Europol silences critics with expensive private law firm

This year,  Europol has faced a surge in individual complaints, according to data from the European Data Protection Supervisor (‘EDPS’). Yet, they have so far prevented most individuals from taking their cases to court. New data revealed by Statewatch indicates that the high costs of legal action may be the reason.

Accountability at too high a cost

Özlem Demirel, German Member of the European Parliament for the Left, asked three questions to Europol in March of this year:

• the number of cases against the agency heard by the Court of Justice of the European Union in 2023, 2024 and 2025;
• the total cost for the external representation hired by the agency; and
• the countries the law firms are from.

Europol responded on 27 July.

The results reveal dramatic differences in how Europol responds to different types of cases brought against the agency. These are either staff complaints or individual claims alleging that the agency violated EU law in carrying out its mandate.

Of the 18 cases brought against the agency in 2025, only four (22%) involved individual claims relating to Europol’s mandate. And yet, those cases accounted for 75.5% of the agency’s total litigation expenditure. On average, each mandate case cost approximately €36,503, 10.8 times higher than €3,379 for each staff case.

Europol also revealed that it contracts external lawyers in Belgium and Germany. All staff-related cases have been dealt with by internal Europol lawyers as well as, in some cases, Belgium-based law firms. Statewatch contacted the lawyers representing other complainants who filed a case against Europol in 2025, who revealed that the law firm working with Europol in the mandate case is based in Germany.

When a complainant loses a case against the agency, they are liable for all legal costs. The data obtained by Özlem Demirel shows that the amount is ten times greater if the person is neither a current nor a former staff member.

The agency has no legal obligation to choose external representation. Europol’s choice to do so, however, seems to be a successful means of silencing external criticism, as few can afford to take on the high financial risk.

A well-tested dissuasion method to silence critics

In most cases brought against Europol, the EU Court has ruled in favour of the agency and ordered the individual to pay all legal costs.  In the rules of procedure of the Court of Justice, recoverable costs are defined as the expenses incurred during a proceeding (Article 144).

Nothing prevents Europol from hiring expensive lawyers and letting the opposing party pay the bill. If it loses the case, European taxpayers cover the costs. The Court can step in and oppose “unreasonable cost” (Article 139), yet it has not done so thus far. This has been true even in cases where it hired an external law firm, rather than using its own legal staff, to handle the litigation.

This creates a significant risk for activists seeking to have their cases heard and investigated by a court. The tactic effectively silences critics by making legal fees unaffordable.

In a pending case from last year against Europol, a Dutch political activist is seeking compensation for the unlawful processing and handling of his personal data.

The activist, Frank van der Linde, spoke to Statewatch about Europol’s dissuasion tactics:

“After finding out that Europol hired this very expensive law firm, which also checked out everything I posted on social media over the last few years, I thought about dropping the case. Europol frightens me more and more. It’s pure intimidation, and it almost worked.”

Another EU agency, Frontex, applies a similar tactic. It has evaded legal accountability for 20 years despite evidence that it has repeatedly violated EU laws at the border. In 2020, Frontex sued transparency activists for €23,701 over legal costs incurred by the agency. The billion-euro agency explained that the cost stemmed from hiring a private lawyer to handle the litigation. This is despite Frontex already having a well-resourced legal team at its disposal.

Data-breach complaints surged in 2025, amid accusations that Europol has been bypassing laws. The EDPS annual report indicates that the supervisory authority exercised its supervisory powers 15 times out of 23 in 2025. Sixty-five per cent of the measures taken by the EDPS out of the seven EU institutions it supervises concerned Europol last year. According to the supervisor, it reflects the agency’s extensive mandate, operational complexity, and high-risk data processing. But it is also likely linked to journalists calling out the agency for trying to bypass the law in its surveillance program.

Since 2023, in 11 cases brought by individuals accusing Europol of violating its mandate and EU law, only one has been considered admissible. This amounts to a 9% chance that a judge will hear the case. Iftach Cohen, co-director of Front-LEX, an NGO that brought five legal actions in the last five years against Frontex to the CJEU, said:

“Unlike Europol, statistics don’t lie: the zero-success rate across dozens of legal actions brought against the agency before the CJEU strongly suggests that, much like with Frontex, the competent court is shielding Europol while failing to provide its victims with effective judicial review.”

He concluded by saying that Front-LEX is “determined to change that.” In July, the NGO filed a legal complaint to ensure Europol complies with EU law in its surveillance program.