by Michael Hollister
The Briefing was published exclusively by HAINTZ.media on August 10, 2026.
2.024 words * 10 minutes readingtime
The complete analysis continue reading here:
EU Commission – A Breach of Law with Advance Warning
My grandmother had a saying for people who talk a great deal about rules: Don’t listen to what they say; watch what they do. The European Union talks a great deal about rules. It demands respect for the rule of law, sanctions violations, and publishes reports on other countries’ compliance. What it does when its own rules are at stake has been documented in one specific case since July 30, 2026 – document by document, without requiring anyone to take a single word on faith.
On that day, the civil liberties organization Statewatch and EUobserver published leaked documents concerning an agreement between the EU law-enforcement agency Europol and the Israeli security authorities. It concerns the exchange of personal data – the most sensitive data recognized under European law. The Council Legal Service, the Union’s own legal advisory body, found the agreement incompatible with EU and international law and demanded that its central clause be deleted. The Commission continued negotiating. Not for weeks, but for years. Europol has data-sharing agreements with a number of third countries; the question is not whether the EU may share data with Israel. The question is what it means when the institution that prescribes compliance to others disregards the explicit legal advice of its own lawyers and sidelines Parliament. The case divides into four breaches: procedural, international-law, data-protection, and German. They can be read one after another like a record – cold, dated, documented.
Breach One: Its Own Legal Opinion, Ignored
On September 14, 2022, the responsible Commission directorate-general reported that the negotiations had concluded and that ratification was the next step. The agreement was never signed. Only when the fully negotiated text was available did the member states see it for the first time. They halted the process and submitted it to the Council Legal Service for review. Its November 29, 2022 opinion, classified as “EU Restricted,” was unequivocal: The Commission had exceeded its negotiating mandate, had never consulted the responsible Council working party in four years, and had failed to inform it about the planned derogation – a violation of the duty of sincere cooperation among EU institutions. The contested clause was to be deleted in its entirety.
It was not the first warning. As early as November 2022, 13 of the 27 member states in the Council working party had refused to continue supporting the agreement; their chief concern was that it would have permitted the use of the data in the occupied territories. More than half the Union applied the brakes, and its own Legal Service followed suit a few days later. Two bodies, the same week, the same conclusion. The process was frozen in December 2022.
And then it continued. Between 2023 and January 28, 2026, Commission officials held at least seven meetings with Israeli diplomats, including one with then-Foreign Minister Eli Cohen in April 2023; Europol repeatedly received Israeli delegations during the same period. Asked whether it had revised the draft, the Commission replied that it did not comment on the substance of confidential negotiations. The 2018 mandate remained in force unchanged. Yet the working arrangement Europol and Israel concluded in 2018 had expressly permitted only the exchange of strategic information – not personal data. This very step, from statistics to the individual, lies at the heart of the new agreement. By his own account, Europol’s Fundamental Rights Officer has never reviewed the cooperation with Israel for compliance with fundamental rights. At the end of July 2026, 27 members of the European Parliament demanded answers in a written question. An institution with no democratic mandate of its own continued negotiating against the advice of its own lawyers – bypassing Parliament.
Breach Two: The Clause for the Occupied Territory
The dispute centers on two articles of the draft agreement. Article 32 states that, “in accordance with European Union policy,” the agreement does not apply to the territories that came under Israeli administration after June 05, 1967 – the West Bank, East Jerusalem, the Golan Heights, and the Gaza Strip. Yet the same paragraph expressly exempts use under Article 7 from that exclusion. Exclusion and exception appear in the same document, only a few lines apart.
Article 7 opens the door. It permits, “by way of derogation” and “exceptionally,” the use of European data in those very territories, supposedly “solely for the protection of the civilian population,” in two cases: when there is an imminent threat to life or when Europol has granted prior authorization. The catch lies in the first case. When an imminent threat to life is invoked, notification after the fact is sufficient. Anyone relying on that provision therefore uses the data in the occupied territory before Europol has even been asked, explaining only afterward why prior authorization was not possible. In all other cases, the article does require advance authorization – but the assurance that the data will be used “solely for the protection of the civilian population” appears in an agreement whose recipients are police and intelligence authorities.
The Legal Service demanded complete deletion. It would be the first time an EU-Israel agreement provided for its application in the territories occupied in 1967. That would conflict with the Palestinians’ right to self-determination under international law and with the Vienna Convention on the Law of Treaties, under which treaties must not harm third parties. It would apply EU law in territories subject to other jurisdictions: that of the Palestinian Authority in the West Bank and, in the Golan annexed in 1981, that of Syria. An agreement between two parties would thereby interfere with the rights of a third party that was not at the table. This is reinforced by the International Court of Justice’s July 2024 advisory opinion, according to which all states and organizations must refrain from acts that maintain the Israeli presence deemed unlawful. UN Special Rapporteur Ben Saul speaks of the obligation not to recognize situations created through breaches of peremptory international law. The Commission justified the clause by citing Israel’s duty as an occupying power to maintain order. The Legal Service rejected that argument: This duty does not permit anyone to assist Israel in violation of other principles of international law. An exclusion clause that simultaneously provides a means of circumventing itself is not a boundary. It is a door marked “closed.” The Legal Service wanted to brick it up; the Commission left it in the text.
Breach Three: The Recipient Is Shin Bet
The draft itself identifies what would be transferred. Article 5 also permits special categories of data: ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data, health data, and data concerning a person’s sex life. These are the categories European law protects most strictly because they can be used to construct the most intimate profiles – what a person believes, whom they know, what their body is like. For a domestic intelligence service, that is precisely the most valuable commodity: not the act, but the person and their environment. People in the EU who are of interest to such a service would be affected – as would their contacts.
Annex II lists the recipients. Alongside the national police, it expressly names the “Israel Security Agency” – the domestic intelligence service Shin Bet. It is not included by implication; it is explicitly designated as a recipient. Internal onward transfer is loosely regulated: Under Article 8, Europol’s prior authorization is not required when the receiving Israeli body is itself a competent authority under Annex II. Shin Bet is such an authority. Material can continue circulating within this group without Europol being asked again – oversight ends at the border, not at the recipient.
Article 17 is supposed to provide protection against this: It requires a supervisory authority that acts “with complete independence,” free from instructions and with secure tenure. The reality is different. Israel’s Privacy Protection Authority is situated within the Ministry of Justice, its head is appointed by the government, and its oversight of Shin Bet is questionable. The European Data Protection Supervisor describes independent oversight not merely as good practice, but as the central guarantee that data will be handled according to EU standards. Legal scholar Douwe Korff warns that highly sensitive data about people in the EU and their contacts – including aid workers, officials, and journalists – would go to a service without oversight that satisfies EU rules. Where such oversight is absent, every protective clause in the agreement is merely paper. One detail reveals the document’s tone: The catalog of offenses in Annex I for which the data is to be shared includes, alongside terrorism and organized crime, “genocide, crimes against humanity and war crimes.” This is the catalog of offenses for which European data is to flow to a circle of recipients that includes an intelligence service without EU-compliant oversight.
Breach Four: What Berlin Is Hiding From the Bundestag
What Brussels is pursuing at the European level, Berlin is advancing bilaterally. On January 12, 2026, Federal Interior Minister Alexander Dobrindt signed a “Cyber and Security Pact” with Prime Minister Netanyahu in Jerusalem; Israel, he said, was Germany’s most important security partner outside NATO and the EU. At its core is the development of a German “Cyber Dome” modeled on Israel’s, commissioned by the cabinet on August 27, 2025. It also includes the deployment of a Federal Police team to a U.S.-led security office in Jerusalem; the German government places this step within the framework of training future Palestinian police forces and stresses that it supports a negotiated two-state solution.
There is a gap between the public label and the legal substance. In response to a minor interpellation by The Left parliamentary group, the German government clarified that, “contrary to the heading … this is not a legally binding agreement under international law, but a political declaration of intent.” Because it is not an international treaty, the text does not have to be published in the Federal Law Gazette. Publicly staged as a pact, legally nonbinding, its wording not public.
The Left parliamentary group wanted to know how far the cooperation extends. Does the Federal Office for the Protection of the Constitution operate joint databases with Israeli intelligence services? The German government refused to answer at all – “for reasons of state security.” It will not even confirm whether such databases exist and refuses to provide the information in classified form to the Bundestag’s Classified Information Office. The question of whether the Israeli AI system Lavender is used in a facility comparable to the Cyber Dome likewise went unanswered. The government identifies the Israel National Cyber Directorate and the Israel National Police as its Israeli partners – the same national police force that Annex II of the Europol draft names as a recipient. In fairness, a bilateral data channel has long existed. According to the government, there is “case-specific international police information exchange with Israel” concerning Hamas activities, based on statutory authority. What would be new is the leap to structured mass data. On one point, Berlin expressly draws the line that the Commission draft renders permeable: Cooperation with Israel does not extend to territories that became part of the area under Israeli administration after June 05, 1967. What Brussels weakens in the agreement, Berlin preserves on paper – while remaining silent about everything else. The citizen becomes more legible to the state, while the state will not even tell Parliament whether it operates shared databases with a foreign intelligence service.
Assessment
Four breaches, one pattern. The EU’s own Legal Service calls the agreement unlawful – the Commission continues negotiating. A clause extends the reach of European data into occupied territory – in the same document that stipulates its exclusion. The most sensitive categories of data are to flow to a circle in which a domestic intelligence service is named explicitly – without independent oversight on the recipient’s side. And in Berlin, the government refuses to tell Parliament how far its cooperation with Israeli services extends.
None of these findings rests on outrage. They appear in the text of the agreement, the Legal Service’s opinion, and the German government’s answers – available to read, paragraph by paragraph. The 2018 mandate remains in force unchanged, the agreement is not dead, and the question submitted by the 27 members of Parliament remains unanswered. A frozen process is not a terminated one; as long as talks continue, the draft can return to the table at any time – with or without the clause the Legal Service wanted deleted. The EU measures compliance externally: It imposes sanctions, issues warnings, and publishes rule-of-law reports on others. Internally, an unelected executive decided to disregard the explicit legal advice of its own lawyers and continue negotiating around Parliament. The value of the rules an institution demands of others is determined by whether those rules also apply to the institution itself. My grandmother would have disposed of the case in a single sentence: Don’t listen to what they say; watch what they do.
The complete analysis – including the Commission’s dual role in the adequacy process, the ignored warning from the New Zealand procedure, and the connection to Israel’s targeting machine – is available in the detailed Deep Dive:
This publication answers to its readers – and no one else. Become a member for $5 or a patron for $15 per month, support genuinely independent journalism, and receive full access to all published analyses.
About the Author
Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.
Weekly analysis, background and context by email.
Sources
- Draft Europol-Israel Agreement, WK 12569/2022 INIT, September 26, 2022 – Articles 5, 7, 8, 17, and 32; Annexes I and II
- Statewatch, July 30, 2026 – Exclusive: EU Commission still seeking controversial police agreement with Israel, despite warnings
- EUobserver, July 30, 2026 – Exclusive: Leaked legal advice questions legality of EU-Israel police data deal
- eucrim (Max Planck Institute), December 01, 2022 – EU Member States Froze Closer Ties between Europol and Israel
- Written question from 27 members of the European Parliament to the Commission, E-002925/2026 – Available online
- German Bundestag, February 11, 2026 – Minor interpellation by The Left parliamentary group, Bundestag document 21/4092
- German Bundestag, February 23, 2026 – German government’s response, Bundestag document 21/4306
- German Bundestag, December 18, 2025 – German government’s response, Bundestag document 21/3368
- German Federal Ministry of the Interior, January 12, 2026 – Notice concerning the Cyber and Security Pact with Israel
© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com.
