Article page checkbox is not checked in page info.
The revision of the Eurojust Regulation: Implementation takeaways
The revision of the Eurojust Regulation: Implementation takeaways
Marie-Astrid Huemer with Matteo Ricotta, Ex-Post Evaluation Unit
Key findings
Eurojust has proven instrumental in enhancing judicial cooperation in criminal matters. Improvements are needed though, as evidenced by the Commission's evaluation and its supporting study. The role and functions of Eurojust governing bodies need to be clarified. Further harmonisation and clarification of applicable regulations at EU and national level may help overcome remaining challenges, such as the clarification of competences between governing bodies. Rules to prioritise cases are also considered necessary to facilitate operational activities. However, regarding technological challenges, legal revision can only provide a partial solution unless specific provisions allow for anticipating and easily adapting to technological developments. Finally, strengthening the operational support and mechanisms for cooperation and coordination between Member States implies financial and human resources.
Purpose statement (this title will not be shown in the final layouts)
This briefing is one in a series of implementation appraisals produced by the European Parliamentary Research Service (EPRS) on the operation of existing EU legislation in practice. Each briefing focuses on a specific EU law that is announced to be amended or reviewed in the European Commission's annual work programme. Implementation appraisals aim at providing a succinct overview of publicly available material on the implementation, application and effectiveness to date of that specific EU law, drawing on input from EU institutions and bodies, as well as external organisations.
Background and existing EU policy framework
The need for better cooperation and coordination in criminal justice was recognised in the 1990s with the adoption of Council Decision 2002/187/JHA setting up Eurojust. Eurojust's tasks were to enhance judicial cooperation in criminal matters and enable investigations and prosecutions among national competent authorities, with the aim of fighting organised crime effectively. In 2015, the evaluation of the Council Decision highlighted weaknesses, including in the governance structure of Eurojust. In November 2018, Regulation (EU) 2018/1727 of the European Parliament and of the Council on the EU Agency for criminal justice cooperation (Eurojust) repealed and replaced Council Decision 2002/187/JHA. Eurojust became a fully fledged European agency.
The 2018 Regulation (hereinafter EJR) aimed to strengthen operational capacity and increase information exchange between Eurojust and EU Member States and introduced the necessary reforms in response to the evaluation. Until 2018, the main governing body, the College, composed of one representative per Member State, cumulated operational, managerial, administrative, strategic and policy competences, resulting in blurred and inefficient decision-making processes. The EJR changed the governance structure; an Executive Board (EB), assisted by an Administrative Director, was set up to take over administrative tasks from the College.
The EJR reiterated the core operational functions of Eurojust (Article 4). Regarding Member States, Eurojust shares information with national competent authorities that might have repercussions at EU level or that might affect Member States other than those directly concerned. Eurojust also provides assistance for coordination and cooperation among Member States regarding criminal investigations and prosecutions of interest to at least two Member States (Article 2). It provides operational, financial and technical support to cross-border cooperation and investigations as well, through the setting up of joint investigation teams (JITs), coordination meetings (CMs) or coordination centres (CCs). Member States must appoint their representative (Article 7) as National Members, and must set up a national coordination system (NCS) to facilitate the carrying out of Eurojust's tasks within the Member State (Article 20(7)). In addition, Member States must cooperate among themselves (Article 21) and respond to Eurojust demands (Article 4(6)). The main difference introduced by the EJR is the competence for Eurojust to carry out tasks on its own initiative (Article 2(3)). Consequently, Eurojust can open cases on its own using information received by Member States, EU institutions, or third countries, or collected by Eurojust itself.
Regarding EU institutions, bodies, offices and agencies (Article 47) and networks (Article 48), Eurojust is a 'natural hub' providing assistance to several networks including the European Judicial Network (EJN), the European Judicial Cybercrime Network (EJCN), the Joint Investigation Teams Network (JITs) and the Genocide Prosecution Network. The Agency also cooperates with other EU agencies such as Europol and the EPPO.1
Regarding cooperation with third countries, Eurojust provides support in various forms, including the designation of contact points in third countries (Article 52(3)), the possibility for liaison magistrates to be posted in third countries (Article 53), and the coordination of the execution of requests for judicial cooperation to and from third countries (Article 54). Cooperation may be formalised through working agreements or working arrangements,2 cooperation agreements,3 or simple memoranda of understanding. Eurojust cooperates with international organisations too (Article 52).
The role of Eurojust is multifaceted, and the Agency also has other activities that are more of a strategic and policy nature. It builds up expert knowledge through specialised working groups on specific crimes or projects.4
To adapt to the new EU legal framework on data protection, and ensure its strict implementation, the EJR introduced a new data protection regime (Article 26 and following).
As a result of the Russian war of aggression against Ukraine, Regulation (EU) 2022/838 of the European Parliament and of the Council of 30 May 2022 amended the EJR as regards the preservation, analysis and storage at Eurojust of evidence relating to genocide, crimes against humanity, war crimes and related criminal offences. The Agency has become the host of a database to preserve, store and analyse evidence of core international crimes (CICED) in order to ensure the safe transmission and secure storage of evidence. In July 2023, the International Centre for the Prosecution of the Crime of Aggression against Ukraine (ICPA) started its operations enabling Prosecutors to work together in the same location and benefit from the expertise and logistical support from the Agency.
European Commission reports, studies and consultations in preparation of the revision
Commission evaluation
On 2 July 2025 the European Commission published its evaluation of Eurojust. The evaluation was done in compliance with Article 69(1) of the EJR that envisages an evaluation of the implementation and impact of this Regulation, and the effectiveness and efficiency of Eurojust and its working practices every five years. The evaluation drew upon a support study covering the period from 12 December 2019 to 1 May 2024 and carried out in line with the Commission's Better Regulation criteria of effectiveness, efficiency, relevance, coherence, and EU added value.
The specific objectives of the 2018 revision of the Regulation were to streamline the structure and governance of the Agency in order to improve the decision-making process, to enhance accountability of decision-makers within Eurojust and reduce the administrative burden on College members. The revision also aimed to align Eurojust with the EU's common approach on decentralised agencies, and with the EU revised data protection regime.
The conclusions of the evaluation regarding the effectiveness of the EJR in those respects are mixed and concern the following issues:
First, the College and the EB do not have clearly delineated competences and the College regularly carries out administrative and managerial functions instead of focusing on operational case work. As a result, decisions taken by the College and the EB, respectively, run the risk of overlapping and the decision-making process is slow and cumbersome.5 The evaluation highlights that the judicial background of the College's National Members (Article 7(4)) is neither a guarantee of their managerial skills nor a guarantee of their independence from national priorities. On the one hand, National Members represent their country; on the other, they are taking strategic, operational and administrative decisions for an EU agency. This creates risks of conflict of interest, since College Members take managerial decisions that affect them directly. The composition of the EB raises questions too: it is composed of the President and Vice-Presidents of Eurojust, one representative of the Commission and two other members of the College designated on a two-year rotation system (Article 16(4)), as a result of which skills and commitment may vary greatly.6
Second, regarding the objectives to strengthen the operational capacity of the Agency and increase information exchange between Eurojust and the Member States, the evaluation concludes more positively, despite remaining challenges caused by a lack of clarity in the Regulation,7 by different practices in Member States, and by specific technological weaknesses, including IT and digital tools, and an outdated case management system that is seen as a repository of information without the necessary analytical tools.
Third, effective access to data, which is key for law enforcement and judicial cooperation, is not automatic. The evaluation observes that data remain under the ownership of the Member States, which hampers the Agency's ability to act on its own initiative. As a result, difficulties for operational activities persist: data-sharing might take a long time and be complex, and national authorities have to be consulted for each case and sometimes have to explicitly consent to data exchange. The evaluation observes that effective access to data not only depends on the EJR implementation, but also on a myriad of legal requirements,8 on harmonisation across Member States and on the delicate balance between data protection requirements and the need to access and use such data for criminal judicial cooperation.9 Technological resources constitute a challenge as well: for instance, the data volume can be overwhelming for investigators and lead to higher processing times and storage capacity issues.10
Fourth, regarding cooperation and information exchange with other EU institutions, bodies, offices and agencies, some provisions of the EJR are found to be unclear, which may explain part of the remaining challenges. Indeed, although cooperation with the European Judicial Network (EJN) is considered positive, the allocation of cases between Eurojust and the EJN is not specified, and depends ultimately on Member States' authorities. Another key challenge for cooperation lies with the Member States' data ownership that ultimately prevents Eurojust from ensuring prompt data sharing, as already mentioned.11 Cooperation and coordination with third countries has improved, but the impact depends on whether some form of agreement was signed between them and Eurojust. However, the Regulation does not clearly define the competence and status of liaison prosecutors seconded to Eurojust by third countries, which could result in inconsistencies between third countries.
Fifth, regarding the operational support to Member States in the investigation and prosecution of serious cross-border crimes, conclusions are positive. The Agency is instrumental in facilitating exchange of information, cooperation, coordination and development of joint actions between Member States. There are various mechanisms: (1) coordination meetings (CM) allow investigating and prosecuting authorities to meet and get to know their counterparts, bringing them together from the start to coordinate parallel proceedings and resolve practical difficulties; (2) coordination centres (CCs) enable the coordination of parallel national actions, such as searches, victim interviews and suspect arrests; (3) joint investigation teams (JITs) allow fast exchange of information, evidence and coordination between parties. The JITs are especially successful for operational support in case of complex cross-border crimes. The number of cases dealt with by the Agency keeps on growing, suggesting that the Agency's work has been a success (see Table 1).12 However, the distinction between complex and simple crimes would facilitate prioritisation, notably between Eurojust and the EJN, making the operational support more effective.
| Case types | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 |
|---|---|---|---|---|---|---|---|
| Ongoing from previous years | 3 892 | 4 200 | 4 808 | 5 227 | 5 710 | 7 609 | 8 364 |
| New cases | 3 912 | 4 599 | 5 297 | 6 317 | 7 454 | 5 363 | 5 582 |
| Total | 7 804 | 8 799 | 10 105 | 11 544 | 13 164 | 12 972 | 13 946 |
| Closed cases | 3 604 | 3 991 | 4 878 | 5 834 | N/A | N/A | N/A |
| Share of closed cases out of total cases | 46.2 % | 45.4 % | 48.3 % | 50.5 % | N/A | N/A | N/A |
Data source: Eurojust Consolidated Annual Activity Report 2019-2023 and Eurojust 2025 Annual Report.
Sixth, the evaluation notes that Eurojust expertise and policy support adds value in some of its activities which are more of a strategic and policy nature. However, some tools remain under-used or are not used at all, with discrepancies between national systems. This is the case, for example, for the Eurojust National Coordination Systems (ENCS), envisaged for the coordination at national level of the work carried out with the support of Eurojust. The On-Call Coordination (OCC) system is hardly used and consequently ineffective. Problems resulting from the difficult exchange of data between the Agency and the national authorities (Article 21) prevent the Agency from having a comprehensive view of challenges and key recurring issues.
Regarding efficiency, the annual 10 % average growth in the Agency's budget corresponds to an increasing number of staff, especially for operational tasks, and an increasing workload. The multiplication of operational activities has significantly and positively impacted the effective implementation of judicial cooperation across borders. Although it is difficult to monetise benefits from Eurojust's activities, indicators exist such as the amount of seized and confiscated assets resulting from JITs. For instance, in 2023 drugs were seized for a value of up to €26 billion, against €7 billion in 2021.
Despite positive outcomes, the evaluation points to inefficient use of resources, as evidenced by structural, operational and technological weaknesses. As mentioned above, the unclear distribution of tasks between the Agency and the EJN and competences between internal governing bodies affect negatively the decision-making processes. It also affects the prioritisation of tasks, prevents National Members from focusing on their core operational activities and causes overlap which is not cost-efficient. Despite the introduction and use of new digital tools to support the administrative and financial management of the Agency, the case management system remains outdated and the interoperability with other agencies is insufficient.
Regarding coherence, the evaluation concludes that there is coherence, broadly, between the legal basis, the mandate and the objectives of Eurojust and other EU institutions, bodies, offices and agencies, as well as with EU policies and legislation in the area of criminal justice and judicial cooperation on criminal matters.13 Eurojust's operational activities are conducted in synergy with EU institutions, bodies, offices and agencies, despite a small number of practical concerns. This relates to cooperation with Europol in particular: Europol's Task Forces (OTF) are perceived as replicating the JITs, and the information sharing between both agencies is challenging, including difficulties in accessing each other's information systems and conflicts with the data ownership principle. This highlights the need for stronger cooperation between both agencies. There are also indications that cooperation with the EPPO may diminish as a result of the EPPO developing its own tools and networks. Regarding the Agency's work with international organisations and third countries, the evaluation found it coherent as well, with the pursuit of similar objectives, and the development of synergies in enhancing coordination and cooperation.
The evaluation finds that Member States could not cooperate on judicial criminal matters across borders with the same impact if it was not with Eurojust. The EU added value of the Agency is linked to the nature and complexity of cross-border crimes. The enhanced cooperation and coordination make a significant difference from past practices. Thanks to existing obligations stemming from the EJR and the cooperation and coordination tools, judicial and prosecution authorities were able to develop effective actions. Furthermore, despite shortcomings, the structure of the Agency and the College provide a space where magistrates may develop mutual trust and strengthen common knowledge to feed a culture of cooperation. Budget and logistical support are instrumental. Likewise, the EU added value is visible with regard to judicial cooperation with third countries, in particular with liaison prosecutors embedded in the Agency.
Findings from the evaluation conclude that there is a quasi consensus among National Members and practitioners on the relevance of Eurojust in core operational activities, in helping to identify and coordinate with competent judicial authorities, and providing practical and logistical support. This conclusion is shared by third countries' representatives. Other Eurojust activities, such as guidance documents and network hosting, are deemed to be less relevant and are not considered to be instrumental for operational activities; according to some National Members and staff, they might divert some resources. Activities related to the Russian war of aggression against Ukraine are not questioned but have raised concerns over the possible impact on the perceived independence of the Agency. The relevance of the Agency's core activities is not questioned, but a technological upgrade is deemed to be a priority to reinforce its impact.
Stakeholder consultations ahead of the revision
On 28 October 2025, the European Commission published its call for evidence for an impact assessment to ensure that the decision on a revision of the Eurojust Regulation will be based on factual evidence and that the public and stakeholders will be informed about the upcoming revision of the EJR. It stressed four problems to tackle: (a) the scope of the Agency's own-initiative tasks; (b) the lack of effective cooperation with institutions, bodies, offices and agencies due to insufficient and inconsistent rules on cooperation and data; (c) the insufficient cooperation with third countries; and (d) the complex governance structure, and the need to clarify competences and simplify procedures.
Feedback was open between 28 October and 3 December 2025. There were 42 responses, more than half (22) from Ministries of Justice (MoJs) and public prosecution offices (PPOs). A surprisingly high number of responses addressed the role of the EJN in relation to Eurojust. The vast majority of MoJs and PPOs insisted on the added value of keeping EJN and Eurojust distinct from each other, both exercising complementary functions. Respondents highlighted the benefits of an autonomous, agile and practitioner-driven network, which would handle daily requests for judicial assistance and simple cases, while multilateral cases involving operational support would remain under Eurojust's responsibility.14 'Eurojust stands for coordination and EJN for cooperation', according to the Swedish EJN national correspondent.
As regards the scope of Eurojust's own-initiative capacities, some respondents consider that Eurojust should remain a coordinating body, while the power to initiate criminal proceedings should remain the responsibility of national authorities.15
A few respondents also mentioned the need for enhanced cooperation with third countries.16
A public consultation was held between 2 December 2025 and 24 February 2026; only statistics from this consultation are available. Public authorities (eight among 20) were the main respondents, followed by EU citizens (four) and businesses (three). The summary report of those public consultations is not available and there are no further details on the outcome. However, relevant stakeholders were also consulted through targeted consultations to feed into the support study to the Commission's evaluation.17
European Parliament position and oversight activities
Parliament position
Parliament scrutinises the implementation of EU agencies' regulations through its discharge decisions. On 29 April 2026, in its discharge decision in respect of the implementation of the EU Agencies budget for 2024, Parliament called for an increase in Eurojust's staffing levels in light of 'its foreseen enhanced mandate to include third countries' and the increasing annual number of criminal cases the agency has to tackle. According to Parliament, it is necessary to ensure comprehensive case coverage and the uninterrupted continuity of Eurojust operations. Parliament called for corresponding funding to be made available.
On core activities, Parliament highlighted the complementarity between Europol's OTFs and Eurojust JITs, exemplified by the dismantling of a criminal encrypted communication platform (Matrix). The OTF involving Member States facilitated intelligence-sharing and monitoring of criminal activity, while the transition to a Eurojust JIT allowed for the coordination of the formal investigation.This resulted in arrests, seizures, and the decryption of 2.3 million messages in 33 languages. According to Parliament, this case underscores the effectiveness of cross-border cooperation in disrupting illicit networks and the need for sustained investment in law enforcement capabilities to address evolving criminal tactics.
Parliament called on the Commission to ensure that cooperation agreements, operational frameworks and data- sharing agreements between Eurojust and third countries include enforceable safeguards and monitoring mechanisms together with clear reporting obligations to the discharge authority.
Selection of parliamentary questions
During Parliament's tenth legislative term, Members of the European Parliament (MEPs) submitted four written questions relevant to the revision of the EJR.
In February 2025, José Cepeda (S&D, Spain) raised the issue of strengthening judicial cooperation in the fight against cybercrime. The Commission referred to ongoing efforts in this area, notably steps to enhance support for Europol and Eurojust. Similar concerns were expressed in July 2025 by Dan-Ştefan Motreanu (EPP, Romania), who emphasised the need to reinforce EU agencies' investigative capacities, improve access to cross-border data, and enhance their legal autonomy from Member States. In its reply, the Commission highlighted its commitment to strengthening these capacities, including through a thorough evaluation of Eurojust and a planned revision to enhance its effectiveness. It also pointed to its roadmap on lawful and effective access to data for law enforcement, as well as to the implementation of the e-evidence system to support the secure exchange of digital evidence.
In October 2025, French PfE MEPs (Griset, Rougé, Deloge, Piera and Joron), raised the possibility of developing a parental control artificial intelligence (AI) model for the protection of minors, based on data from Europol and Eurojust. The Commission replied that EU agencies are bound by their mandates and strict data protection rules regarding the use and sharing of operational data, so that such an approach could not be considered. In November 2025, Mariusz Kamiński (ECR, Poland) submitted a question on possible cooperation between the Commission, Member States, Europol and Eurojust in addressing the use of the messaging application Telegram by criminal actors. The Commission clarified that it does not take part in specific criminal investigations and that it cooperates with Eurojust and Europol to support judicial and law enforcement cooperation.
Petitions and citizens' enquiries
In petition No 1750/2025 by T. T. (Polish) on personal data management by Eurojust, the petitioner was previously subject to a European Arrest Warrant and Interpol Red Notice before being granted international protection. Despite both procedures being closed, the petitioner expressed his concerns over the processing and management of his personal data, in fear that Eurojust retains or uses them. The petitioner warned against misuse, misinterpretation and risks for his safety and freedom and insisted on respect for the EU Charter of Fundamental Rights (the Charter) and the data protection rules.
The petitioner requested from the Commission an assessment of compliance of Eurojust's 'post-closure data processing' with the Charter and relevant EU regulations together with an explanation of 'how human-rights defender status is operationalised as a protective factor'. Considering the AI Act, the petitioner requests that any searches touching upon refugee/human rights defender data are designed with risk controls before being reused or disseminated.
The petitioner called on Parliament to ask Eurojust for a complete report on the legal framework for any ongoing processing, and explanations on data processing. In addition, the petitioner is asking for the European Data Protection Supervisor to clarify the scope of its supervision and indicate whether corrective measures are needed.
The petitioner requests, from the EU Agency for Fundamental Rights, input on safeguards for handling data relating to refugees and human-rights defenders in cross-border judicial cooperation systems.
The case is still open and available to supporters.
Views of the Council of the EU
Throughout Justice and Home Affairs Council meetings , the Council of the EU has clarified its position, in particular in relation to third countries. On 18 June 2024, in conclusions on strengthening judicial cooperation with third countries in the fight against organised crime, the Council highlighted the need to support this effort and proposed a toolkit comprised of exchanges of experience and best practices between Member States' experts, an increased number of secondments of liaison prosecutors from third countries to Eurojust and the promotion of accession by priority third countries to Council of Europe conventions to facilitate the conclusion of cooperation agreements.
In its conclusions of 26 June 2025, the Council linked the EU's internal security with further action from EU institutions and Member States, which are required to strengthen law enforcement and judicial cooperation, especially by ensuring effective access to data for law enforcement purposes, by information exchange and through cooperation with third countries.
On 13 October 2025, during the Justice and Home Affairs Council meeting regarding the future of Eurojust and improvement for supporting competent authorities, two points were stressed: the need for the Agency to be given means for its operational support to investigations, and the role that the Agency can play in improving judicial cooperation between the EU and third countries.
Some competent national authorities have expressed opposing positions during consultations held in support of the European Commission's evaluation.18
With regard to national sovereignty or reinforced EU powers, some Member States are reluctant to expand Eurojust's mandate; they consider that judicial powers fall under the exclusive jurisdiction of Member States, whereas Eurojust is only competent for operational support. Some are eager to reinforce the Agency's own-initiative power and consider that this is necessary to enhance criminal justice cooperation.
Concerning implementation of data protection rules and transfer of operational personal data, Member States give priority either to security or to privacy; some are reluctant to have Eurojust dealing with this, and some consider that this is within Europol's mandate.
On cooperation with third countries and international courts, there were concerns over the risk of external influence on EU Member States' systems from the expansion of liaison prosecutors and broader evidence exchange with third countries. However, recently Member States have expressed unanimous support for cooperation with third countries and international bodies.
Judgments of the Court of Justice of the European Union
The European Court of Justice (ECJ) has clarified the status and role of Eurojust in decisions concerning data driven investigations conducted with the support of Eurojust.19 Two major cases – concerning the encrypted communication network EncroChat and the messaging application Sky ECC – illustrate the complexity and the implications of such investigations or judicial cooperation on criminal matters under Eurojust's remit.20 On the one side, there is the legitimate need to fight against organised crime that uses state of the art encrypted technology; on the other side, there are legal implications from a human rights perspective.21
For a few years, law enforcement authorities have investigated and conducted operations involving bulk collection of data using encrypted technologies. In the Sky ECC case, Eurojust's role and liability were put into question. Sky ECC was a subscription-based messaging application using cryptophones, and was investigated from 2019 to 2021. On 13 December 2019, France, the Netherlands and Belgium concluded a JIT agreement in which they agreed to share intercepted data among themselves and to analyse the data in support of ongoing investigations or to launch new ones. Data decryption and analysis was possible due to techniques developed by the Dutch law enforcement authorities, which they shared with their partners. The bulk collection of one billion messages highlighted the need for sophisticated technology for data analysis. Sky ECC operations resulted in hundreds of arrests, investigations and convictions across countries.22
In BW v EUROPOL and Eurojust , claiming a breach of his right to privacy to demand the annulment of the JIT agreement, the defendant argued that Eurojust, together with Europol, was involved in unlawful operations against Sky ECC Global and that the Agencies had to be held liable because of the subsequent use of the data obtained (in the case of Eurojust, because of the transfer of the claimants' personal data). The claimant sought compensation for detention, reputational harm and legal costs.
In its ruling on 26 February 2026, the General Court made a distinction between the coordinating role of EU agencies and Member States' responsibility for subsequent law enforcement and judicial acts such as arrests, prosecutions and seizures. The Court found that EU Agencies cannot be considered as the guarantor of Member States' proceedings. The Court dismissed the demand for annulment of the JIT's agreement, considering that the agreement was concluded between Member States, and not by the Agency. The Court found that JITs' agreements are not an EU act and, as such, are not subject to the Court's jurisdiction.23
In the case of CV v EUROPOL and Eurojust (Encrochat) T-148/24, dealing with the exploitation of data from mobile phones equipped with special software that allowed end-to-end encrypted communication (operating under the 'EncroChat' licence), the Court clarified the extent of Eurojust's responsibility. The Court acknowledged that Eurojust can be held liable for damages caused to an individual as a result of unauthorised or incorrect data processing 'for which it is responsible'. However, according to the Court, 'the mere fact that Eurojust organised coordination meetings between the parties to the JIT does not allow to infer that it collected, received, stored, transmitted or analysed the applicant's personal data and, on any of these occasions, carried out unauthorized or incorrect processing of such personal data'. In fact, this was not demonstrated by the applicant. The only data processing operations that Eurojust had carried out in this case concerned the facilitation of mutual legal assistance requests.
These two cases highlight challenges faced by the Agency when it has to process and transfer data. This shows that, if Eurojust's own-initiative capacity were to be extended, data processing would have to be entrenched in clear and foreseeable rules and safeguards in compliance with data protection rules.
Views of the European Data Protection Supervisor (EDPS)
The EDPS is vested with specific powers to supervise the way EU institutions, bodies, offices and agencies process personal and operational personal data in accordance with Regulation (EU) 2018/1725. This regulation establishes the rules on the protection of natural persons with regard to the processing of personal data by EU institutions, bodies, offices and agencies, ensuring individuals' privacy rights and responsible governance. In addition, the Eurojust Regulation contains specific provisions and principles derived from Article 8 of the EU Charter of Fundamental Rights. The EDPS dedicates particular attention to the implementation of data protection rules in the area of freedom, security and justice by the relevant agencies, including Eurojust. In its annual reports, it underlines the sensitivity of personal data processing for such purposes and the fragmented legal and operational framework governing police and judicial cooperation and border management.
As presented in its 2024 annual report, the EDPS has, in particular, followed the development of the EUROJUST Core International Crimes Evidence Database (CICED).24 Throughout the years, supervisory opinions on CICED were delivered to ensure its compliance with data protection rules: one on the secure transmission of evidence to Eurojust (opinion 2022), one on the secure storage of the transmitted evidence (2023), one on the analysis of structured data (2023), and one on the use of automated translation tools (2024).25 In 2025, another opinion was issued regarding the introduction of an optical character recognition tool and new arrangements for sharing CICED data with internal stakeholders, national authorities and Europol. The EDPS issued recommendations aimed at mitigating the risks stemming from these new processing operations.
Another topic supervised by the EDPS concerns data transfer. In the 2024 annual report, the EDPS indicated that it was consulted on Joint Investigation Team agreements as a tool for transferring operational personal data to non-EU/EEA countries. The report concludes that 'the proposed data protection clauses of the JIT agreement did not meet the threshold of an international agreement under the Eurojust Regulation. A case-by-case assessment is thus necessary to determine whether the proposed clauses would provide appropriate safeguards for a specific transfer to a non-EU/EEA country.' Although the EDPS noted positively the incorporation of essential data protection elements in the model JIT agreement,26 it highlighted the need for particular attention to be paid to data protection rules when they relate to JITs with third countries. This is also reflected in opinions delivered on proposed agreements between the EU and third countries regarding the cooperation between Eurojust and these countries' authorities.27
The EDPS also exercises its supervisory power over Eurojust in light of the use of AI tools, as was the case for machine translation of evidence in CICED. The opinion provided a number of recommendations to ensure that the risks are properly and sufficiently identified, and, by extension, that appropriate measures are envisaged and applicable.