INTERPOL vs Europol: powers, data, alerts and remedies

Who holds power? The institutional authority matrix

The name appearing in a police report does not necessarily identify the body legally responsible for the consequence. A national arrest can follow information supplied through an international channel, while the domestic authority remains responsible for its decision. The comparison below separates four questions: who sends information, who handles a record, who exercises coercive powers, and who can grant a remedy.

What counts as an alert, and what does not?

An INTERPOL Red Notice asks police worldwide to locate and provisionally arrest someone pending extradition or a similar process. It is a request for cooperation, not an arrest warrant issued by INTERPOL; each country decides whether to act under its own law. Many Red Notices are not publicly visible, so failure to find a person in the public search does not establish that the system holds no information about them.

A diffusion is another INTERPOL communication, circulated by an NCB directly to some or all other member countries. Its legal requirements and review arrangements are relevant, but it should not be mistaken for a judicial order either. The operational review and visibility of wanted-person diffusions differ from other types of INTERPOL notices. If a police document says only “international alert,” ask for the issuing body, the record category, and the domestic legal instrument instead of assigning a colour or procedural status by guesswork.

Europol's role is fundamentally different. Its secure exchanges, cross-checking and analysis can assist an investigation, but an Europol analytical lead is not an Europol arrest warrant and does not establish an EU-wide judicial obligation to detain. The European Arrest Warrant, when applicable, is a separate judicial cooperation instrument issued and executed by competent national judicial authorities, not a Europol notice. This distinction matters whenever an officer cites “Europe” as the source without identifying the actual instrument.

Europol can also support Member States in processing data supplied to it by third countries or international organisations about persons involved in terrorism or serious crime, and may propose that a Member State consider an “information alert” on a third-country national in the interest of the Union in the Schengen Information System (SIS). Under Article 4(1)(t), the Member State has discretion and, after its own verification and analysis, decides whether to enter the alert; Europol does not itself enter it. An SIS information alert is neither an INTERPOL notice nor an arrest warrant; identify the SIS record and the national decision-maker before choosing a remedy.

Which record caused the problem? Ask four questions before filing anything

1. What happened? Distinguish an arrest, police interview, refused entry, account screening, immigration action, or a mere suggestion that data exist. Each has a different decision maker and sometimes a different deadline.
2. Where is the information? Identify whether the record is in INTERPOL's Information System, Europol's processing environment, a national police database, a border system, or several locations. A reference to either organization does not prove that it currently stores the disputed material.
3. Who supplied it? Preserve the name of the state, investigative office, prosecutor or other provider, the identifiers or reference numbers, and whether the challenged information is copied or derived from analysis. Responsibility for data accuracy can differ from responsibility for an unlawful arrest.
4. Who can change the result? Ask separately who can change an international data entry, who can amend a national record, and which court or administrative body can annul or suspend the local action. No single application necessarily cures all three.

For example, an individual detained at an EU airport may discover that officers refer to an INTERPOL communication. The person may need a prompt national remedy against detention and, in parallel, a CCF request about INTERPOL processing. Conversely, a national officer might be using material analysed by Europol: a Europol data-access request will not substitute for any national criminal-procedure challenge. A national case number, arrest record and written grounds are often more useful for routing the dispute than an unverified online screenshot.

How to request access or correction from INTERPOL in 2026

The CCF receives requests concerning personal data processed in the INTERPOL Information System. It has a Requests Chamber dealing with access, correction and deletion; it does not decide guilt, national arrest legality, asylum, immigration entry or whether extradition must occur. An applicant or authorized representative should explain the requested outcome and supply evidence of identity, authorization where relevant and documents showing why the processing may breach INTERPOL's rules.

The submission channel changed on 26 March 2026. INTERPOL states that new CCF applications must be made through its dedicated secure online portal, with exceptions only where the CCF accepts exceptional circumstances under its operating rules. Older advice to send a new request by email or post is therefore unreliable. The application is free of charge; an initial acknowledgement is not proof that the CCF has accepted the application as admissible.

The CCF’s published procedure says that it generally decides access requests within four months from admissibility and correction or deletion requests within nine months from admissibility. For correction or deletion, the General Secretariat has one month to comment on the CCF’s conclusions; after the decision becomes final, the applicant is notified within one month. These periods do not run from an airport stop or the date of first contact with a lawyer. The CCF may consult the data source before disclosure, so confidentiality restrictions can limit what the applicant learns.

Correction or deletion requires a reasoned challenge to compliance with INTERPOL rules. Relevant grounds can include the nature of the offence, political neutrality under Article 3 of INTERPOL's Constitution, accuracy, proportionality, purpose, the status of the underlying proceedings and protection of fundamental rights. The CCF seeks information from the source and General Secretariat and reaches a decision under its own mandate. It is not required to accept a national defendant's account as a substitute for supporting documents.

A CCF decision is not ordinarily appealable as if it were a national criminal judgment. Under Article 42 of the CCF Statute, revision rests on a newly discovered relevant fact that could have changed the outcome, with an application within six months of discovering that fact. Repeating arguments without new material is not the same remedy. The detailed strategy for notice removal belongs to the separate INTERPOL triage guide; this comparison is about choosing the responsible system.

How to exercise Europol data rights and use the EDPS route

For Europol processing, the starting point is the current consolidated Europol Regulation, not the general assumption that every EU police file is governed by an ordinary consumer GDPR access request. Article 36 permits a person to request access directly from Europol or through the designated authority in an EU Member State of the person's choice. When the national authority receives the request, it refers it to Europol without undue delay and within one month. Article 36(4) requires Europol to respond without undue delay and, for a referred request, at the latest within three months of receipt by Europol from the national authority.

Article 37 provides routes for rectification, erasure or restriction of processing. Article 38 separately allocates responsibility for data quality: it lies with the Member State or Union body that supplied the data, while Europol is responsible for data supplied by third countries or international organisations, directly provided by private parties, retrieved from public sources, or generated by its own analyses. For data supplied by a Member State, Article 37 requires the Member State and Europol to act in collaboration within their respective competences. An analytical conclusion, the original police entry and a later national decision may therefore require different evidence and recipients.

Access can be restricted where necessary and proportionate to protect ongoing inquiries, public or national security or the rights of others under Article 81 of Regulation (EU) 2018/1725. Thus a limited answer does not, by itself, prove either that Europol holds no information or that the processing is lawful. Ask for the legal basis for any communicated restriction, preserve the decision and distinguish lawful non-disclosure from refusal to correct demonstrably inaccurate data.

The EDPS is the independent supervisory route for alleged unlawful processing by Europol. Article 47 of the Europol Regulation permits a data subject to complain to the EDPS. Where Member State data are involved, the EDPS consults or works with the relevant national supervisory authority, each within its remit. The EDPS recommends contacting Europol’s Data Protection Officer first where appropriate; it cannot itself decide a complaint about processing carried out by a national authority. The EDPS can require Europol to comply with access or correction rights and can order measures concerning unlawful processing under Article 43. It does not act as the national judge deciding whether an arrest was justified.

Article 48 provides judicial review of an EDPS decision before the EU Courts according to the applicable EU procedural rules. A complaint, court action and claim for damages are separate routes with different admissibility requirements and potential time limits; the bare mention of the Court of Justice in the Regulation does not mean an applicant may file any claim with any chamber in any form. In a contested case, identify the act to be challenged, the applicant's standing and the EU court with first-instance jurisdiction, commonly the General Court where EU procedural rules so provide. National police records and national judicial acts remain for the remedies supplied by the relevant national law.

Article 37 requires Europol to inform the person in writing, within three months of receiving a rectification or erasure request, whether the data have been rectified, erased or restricted, or whether the request has been refused; a refusal must give reasons and explain the EDPS complaint and judicial-remedy routes. A challenge to an EDPS decision generally has to be brought within two months under Article 263(6) TFEU, counted from publication, notification to the applicant or the date the decision became known, as applicable. A non-contractual damages action against the EU is subject to the five-year limitation in Article 46 of the Statute of the Court of Justice. That Statute contains technical interruption rules; if a prior application to the relevant EU institution is relied on to interrupt limitation, a separate two-month filing rule may apply. Do not assume that an access request or EDPS complaint automatically preserves every other deadline.

Can an EU damages judgment solve the problem?

Regulation (EU) 2016/794 contains specific provisions on liability and compensation, including Articles 49 and 50. In its Grand Chamber judgment of 5 March 2024 in Kočner v Europol (C-755/21 P, ECLI:EU:C:2024:202), the Court of Justice interpreted the version of Article 50(1) applicable to the events in that case. It held that, for unlawful processing carried out in the course of cooperation between Europol and a Member State, the claimant did not also have to prove which participant was responsible in order to seek full compensation under that version’s joint-and-several liability rule. The current Article 50(1), as amended by Regulation (EU) 2022/991, now refers to compensation under Article 65 of Regulation (EU) 2018/1725 and Article 56 of Directive (EU) 2016/680. The amendment entered into force on 28 June 2022. The applicable version must be identified by reference to the processing acts in issue and any relevant transitional rules; Kočner’s interpretation of the former wording should not automatically be carried over to later processing.

Neither Kočner nor current law awards damages merely because Europol or a national police authority mentioned a person. The claimant must establish unlawful processing, actual qualifying damage and a causal link under the applicable legal test. In its order of 12 March 2026 in FL v Eurojust and Europol (C-564/25 P, ECLI:EU:C:2026:208), the Court dismissed the appeal as partly manifestly inadmissible and partly manifestly unfounded, reiterating that actual and certain damage and causation must be proved. The order does not remove the need to identify which version of Article 50 applies to the alleged processing.

The General Court also dismissed damages claims in BW v Europol and Eurojust (T-1180/23) and DG v Europol and Eurojust (T-167/24), judgments of 25 February 2026, on the evidence and legal claims before it. In T-1180/23, it applied the former joint-liability wording to processing before 28 June 2022 because the last alleged act occurred on 24 June 2022; the related appeal C-399/26 P was pending on 28 October 2026. The related appeal in T-167/24, C-274/26 P, was also pending on that date. T-167/24 is a fact-specific first-instance decision, not a final Court of Justice ruling. Kočner’s interpretation of the former wording must not automatically be extended to later processing under amended Article 50. These decisions do not establish that any mention in Europol data creates a right to compensation, set aside a national arrest, compel disclosure of confidential criminal intelligence or create an INTERPOL damages jurisdiction.

The first-stage claim against Europol belongs before the competent EU court; a claim against a Member State belongs before the competent national court, subject to the applicable rules on jurisdiction, liability and procedure. The ultimate allocation of compensation responsibility between Europol and a Member State is a distinct issue under Article 50(2). A court claim requires evidence of the wrong, actual damage, causation, a proper defendant and compliance with procedural limits. A data-access application is a separate route, not a substitute for preserving litigation deadlines.

Where should a person go first? A decision-routing table

What to preserve before making either request

• A precise timeline: date, time, country, airport or authority, and what the officer actually said versus what appears in writing.
• The written national measure: arrest record, refusal decision, warrant reference, detention order, case number and language of the document.
• Identifiers of the data: personal details, reference numbers, originating country, notice or diffusion description, and whether information was publicly displayed or disclosed confidentially.
• Records contradicting the information: court orders, withdrawal or termination decisions, proof of mistaken identity, corrections, or official documents on the underlying proceedings.
• Copies of all requests, portal acknowledgements, admissibility notices, responses and evidence of the date each decision or newly discovered fact came to light.
• Identity and authority documents for any representative, with translations as required by the particular channel.

Do not send an unredacted criminal case file to every institution merely because its name appears in a search result. Determine the addressee and permitted secure channel first. If detention, a hearing or a removal deadline is imminent, address that national emergency independently; the multi-month CCF process and Europol's data procedure are not emergency judicial stays.

Three mistakes that lead to the wrong remedy

First, confusing a data origin with a legal decision. An INTERPOL record may be the occasion for an officer's check, but the coercive power comes from domestic law. A successful correction can improve the data picture without deciding whether a separate domestic warrant remains valid. Equally, an EU data-protection complaint cannot overturn an immigration refusal merely by alleging that Europol contributed intelligence.

Second, assuming one successful deletion reaches every copy. The CCF's authority is limited to INTERPOL-system processing; Europol's supervisory route addresses Europol processing, and national authorities have their own records and duties. Ask for proof that recipients were notified where the legal regime requires it, and verify the status of consequential national records instead of assuming automatic worldwide synchronization.

Third, using the wrong deadline or wrong review body. CCF timeframes generally begin at admissibility, and Article 42 revision turns on discovery of a new relevant fact. Europol's Article 36 response clock has its own trigger. A national appeal deadline may begin much earlier, on service of an arrest or administrative decision. No time limit for a hypothetical national case can safely be supplied without the state, process and actual written decision.

Questions people commonly ask

For the narrower practical questions of checking a possible Red Notice, the role of a National Central Bureau, or defending a national extradition case, use the dedicated guides rather than treating them as one procedure. If you have an official notice or decision and need help identifying its competent forum, you can request a case assessment; this information is not individual legal advice.