A human rights activist is bringing a legal case against Europe’s data protection watchdog for failing to protect her rights after her personal data was “unlawfully” stored and processed by the European policing agency, Europol.
Natalie Gruber, an Austrian campaigner who was targeted by Greek law enforcement after documenting Greece’s treatment of migrants, claims that Europol stored and collected her personal data with no valid legal basis.
She is bringing a case against the European Data Protection Supervisor (EDPS) at the Court of Justice of the European Union, for failing to exercise the minimum due diligence to investigate her claim against Europol.
The activist said that she was forced to shut down an organisation she co-founded to support migrants and to abandon her humanitarian work after being subjected to a campaign of “lawfare” by Greek law enforcement.
According to the complaint, Gruber has also obtained prima facie evidence that the European border agency, Frontex, collected information about her during “debriefing interviews” with failed asylum seekers and shared it unlawfully with Europol.
She is asking the court to overturn a decision by EDPS that found that Europol had acted lawfully by storing and processing her personal data, and is seeking €130,000 in compensation.
Europol and Frontex ‘shielded from scrutiny’
Iftach Cohen, co-director of Front-Lex, a campaign group which is backing Gruber’s case against the EDPS, said that the inability of the data protection regulator to properly perform its role shielded Europol and the European border agency, Frontex, from scrutiny.
“Europol was willing to break EU data protection law and support an evident campaign of lawfare … because of the nature of her humanitarian work. The EDPS has disgracefully shielded Europol and Frontex for the very same reason,” he added.
Gruber, an Austrian citizen, co-founded Josoor International Solidarity in 2016 to support migrants who had been subject to “pushback” operations, in which countries force migrants back across a border without giving them a chance to present their case or claim asylum.
In 2020, she learned that she and other human rights defenders were being investigated by Greece’s anti-terrorism police, secret service and coast guard over allegations of espionage and facilitating the illegal entry of foreigners into Greek territory.
According to Front-Lex, Greek law enforcement agencies made the accusations at a time when they faced growing criticism over their systematic pushbacks of migrants from Greece to Turkey, which were being monitored and recorded by Gruber and other activists.
Europol processed and stored Gruber’s personal data both during the Greek investigation and long after it had ended, and linked Gruber to the alleged crime of “aiming at forcing the competent border authorities to rescue the migrants”, according to the complaint.
The data collected by Europol included Gruber’s date of birth, her address in Austria, the fact that she lacked of criminal record in Austria and her role as president of Josoor. She was described as a “contact” linked to “illegal immigration and other organised crime”.
Europol disclosed that it had processed the data in relation to a preliminary inquiry into alleged offences including forming and joining a criminal organisation, espionage, violation of state secrets and facilitation of illegal immigration.
No legal basis
According to the complaint, Europol had no legal basis to process Gruber’s data when it manifestly related to non-criminal activity.
It argues that a member state cannot make processing of data lawful by labelling it “organised crime” when the underlying conduct was documenting human rights violations and calling on authorities to fulfil their legal duties.
Gruber complained to the European Data Protection Supervisor in 2022, challenging Europol’s processing of her personal data and its failure to disclose her data under subject access request.
By the time the charges against her were formally dropped in February 2024, the EDPS had still not “diligently investigated” her complaint or issued a decision and Europol continued to process her data. It took the EDPS a further 13 months to notify Europol that Gruber was no longer facing charges, after she alerted the regulator.
The EDPS issued a decision to reject Gruber’s complaint more than three and a half years after she filed it, without issuing the minimum due diligence required to protect her rights as a data subject, the complaint alleged.
Gruber also alleged that there were concrete reasons to suspect that her personal data may have been processed in “parallel IT systems” at Europol – revealed in an investigation by Computer Weekly, Correctiv and Solomon – that failed to meet security and data protection standards.
Cohen said that Gruber was targeted with a campaign of “lawfare” for assisting refugees and migrants, adding that Europol continued processing Gruber’s personal data for 18 months after the Greek investigation had found no evidence of any crime.
“It stopped only after the EDPS passed on the information Natalie [Gruber] herself had provided about her acquittal – but the EDPS had sat on that information for a full year before forwarding it to Europol. During that year, [Gruber] was left believing that there must be another criminal investigation underway against her somewhere in Europe,” he added.
