The European Commission’s late-June proposal to overhaul Europol and Eurojust is being sold as a long-overdue answer to organised crime that has gone digital, international and ruthless. It is also a quiet but significant shift in where power sits between Brussels, national capitals and the citizen, and that is the part worth examining closely.
The package is substantial. Two regulations would expand the mandates of the bloc’s police and judicial cooperation agencies, a revised European Investigation Order would speed cross-border evidence gathering, and amendments to data protection rules for EU bodies would adjust how information moves through the system. Europol would gain faster, more automated information sharing and new Support Offices embedding its officers alongside national police. Its budget is slated to roughly double to 3 billion euros under the 2028 to 2034 financial framework, with staffing rising in step. Eurojust, for its part, would act on its own initiative to link cases and move into cybercrime, breaches of sanctions and gender-based violence.
The case for all this is genuine and should not be waved away. Criminal networks do not respect borders, encrypted communications outpace national forces, and fragmented cooperation between member states has long been the weak seam that smugglers and fraudsters exploit. An agency that can connect a fraud in one country to a trafficking ring in another, in something closer to real time, plainly serves the public. The label attached to the wider strategy, ProtectEU, captures the political logic: security has become the currency in which voters now judge the Union.
Yet doubling a police agency’s budget and broadening its reach raises a question the proposal answers less confidently than it poses it. The more data Europol pools and the more independently Eurojust acts, the heavier the burden on the institutions meant to check them. Europol is not a force with its own powers of arrest; it supports national authorities. But the distinction blurs as it gains the capacity to gather, hold and analyse ever larger quantities of personal data, including on people never charged with anything. That the package amends data protection rules for EU bodies should focus minds rather than reassure them, because the direction of such amendments is rarely toward tighter restraint.
Oversight in this corner of the Union has always lagged behind capability. The European Parliament and a joint parliamentary scrutiny group monitor Europol, and the European Data Protection Supervisor polices its handling of information, but both have repeatedly flagged that resources and access have not kept pace with the agency’s growth. If Europol nearly doubles in size while the bodies watching it stay roughly the same, the imbalance widens rather than closes. The lesson of past expansions is that powers granted in a moment of urgency are seldom handed back, and that scrutiny mechanisms built for a smaller agency strain to cover a larger one.
There is a credible rebuttal. Supporters argue that stronger agencies are precisely what allow democratic states to fight crime without resorting to the emergency measures and national carve-outs that erode rights far more sharply. A well-resourced, rules-bound Europol, on this view, is a safeguard against worse, and the data protection amendments may tighten as much as they loosen once the detail is known. The proposal is, after all, only a starting point; the Parliament and Council will spend months reshaping it.
That legislative journey is where the real test lies. Lawmakers should treat the security argument as valid and the oversight question as non-negotiable, funding the watchdogs in proportion to the powers they must watch. The measure of this reform will not be how much stronger Europe’s crime-fighters become, but whether the institutions holding them to account grow with them. Strength without scrutiny is not security; it is merely power waiting for a use no one approved.
