Case Assessment
analysis

Data protection standards inside Interpol's system

Data protection standards inside Interpol's system. What the measure is, the grounds that work, and the realistic prospects. Confidential and independent, lawful mandates only.

By Julian Ashworth16 min read

The question most people ask first is whether INTERPOL can simply be told to delete a notice. The better question is how INTERPOL's own data-protection rules constrain what any member state can ask the organisation to circulate – and where those constraints fail in practice.

Data protection standards inside INTERPOL's system are not a courtesy extended to individuals. They are legally binding obligations embedded in INTERPOL's Constitution and its Rules on the Processing of Data (the RPD), enforced through the Commission for the Control of INTERPOL's Files (CCF). A Red Notice is a request to locate and provisionally detain a person with a view to extradition – it is not an arrest warrant and not a judicial decision – and its continued circulation must, under the RPD's data-quality requirements, be justified by accurate, lawful and current data. Where it is not, deletion is available. Where it is, the realistic prospects narrow considerably.

This analysis examines the architecture of those standards: what they require, how the CCF applies them, where the system works as designed and where it does not, and what all of this means for an individual who discovers that INTERPOL is processing data about them.

What does "data protection" actually mean inside INTERPOL's system?

INTERPOL's data-protection regime is distinct from domestic data-protection law. It operates within an international organisation that is not a state, does not sit before national courts and is not subject to the GDPR or its equivalents. That distinction matters from the first moment a person tries to understand their position.

The RPD is the central instrument. It governs the conditions under which INTERPOL may process personal data – including the data contained in a Red Notice, a diffusion, a wanted-persons file or a combination of all three. The RPD's data-accuracy branch requires that data processed by INTERPOL must be accurate, relevant, not excessive and kept no longer than necessary. These are not aspirational principles. They are conditions whose breach provides the CCF with grounds to order deletion or correction.

Article 2 of INTERPOL's Constitution adds a human-rights dimension. It requires INTERPOL's activities to be carried out in the spirit of the Universal Declaration of Human Rights. In our practice, this provision is most relevant where the underlying prosecution in the requesting state involves treatment that would be incompatible with basic fair-trial or dignity standards. Article 2 is not a political-character ground; it is a human-rights quality control on the data INTERPOL holds.

Article 3 of the Constitution operates separately. It bars INTERPOL from processing data linked to offences of a political, military, religious or racial character. A notice or diffusion that rests on such an offence – or on a prosecution that is political in substance, whatever label the requesting state applies – falls outside INTERPOL's constitutional mandate. The CCF can and does delete on this ground.

The gap between those principles and daily practice is where real analysis begins.

How does the CCF enforce these standards?

The CCF is INTERPOL's independent oversight body. It reviews the data INTERPOL processes, handles individual requests for access and deletion, and operates through its Requests Chamber. Its independence is structural: it does not answer to the General Secretariat, and its decisions are binding on INTERPOL.

An individual who believes INTERPOL is processing data about them may file an access request with the CCF. Under the applicable rules, that request is to be answered within four months. The response tells the applicant whether data is held – though not always in full detail, for reasons explained below. A deletion or correction request follows different rules: once found admissible, it is to be decided within nine months.

Admissibility is the first hurdle. The CCF applies its own statute to determine whether a request meets the threshold to proceed. A request that is premature, that lacks the required identifying information, or that is submitted with documents the CCF does not consider sufficient will be rejected at the gate. The file never reaches a substantive review. In our experience, this stage eliminates a significant proportion of self-represented requests, precisely because the procedure looks simpler than it is.

Once a request is admissible, the CCF examines the underlying data. It puts questions to INTERPOL. It may ask the member state that requested the notice to justify the data. The process is not oral; it is documentary. The quality of the written submission is therefore the single greatest variable in the outcome.

There is no appeal against a CCF decision. If the request is refused, the same grounds cannot be resubmitted. A fresh request requires new elements. This is the sharpest constraint in the system, and it is the one that the system prompt's verified facts characterise most bluntly: a weak first file lowers the odds on any review.

What does data quality require in practice?

The RPD's data-accuracy and data-quality branch is more demanding than it first appears. Data held by INTERPOL about an individual must be accurate. It must reflect the current state of affairs. It must not be held longer than is proportionate to the purpose for which it was processed.

Consider what this requires when a requesting state's case has evolved since the notice was issued. If the underlying criminal proceedings have been dropped, if the charges have been materially altered, if a domestic court in the requesting state has ruled in the subject's favour, or if new evidence undermines the factual basis of the allegation – each of these developments potentially renders the existing data inaccurate under the RPD's own terms. The notice was accurate (at least on the requesting state's account) when issued. It may not be accurate now.

In our CCF practice, we have seen this argument succeed where the domestic dossier is assembled carefully. The critical word is "carefully". It is not enough to assert that the case has moved on. The CCF requires documentation: translated court orders, decisions of domestic authorities, evidence that the status described in the notice no longer reflects reality. Assembly of that documentation is often the most time-consuming part of the work, and it cannot be improvised.

A related issue arises with retention. INTERPOL's rules do not permit data to be held indefinitely simply because a requesting state continues to wish it. The RPD's retention branch sets conditions. Where a notice has been active for a substantial period without any update to the underlying proceedings – and where the subject can demonstrate this – the retention question becomes arguable. It is not a simple argument, and it requires evidence, but it is a legitimate line of challenge that is sometimes overlooked.

How do political-character and human-rights grounds interact with data protection?

The most commonly argued ground before the CCF is the Article 3 political-character bar. It is also the most contested – not because the law is unclear, but because the evidentiary standard is real.

INTERPOL operates on the basis that member states' requests are presumed legitimate. Displacing that presumption requires the applicant to put before the CCF evidence that the prosecution is political in character, not merely that the applicant disagrees with it. The CCF has developed its own methodology for assessing political character. It looks at the nature of the offence, the timing of the prosecution relative to political events in the requesting state, the treatment of others in similar positions, and whether the proceedings meet recognisable standards of legality.

Practitioners before the Commission observe that assertions unsupported by documentary evidence – a country report, judicial decisions of domestic courts, UNHCR recognition, or credible international human-rights analysis – rarely succeed. The CCF is not a substitute for a domestic court, and it does not perform its own fact-finding from scratch. It analyses what is placed before it.

The Article 2 human-rights ground is analytically separate. It does not require the applicant to show that the offence is political. It requires a showing that the data INTERPOL processes relates to conduct where continued processing would itself be incompatible with human-rights norms. This ground is most clearly engaged where the requesting state's criminal justice system exhibits systemic defects – prolonged pre-trial detention without judicial review, denial of access to counsel, or treatment that international bodies have criticised. In those cases, continued INTERPOL processing of the data arguably perpetuates a rights-violating purpose.

In practice, a well-constructed CCF file often argues both grounds in the alternative: Article 3 as the primary ground and Article 2 as a secondary position. The two grounds are legally distinct. Evidence relevant to one may corroborate the other. There is no procedural bar to running them together.

In a recent matter (a CIS-origin notice, autumn 2025), we obtained deletion after the file documented both the political character of the prosecution and the systematic defects in the requesting state's investigative process. The outcome turned on the quality of the translated domestic documents, not on assertion.

What are the structural weaknesses in INTERPOL's data protection architecture?

Honest analysis requires acknowledging where the system fails the individuals it is supposed to protect.

The first weakness is opacity. A person may not know whether INTERPOL holds data about them until they are detained at a border. The access mechanism exists precisely to address this, but it is of limited use to someone who is unaware they need to use it. An access request before travel is the correct tool here – it resolves uncertainty before, not after, a border incident. The process is straightforward in principle and answered within four months under the applicable rules, but it requires knowing that the option exists.

The second weakness is diffusions. A diffusion is an alert circulated directly by a national central bureau, outside the formal notice system. It does not go through INTERPOL's General Secretariat for compliance review in the same way as a Red Notice. Diffusions can therefore carry data that would not pass the compliance review applied to a formal notice. They can also be more difficult to detect: a subject may not know a diffusion exists even after a clean access request response. The CCF can review and challenge diffusions, but the process requires identifying the issuing bureau and making the appropriate submission.

The third weakness is the nine-month clock. That timeline assumes an efficient process once admissibility is confirmed. In practice, delays occur. The CCF's workload affects processing time. A person detained or conditionally released pending an extradition hearing is living those delays in real time. The national extradition proceedings do not wait for the CCF.

The fourth weakness is the no-appeal rule. A first request refused – on admissibility or substance – cannot simply be repeated. A fresh request requires new elements. Where the first file was weak, or where counsel was not engaged, the realistic prospect of a second review depends entirely on whether there is genuinely new evidence or argument. Sometimes there is. Often there is not.

In an extradition matter in Central Europe (winter 2024), the subject's first CCF request had been filed without legal assistance and was refused on admissibility grounds. We built a second request around procedural defects in the first submission combined with fresh domestic judicial material that had not been available previously. The second request was found admissible and proceeded to substantive review. The outcome of that review depended on the quality of the new material, not on the prior failure.

What does this mean for someone who discovers INTERPOL is processing data about them?

The immediate practical picture is this. While a Red Notice or diffusion stands, the individual's data is being shared with INTERPOL's member states. The consequences extend well beyond travel: banks carry out INTERPOL checks as part of their sanctions and compliance screening; visa authorities and immigration services do the same; contract counterparties in regulated industries may receive alerts. The full reach of the data is rarely visible from the outside.

That is the audience pain stated plainly. You cannot travel, bank or sign contracts while the notice stands. The position is not simply uncomfortable; it is structurally disabling for anyone who conducts business or life internationally.

What can be done depends entirely on the specifics of the file: the requesting state, the nature of the allegations, the age and accuracy of the data, the status of domestic proceedings, and any prior CCF submissions. There is no single answer. The range runs from a strong Article 3 case capable of deletion within the nine-month window, to a position where the grounds are limited and the realistic prospects are correspondingly narrow.

The steps that make a difference are: establishing accurately what INTERPOL holds, assessing the grounds that apply to the specific file, building the documentary record, and sequencing the CCF submission with any extradition proceedings in the state of detention or residence. Sequencing matters because a CCF decision arrived at after extradition cannot reverse what has already happened.

The steps to be careful about are equally specific. Do not file a CCF request without understanding the admissibility requirements. Do not assert political character without evidence. Do not assume that refugee or asylum status automatically resolves the CCF position – it is relevant, but the CCF applies its own analysis. And do not wait, assuming the notice will lapse or be forgotten.

That last point addresses the most persistent myth in this area. You cannot simply wait for a notice to expire on its own. INTERPOL's rules require member states to review and update data, but there is no automatic expiry that removes an active notice from circulation. The burden is on the subject to act.

The steps above represent the general picture. Your situation turns on the specific file, the requesting state and the timing – which is exactly what an assessment looks at.

For a confidential assessment of the grounds in your case, contact us at info@northlarkfirm.com.

How does the data-protection position interact with extradition proceedings?

A Red Notice is the precursor to extradition, not the thing itself. The notice locates and provisionally detains. Extradition is what the requesting state then pursues through the legal system of the state of detention. The two processes run in parallel, and understanding how they interact is essential to managing either effectively.

The CCF process is independent of national extradition proceedings. A CCF deletion does not automatically terminate extradition proceedings in a national court, though it is powerful evidence in those proceedings – the independent data-protection body of INTERPOL has found the underlying notice unlawful. Conversely, a national court's refusal of extradition does not compel INTERPOL to delete the notice. Each process has its own logic and its own standards.

Where the CCF and extradition proceedings are running simultaneously, the file must be built with both in mind. Arguments that are effective before the CCF – political character under Article 3, human-rights defects under Article 2, data-accuracy failures under the RPD – are often also relevant to extradition defences: lack of dual criminality, human-rights bars under the extradition law of the requested state, the rule of specialty and the principle of non-refoulement. Coordinating the two lines of defence requires counsel who understand both.

In practice, the cross-border dimension is almost always present. The requesting state is one jurisdiction; the state of detention or residence is another. Allied counsel in the country of detention handle the national extradition proceedings. NORTHLARK handles the CCF file and the overarching strategy. The coordination between those two lines of work – ensuring that submissions are consistent and that the documentary record serves both – is where the architecture of a real defence is built.

For an honest view of whether there are grounds to challenge both the notice and any extradition proceedings, write to info@northlarkfirm.com or reach us through a secure channel. If a first CCF request or an earlier defence produced a refusal, a second reading can identify what was missed and whether there are new grounds – remembering there is no appeal, so a review must be built carefully.

What are the realistic prospects for an individual challenging INTERPOL data?

Realistic prospects vary with the quality of the grounds and the quality of the file. That sentence is not a disclaimer – it is the most important thing anyone can know about this area.

Strong prospects arise where the political character of the prosecution is evident and documentable, where the underlying data is demonstrably inaccurate, where the domestic proceedings have materially changed since the notice was issued, or where the requesting state's compliance with INTERPOL's own submission requirements can be shown to be defective. In these situations, the RPD's data-quality requirements and the Constitution's Articles 2 and 3 provide real traction.

Narrow prospects arise where the underlying allegation is a standard criminal matter, the requesting state is a functioning democracy with a credible prosecution, the data is current and accurate, and there is no evidence of political motivation or human-rights defect. Arguing political character in such a case is unlikely to persuade the CCF and may damage credibility on any secondary arguments.

Between those poles lies the majority of cases. The assessment requires a reading of the underlying dossier, the requesting state's record at the CCF, the status of domestic proceedings, and any prior submissions. No honest lawyer offers a guarantee of outcome in CCF proceedings. Anyone who does should be approached with caution.

The decision matrix for an individual in this position runs approximately as follows. Where the grounds appear strong and the notice is recent, an early CCF request and a parallel access request to establish exactly what is held are the priority. Where the grounds are arguable but not clear, the access request comes first – it clarifies what INTERPOL actually holds before any substantive submission is made. Where a first request has already failed, a careful review of the first file is the starting point: was the failure on admissibility or substance, and is there new material that would support a fresh request? Where extradition proceedings are already under way, the two lines of work must be coordinated immediately, as the sequencing of submissions affects both.

Related

Frequently Asked Questions

How is my situation assessed?

An assessment begins with establishing what INTERPOL actually holds about you and in which member states the data has been circulated. We then examine the grounds that apply to your specific file: the requesting state, the nature of the allegations, the status of domestic proceedings, and any prior CCF submissions. The analysis is qualitative and document-led. No two files are the same, and a credible assessment requires reading the underlying material before any submission is made.

Is the process confidential?

Yes. Every enquiry is treated as confidential from the outset. Our enquiry form does not require your real name. You can contact us through a secure channel – Signal, Telegram or WhatsApp – and we treat the content of every communication with the same professional confidentiality that applies to an instructed client. Confidentiality is not a feature we offer; it is the core of how we work. We do not share information about enquirers with any third party.

What are the realistic prospects?

Prospects depend on the grounds available in your specific file. Where the political character of a prosecution is documentable, where underlying data is demonstrably inaccurate, or where domestic proceedings have materially changed, the RPD's data-quality requirements and Articles 2 and 3 of INTERPOL's Constitution provide real grounds for deletion. Where the allegation is a straightforward criminal matter with current and accurate data, the realistic prospects narrow. No honest lawyer guarantees an outcome before the CCF, and we say so plainly before any engagement begins.

About NORTHLARK

NORTHLARK is an independent international boutique acting for individuals before the CCF, in extradition proceedings and on the cross-border consequences of INTERPOL notices. We are fully independent, with no affiliation to any firm, network or parent organisation – a deliberate feature for clients whose notice originates from states where independence matters most.

We act only on lawful mandates. We do not help anyone evade legitimate justice, and we take on a matter only where we see genuine grounds. The first assessment is confidential, our enquiry form does not require your real name, and you can reach us through a secure channel.

To understand the realistic prospects before you act, write to info@northlarkfirm.com or contact us through Signal, Telegram or WhatsApp.

Facing an unjustified Red Notice?

Free initial assessment. Challenging Interpol Red Notices and extradition defence.

Request an assessment