A Deal Could Put Palestinians’ Data in Europe in the Shin Bet’s Hands: What’s the Story?

The European Commission has been negotiating for years on an agreement that could make highly sensitive personal data originating in Europe accessible to Israeli authorities, including the Israeli National Police and the Internal Security Agency, known as the Shin Bet. 

Under the draft agreement, the data could potentially be used in certain circumstances within the occupied Palestinian territories.

The issue was brought back into the spotlight most recently after Statewatch revealed on July 30, 2026, that negotiations and contacts had continued despite legal objections within the European Union.

Commission officials held at least seven meetings with representatives of the Israeli government between 2023 and January 2026. 

Meanwhile, the EU Agency for Law Enforcement Cooperation, Europol, received delegations that included representatives of the Israeli National Police as recently as March 2026.

On April 29, the Commission refused to release the latest draft and meeting reports, stating that negotiations were still “ongoing” and “not concluded.” 

Meanwhile, the central dispute over whether European data could be used within the occupied Palestinian territories remained publicly unresolved.

What Types of Data Are Involved? 

The draft agreement, dated September 26, 2022, defines personal data broadly to include names, identity numbers, location data, online identifiers, and physical, physiological, genetic, mental, economic, cultural, and social characteristics.

It also covers biometric data resulting from the technical processing of physical, physiological, or behavioral characteristics for the purpose of uniquely identifying a person, explicitly including fingerprints.

Genetic data, meanwhile, covers information resulting from inherited or acquired characteristics, including data obtained through the analysis of biological samples, the legal framework under which DNA profiles fall.

The draft extends to information touching on some of the most sensitive aspects of a person’s private life. Article 5 includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data used for unique identification, and health information.

For these categories, the draft imposes strict requirements of necessity and proportionality in each individual case, while providing additional protection for the data of minors, victims, witnesses, and informants.

The text requires the transferring authority to specify the purpose for which the information is being sent and stipulates that its processing must be linked to the prevention, investigation, detection, prosecution, or enforcement of penalties for crimes falling within Europol’s remit.

Under Europol’s system, the range of people whose data may be processed extends beyond those directly accused or convicted of a crime. 

It includes suspects and people for whom there are factual reasons or reasonable indications linking them to the possible commission of a crime, as well as victims, witnesses, informants, contacts, and people associated with someone under investigation.

Since the 2018 authorization, the Council of the European Union has also required data-protection safeguards to apply regardless of a person’s nationality or place of residence.

This means that a Palestinian living in an EU member state, or holding European citizenship, could potentially have their data fall within the scope of the agreement if a criminal investigation places them in one of the categories whose data Europol is permitted to process.

Particular sensitivity surrounds “political opinions,” which the draft explicitly lists among the types of data that may be transferred when the heightened protection requirements are met.

Against the backdrop of widespread Palestinian activism, solidarity campaigns, and protests linked to Gaza across Europe, this raises questions about the boundary between political information and law-enforcement records that may contain such information.

The text requires processing to be connected to a criminal purpose and subject to strict necessity and proportionality tests. 

However, it allows such information to be included in exchanged records when the transferring authority determines that these conditions have been met.

French Member of the European Parliament Mounir Satouri, of the Greens, warned in comments cited in a Statewatch investigation published on July 30, 2026, that the agreement could increase the pressure faced by Palestinians and human rights defenders in Europe.

The draft sets out a number of restrictions on data transfers. It requires both parties to limit transfers to data relevant and necessary for the stated purpose, maintain the accuracy of the information and keep it up to date, and establish retention periods.

It also prohibits the transfer of information collected in clear violation of human rights recognized under international law binding on the parties, and prohibits its use in connection with requests for, or the enforcement of, the death penalty, as well as cruel or inhuman treatment.

Data subjects are granted rights to access, correction, erasure, or restriction of processing, as well as the right to lodge complaints, seek judicial remedies, and obtain compensation. 

The draft also requires records to be kept of access, disclosure, onward transfer, and erasure so that these operations can be subject to review.

How Could the Data Be Used?

The 2022 draft identifies the authorities with which Europol would be able to exchange data, foremost among them the Israeli National Police, the Shin Bet, and other “law-enforcement” authorities with specific areas of competence.

The annex on contact arrangements also designates the Coordination and Operations Division of the Israeli National Police as the central point of contact between Europol and the Israeli side.

Article 8 regulates the movement of information after it reaches the Israeli authorities. If data is transferred to one of the bodies listed as “competent authorities,” it may be passed on to another authority on that list, while the restrictions imposed by the original source of the information continue to apply. This creates a legal pathway through which a file could move from Europol to the Israeli National Police and then to the Shin Bet.

Transferring data to an authority not listed in the annex, including a military or border authority, would require Europol’s explicit prior consent, according to the text, and its use would have to remain linked to the original purpose or to a directly related purpose.

The draft also allows certain information to be transferred onward to a third country or international organization, subject to additional conditions and Europol’s consent.

The occupied Palestinian territories lie at the heart of the agreement through Article 7. When it authorized negotiations in 2018, the Council of the European Union decided to exclude from the agreement’s territorial scope the areas that came under Israeli occupation after June 5, 1967.

However, the 2022 draft introduced an exception allowing Israeli authorities to use European data in those areas when this concerns the “prevention of a crime” in cases involving an imminent threat to life, with Europol able to be notified after the use of the data in urgent circumstances.

It also permits the use of the information to “prevent, investigate, detect, or prosecute a crime” after obtaining Europol’s prior consent.

This exception triggered objections within the Council of the European Union. In a restricted legal opinion issued on November 29, 2022, the Council’s Legal Service concluded that the wording clearly made the agreement applicable in the territories occupied in 1967. 

It noted that accepting the provision would mark the first time an international agreement between the EU and “Israel” explicitly extended to those territories.

The Legal Service also found that the wording could cover parts of the West Bank where policing powers had been transferred to the Palestinian Authority, as well as the Gaza Strip. 

It considered the provision incompatible with the Palestinian people’s right to self-determination and with the legal principle that an agreement between two parties cannot prejudice the rights of a third party, and called for the exception to be removed.

During internal discussions in 2022, the Commission argued that “Israel”, as an occupying power, had a duty to maintain public order and safety in areas under its control.

The Council’s Legal Service responded that an occupying power’s obligations to “maintain order” do not give states or international organizations the right to assist it in a manner that violates other principles of international law.

That response carries additional weight following the International Court of Justice’s advisory opinion of July 19, 2024, which concluded that “Israel’s” continued presence in the occupied Palestinian territory is unlawful and that all states must refrain from recognizing the situation arising from it and from rendering aid or assistance in maintaining it.

Concerns also relate to what happens after the information reaches Israeli authorities. Ben Saul, the UN Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism and a professor of international law, told Statewatch that there were concerns about the adequacy of “Israel’s” data-protection framework.

Eitan Diamond, director of the International Humanitarian Law Centre at the Diakonia organization in Jerusalem, said the ICJ ruling had strengthened the legal objections to the agreement. 

He warned that European data could become part of decisions involving the deprivation of Palestinians’ liberty or be used as intelligence in targeting operations.

Raji Sourani, director of the Palestinian Centre for Human Rights in Gaza, offered a direct Palestinian perspective, expressing grave concern about placing sensitive data within a security-cooperation framework involving Israeli authorities, citing Palestinians’ experience with detention and security persecution.

These concerns are not merely about potential future developments. In May 2023, Amnesty International documented the use of the “Red Wolf” facial-recognition system at military checkpoints in the occupied city of Hebron, where Palestinians’ faces are scanned and compared against biometric databases without their consent.

According to the organization, the system can affect whether a Palestinian is permitted to pass through a checkpoint. It can also be linked to information indicating that a person is wanted for questioning or arrest, as well as to the “Wolf Pack” and “Blue Wolf” systems, which collect extensive information on Palestinians.

Within Europe, another legal channel can make it more difficult to determine the original source of information. In an official response to the European Parliament on April 8, 2025, the Commission explained that a member state can create an alert in the Schengen Information System based partly or entirely on information received from a third party.

It also explained that the country that entered the alert is not required to inform other countries or Europol of the source of that information. 

This means that information provided by a security agency outside the EU could later appear in a border or police procedure within the Schengen Area without the shared record revealing its origin to other countries.

Security cooperation between Europol and the Israeli authorities predates the current agreement. In 2018, a “working arrangement” between the two sides entered into force, establishing a framework for cooperation. 

However, that arrangement does not provide the same legal basis for the regular exchange of operational personal data that the new negotiations seek to establish.

In its April 2025 response, the Commission also confirmed that Article 23(5) of the Europol Regulation allows the agency to receive personal data from a third country in specific circumstances even in the absence of a comprehensive international agreement, subject to rules on necessity, proportionality, and data protection.

There have been notable precedents. In March 2019, German authorities revoked Palestinian official Rima Dudu’s Schengen visa and barred her from participating in a political event following Israeli intervention and pressure, although no document has emerged showing that the decision was based on the exchange of police or biometric data.

In December 2023, the Shin Bet and the Israeli foreign intelligence agency, the Mossad, announced that an intelligence investigation had preceded arrests carried out by Danish security and law-enforcement authorities in a case they said was linked to Hamas, alongside arrests in Germany and the Netherlands.

Why Are the Negotiations Continuing?

The actual negotiations began in 2021. The two sides then held the third round on June 30, 2022, followed by the fourth round on September 13 and 14. The talks reached an agreed text at negotiators’ level, which was initialled, before the draft was issued on September 26 of that year.

The next step would have required the proposal to move to the Council of the European Union and the European Parliament. However, objections from member states over the exception concerning the occupied territories, as well as concerns about the Commission’s handling of the negotiations, brought that process to a halt.

The Council’s Legal Service identified another problem extending beyond the substance of Article 7. It concluded that the Commission had failed to comply with the mandate given to it by the Council by negotiating the territorial exception without the required consultation with the special committee tasked with overseeing the talks.

The Legal Service considered this a violation of Article 3 of the negotiating mandate and of the procedures for concluding international agreements set out in the Treaty on the Functioning of the European Union, as well as the duty of interinstitutional cooperation. 

Its November 2022 opinion ultimately left it to the Council to decide whether negotiations should continue and whether to issue further instructions to the Commission.

The negotiations nevertheless continued. On August 7, 2023, the Commission acknowledged in a formal response to the European Parliament that the question of the territorial scope remained under discussion.

Documents later obtained by Statewatch showed that Commission officials held at least seven meetings with representatives and diplomats of the Israeli government between 2023 and January 28, 2026, including a meeting with then-Israeli Foreign Minister Eli Cohen in April 2023.

Documents obtained by the organization also show that Europol received delegations that included representatives of the Israeli National Police on at least four occasions between August 2024 and March 2026. 

The continuation of these contacts after 2023 is particularly sensitive given the record of violations that EU institutions themselves have increasingly been required to address.

MEP Mounir Satouri described the continuation of the negotiations as a twofold problem: security cooperation at a time when European and international bodies are documenting serious violations of international humanitarian law in Gaza, and the conduct of the talks without parliamentary oversight.

Spanish MEP Hana Jalloul, of the Socialists and Democrats group, stressed that “the objectives of combating terrorism and serious crime” do not exempt EU institutions from their obligations under the law.

In late July 2026, 27 MEPs formally asked the Commission to clarify the purpose of the meetings, the status of the negotiations, and the agreement’s potential human-rights risks.

The Commission’s rationale for continuing the process is rooted in an objective it set out in a December 2017 recommendation: strengthening Europol’s capacity to cooperate in combating serious cross-border crime and “terrorism.”

From the outset, the European Parliament set broad conditions for any final approval. In its resolution of July 4, 2018, it called for the agreement to provide a level of protection that was essentially equivalent to that afforded under EU law and practice.

It also called for the agreement to specify the purposes for which data could be used, retention periods, rights of access, correction and erasure, and avenues for legal redress, while requiring implementation to be subject to independent oversight, periodic evaluations, and strict controls on onward transfers.

Safeguards relating to the occupied territories and the onward transfer of data remained among the main obstacles holding up the agreement, while the data-protection framework of the Israeli authorities created another point of contention.

The Commission has continued to classify “Israel” among the countries whose laws it considers to provide a level of protection for personal data sufficiently close to European standards. 

This is known in the EU as an “adequacy decision,” and the Commission reaffirmed this classification in a review published in January 2024.

However, that decision primarily concerns civil and commercial data transfers and does not, through the same mechanism, cover police and law-enforcement data, which are governed by separate and more stringent EU rules.

To date, no final text has emerged that resolves the dispute. On April 29, the Commission refused to publish the meeting reports and a more recent draft of the agreement, arguing that disclosure would undermine ongoing and unresolved negotiations.

Three months later, the Council of the European Union told Statewatch that the 2018 mandate excluding the occupied territories had not changed and remained in force, while the latest draft still allows exceptions for the use of data in those territories.