Why did an Austrian activist take the EDPS to court?
Natalie Gruber, co-founder of Josoor International Solidarity, documented alleged pushbacks of migrants at the Greek-Turkish border. Greek authorities opened an investigation into her and other activists on charges including espionage and facilitation of illegal entry. The case was dropped in February 2024. Gruber claims Europol continued to hold and process her data for months after the investigation closed. She argues the agency lacked any legal basis because the underlying activity involved human-rights monitoring, not criminal conduct. The activist says she was forced to close the organisation she co-founded and abandon her humanitarian work after facing a campaign of legal pursuit by Greek law-enforcement agencies. She maintains that helping migrants and recording rights violations cannot lawfully be treated as criminal activity justifying Europol data retention. The complaint emphasises that the Greek investigation itself was opened during a period of rising international criticism of systematic pushbacks, which Gruber and fellow activists had recorded and publicised.
What evidence does Gruber present against Europol and Frontex?
The complaint states that Frontex collected information on Gruber during debriefing interviews with rejected asylum seekers and forwarded it to Europol without proper legal grounds. Data held by Europol included her date of birth, Austrian address, lack of criminal record and role as president of Josoor. She was labelled a contact linked to organised crime. Gruber also points to indications that her data may have entered parallel Europol IT systems that do not meet required security standards, as reported in earlier investigations by media outlets. Europol described her as linked to illegal migration and other forms of organised crime and connected her to an alleged attempt to force border authorities to rescue migrants. The complaint argues that a member state cannot create a valid legal basis simply by labelling rights-monitoring activities as organised crime. It further alleges that Europol processed the data both during the Greek investigation and long after it had concluded, linking her to the supposed offence of trying to compel rescue operations.
How long did the EDPS take to act on the complaint?
Gruber lodged her complaint with the EDPS in 2022. The supervisor did not inform Europol that the Greek case had ended until 13 months after Gruber herself supplied that information. A final rejection of her complaint arrived more than three and a half years after submission. During this period Europol kept processing the data. Gruber maintains the delay left her uncertain whether additional criminal inquiries were underway elsewhere in Europe. The EDPS only acted after Gruber notified the supervisor of her acquittal; the supervisor then took another year to pass the information to Europol. Europol finally stopped processing the data 18 months after the Greek investigation closed. The complaint stresses that the EDPS issued its rejection without conducting the minimum diligence required to safeguard her rights as a data subject.
What remedies does the lawsuit seek?
The action asks the Court of Justice to annul the EDPS decision that found Europol’s processing lawful. It also claims 130,000 euros in damages for the impact on Gruber’s work and personal life, including the closure of Josoor International Solidarity. Gruber further seeks a declaration that the EDPS failed to exercise the minimum diligence required to protect her rights as a data subject. The compensation figure reflects both material losses from shutting down the organisation and the prolonged uncertainty caused by the extended data retention.
How has the EDPS response affected oversight of EU agencies?
Front-Lex co-director Iftach Cohen stated that the EDPS decision shielded both Europol and Frontex from scrutiny. He argued the supervisor failed to exercise the diligence required to protect data-subject rights when member-state allegations target humanitarian activities. Cohen said Europol was willing to violate EU data-protection law to support an apparent campaign of lawfare because of the nature of Gruber’s humanitarian work, and that the EDPS had shamefully protected the agencies for the same reason. The case is therefore presented as testing whether the EDPS can be compelled to conduct thorough reviews when complaints concern agencies operating in politically sensitive migration contexts.
Frequently asked questions
What was the original Greek investigation about?
Greek authorities investigated Gruber for alleged espionage and facilitation of illegal entry after she recorded migrant pushbacks. The case was closed in February 2024 with no charges filed.
Did Europol stop processing Gruber’s data after the Greek case ended?
No. Europol continued processing for approximately 18 months after the investigation concluded, according to the complaint. Processing stopped only after the EDPS eventually informed the agency of the acquittal.
Can a member state label human-rights work as organised crime?
Gruber argues that characterising rights monitoring as criminal activity does not create a valid legal basis for data processing under EU rules.
What role did Frontex play according to the complaint?
The complaint alleges Frontex gathered information on Gruber during asylum-seeker interviews and shared it unlawfully with Europol.
Is this the first case of its kind?
The lawsuit is presented as a test of EDPS oversight responsibilities when complaints involve EU agencies operating in sensitive migration contexts.
