The European Union is setting its sights on an ambitious goal: enabling law enforcement agencies to decrypt private data by 2030. This objective was outlined in a Roadmap unveiled by the EU Commission on June 24, 2025, as part of the broader ProtectEU strategy, initially introduced in April 2025. The strategy aims to provide “lawful and effective” access to citizens’ data, raising significant concerns among privacy advocates and experts.
The announcement marks a significant step in the EU’s internal security strategy, but it has already sparked alarm among privacy experts. The Roadmap is part of an effort to address the challenges posed by encrypted communications, which have been identified as a major obstacle for law enforcement agencies in their investigative work.
ProtectEU: A Strategic Vision
ProtectEU represents the EU Commission’s comprehensive plan to enhance security across the European bloc. This initiative stems from the work of the High-Level Group, which was tasked by the EU Council in June 2023 to develop a strategic plan for accessing data effectively for law enforcement purposes. The group’s final report, published in March 2025, highlighted end-to-end encryption as a significant technical challenge.
The Roadmap outlines six key areas of focus:
- Data retention: The EU Commission plans to assess the impact of extending data retention obligations and reinforcing cooperation between service providers and authorities.
- Lawful interception: Measures to improve cross-border cooperation for lawful data interception are expected by 2027.
- Digital forensics: Developing technical solutions to analyze and preserve digital evidence on electronic devices is a priority.
- Decryption: A Technology Roadmap on encryption will be presented next year to identify and evaluate decryption solutions, with the aim of equipping Europol officers by 2030.
- Standardisation: The Commission is working with Europol, industry stakeholders, and experts to standardize new approaches to internal security.
- AI solutions for law enforcement: By 2028, the deployment of AI tools to process large volumes of seized data is anticipated.
Expert Opinions and Privacy Concerns
Experts have voiced significant concerns about the EU’s plans to weaken encryption. Robin Wilton, Senior Director at the Internet Society, warned that efforts to develop decryption techniques could introduce vulnerabilities that may be exploited by malicious actors. “Efforts to develop decryption techniques almost inevitably introduce new vulnerabilities that could be exploited by anyone with the motivation and know-how,” Wilton stated.
“Strong encryption isn’t the enemy of security – it’s the starting point for it.” – Robin Wilton, Internet Society
These sentiments echo warnings from technologists, cryptographers, and privacy advocates who have expressed deep concerns about the EU’s plan to undermine encryption. The ProtectEU initiative, seen as a rebranding of the controversial Chat Control proposal, aims to balance law enforcement access with privacy and cybersecurity.
Historical Context and Global Implications
The EU’s push for decryption capabilities comes amid a global surge in cyberattacks, prompting agencies like the FBI and CISA in the United States to advocate for end-to-end encryption to combat these threats. The European Commission itself has previously recognized encryption as essential for cybersecurity, contributing to the failure of similar proposals like the Chat Control bill since 2022.
EU Commissioner for Internal Affairs and Migration, Magnus Brunner, emphasized the need for a balanced approach: “Lawmakers promise to find the right balance between allowing for efficient and future-proof solutions to facilitate law enforcement’s lawful access to digital information, while respecting the right to privacy and maintaining high levels of cybersecurity.”
The ProtectEU strategy represents a critical juncture in the ongoing debate over privacy and security. As the EU moves forward with its plans, the implications for both citizens and law enforcement agencies will be closely scrutinized. The next steps will likely involve further discussions and potential revisions to ensure that the strategy aligns with both security needs and privacy rights.
About The Author
