reflects the growing need for the EU to strengthen its response to terror;
  • the European Serious Organised Crime Centre, which provides operational support to Member State investigations in priority cases related to serious and organised crime;
  • the Intellectual Property Crime Coordinated Coalition, which provides operational and technical support to law enforcement agencies and other partners;
  • the European Financial and Economic Crime Centre, an operational centre to support Member States in ongoing cases relating to financial and economic crime;
  • FIU.net, a decentralised and sophisticated computer network supporting the Financial Intelligence Units in the EU in their fight against money laundering and the financing of terrorism;
  • the EU Internet Referral Unit, which detects and investigates malicious content on the internet and social media networks.

Europol was established under the Europol Regulation. It is based in The Hague, the Netherlands. Europol produces several reports, such as the EU Terrorism Situation and Trend Report (TE-SAT), the Serious and Organised Crime Threat Assessment (SOCTA), the Internet Organised Crime Threat Assessment (IOCTA), and an annual review. Europol published its most recent SOCTA in April 2021, its most recent TE-SAT in June 2023 and its most recent IOCTA in July 2023. On 5 April 2024, Europol presented its first report on ‘Decoding the EU’s most threatening criminal networks’.

In order to achieve greater accountability for the agency, a Joint Parliamentary Scrutiny Group (JPSG) on Europol was set up under the Europol Regulation. Article 88 TFEU provides for scrutiny of Europol’s activities by the European Parliament, together with national parliaments. According to Article 51 of the Europol Regulation, ‘the JPSG shall politically monitor Europol’s activities in fulfilling its mission, including as regards the impact of those activities on the fundamental rights and freedoms of natural persons’. The 14th meeting of the JPSG was organised on 18 and 19 February 2024 in Ghent.

In May 2022, Parliament and the Council adopted a new regulation amending Europol’s mandate, which entered into force on 28 June 2022. The new Europol Regulation covers improvements on research and innovation, the processing of large datasets, cooperation with private parties and non-EU countries, cooperation with the European Public Prosecutor’s Office, and how new alerts in the Schengen Information System can be entered on the basis of information from non-EU countries, as Europol can now suggest that Member States enter alerts. The Executive Director of Europol can also propose opening a national investigation into non-cross-border crimes that affect a common interest covered by an EU policy.

2. European Union Agency for Law Enforcement Training (CEPOL)

CEPOL is an agency dedicated to developing, implementing and coordinating training for law enforcement officials. CEPOL contributes to a safer Europe by facilitating cooperation and knowledge sharing among law enforcement officials of the Member States, and to some extent from non-EU countries, on issues stemming from EU priorities in the field of security; in particular, from the EU policy cycle on serious and organised crime. The Law Enforcement Training Agency is established under the CEPOL Regulation. It is based in Budapest, Hungary.

3. Standing Committee on Operational Cooperation on Internal Security (COSI)

Under Article 71 TFEU, ‘a standing committee shall be set up within the Council in order to ensure that operational cooperation on internal security is promoted and strengthened within the Union. Without prejudice to Article 240, it shall facilitate coordination of the action of Member States’ competent authorities. Representatives of the Union bodies, offices and agencies concerned may be involved in the proceedings of this committee. The European Parliament and national parliaments shall be kept informed of the proceedings.’ COSI was established by the Council Decision of 25 February 2010 on setting up the standing committee on operational cooperation on internal security (2010/131/EU).

4. EU Intelligence and Situation Centre

The EU Intelligence and Situation Centre (EU INTCEN) is not, strictly speaking, a police cooperation body, since it is a body of the European External Action Service and only deals with strategic analysis. Nevertheless, it contributes to police cooperation by producing threat assessments based on information provided by intelligence services, the military, diplomats and police services. INTCEN is also able to make useful contributions from an operational perspective by providing, for example, EU-wide information on the destinations, motives and movements of terrorists.

Role of the European Parliament

Parliament has played a key role in shaping EU legislation in the field of police cooperation by making the safety of the EU’s population a political priority. Furthermore, under the ordinary legislative procedure, it has been working on improving police cooperation on an equal footing with the Council.

The main instrument for police cooperation is Europol, which is a central pillar of the EU’s broader internal security infrastructure. As part of the Europol reform, Parliament actively advocated for greater parliamentary scrutiny and better data protection rules. Parliament was involved (under the ordinary legislative procedure) in strengthening Europol’s mandate, following the Commission proposal adopted on 9 December 2020. The new mandate allows Europol to process large data sets and to develop new technologies that meet law enforcement needs. It also strengthens Europol’s data protection framework and parliamentary oversight. The revised Europol Regulation entered into force in June 2022.

During various debates on fighting terrorism and freedom of expression, Parliament condemned terrorist attacks in Europe and around the world and called for unity and a robust response. Parliament also called for additional efforts to promote fundamental freedoms and referred to the need to urgently tackle the online aspects of radicalisation and hate speech.

On 17 December 2020, Parliament adopted a resolution on the EU Security Union Strategy for the 2020-2025 period, which was proposed by the Commission on 24 July 2020. The strategy proposes the development of tools and measures over the next five years to ensure security in our physical and digital environment, including combating terrorism and organised crime, preventing and detecting hybrid threats, increasing the resilience of our critical infrastructure, promoting cybersecurity and fostering research and innovation.

On 6 October 2021, Parliament adopted a resolution on artificial intelligence (AI) in criminal law and its use by the police and judicial authorities in criminal matters. MEPs pointed to the risk of algorithmic bias in AI applications and emphasised the need for human supervision to prevent discrimination. They also asked for a moratorium on the deployment of facial recognition systems for law enforcement purposes. On 13 March 2024, Parliament adopted a legislative resolution on the proposal for a regulation on laying down harmonised rules on Artificial Intelligence (AI Act). The regulation establishes obligations on AI systems and providers, based on the potential risks and impacts of AI, while ensuring safety and compliance with fundamental rights. The use of biometric identification systems by law enforcement is prohibited in principle, except in exhaustively listed and narrowly defined situations.

Parliament is involved in the evaluation and scrutiny of the following, and is reviewing the relevant legislative proposals:

To make sure that law enforcement authorities across the EU can work together better under a modern rulebook, on 8 December 2021 the Commission proposed an EU police cooperation code, which will streamline the current patchwork of various EU tools and multilateral cooperation agreements. The proposed measures include a recommendation on operational police cooperation, new rules on information exchanges between law enforcement authorities across the Member States and revised rules on automated data exchanges for police cooperation under the ‘Prüm’ framework. Parliament was involved in the approval of the proposed measures.

Parliament recently prepared reports and resolutions on the following issues: preventing and combating trafficking in human beings and protecting its victims; preventing and combating violence against women and domestic violence; cyber-violence; child sexual abuse online; cybercrime and cybersecurity; money laundering and financing of terrorism; European production and preservation orders for electronic evidence in criminal matters; the reform of e-Privacy and the confidentiality of electronic communications; the revision of the Schengen Borders Code; the digitalisation of visa-issuing procedures; law enforcement cooperation; the collection and transfer of advance passenger information; terrorism and violent radicalisation; intrusive spyware; foreign interferences and disinformation; and the exchange of information and data flows with the United States.

Police cooperation and internal security policies are still under development, with attention focused on countering pan-EU threats and crime more effectively and, particularly for Parliament, doing so in accordance with rules on fundamental rights and data protection. While there has been a complete overhaul of the rules applying to EU police cooperation agencies, concerted efforts will still be needed to further strengthen police cooperation measures, in particular on the exchange of data and evidence between Member States’ law enforcement authorities, and between those authorities and EU agencies. Parliament has urged the Member States to make the necessary technical standardisation improvements with regard to data quality and to establish a legal framework for a future approach based on ‘information sharing by default’. In this context, the EU will have to carefully address challenges related to new technologies, artificial intelligence, encryption and the interoperability of information systems for borders, security and migration.

As the number of tasks increases and expectations grow, adequate financial and human resources for EU agencies need to be ensured.

Parliament is now a fully fledged institutional actor in the field of internal security policies, and should play a greater role in evaluating and defining police cooperation policies.

 

Alessandro Davoli