The EU Commission’s Roadmap outlines plans to ensure “lawful and effective” access to citizens’ data for law enforcement, potentially enabling decryption by 2030. This initiative is part of the broader ProtectEU strategy unveiled in April 2025.
The Roadmap addresses six key areas. First, the EU Commission is expected to conduct an impact assessment to potentially extend data retention obligations and enhance cooperation between service providers and authorities. Second, lawmakers aim to explore ways to improve cross-border cooperation for lawful data interception by 2027. Third, the plan includes developing technical solutions for authorities to analyze and preserve digital evidence on electronic devices.
A Technology Roadmap on encryption is expected next year to identify and evaluate decryption solutions, with the aim of equipping Europol officers with these technologies by 2030. Additionally, the Commission intends to collaborate with Europol, industry stakeholders, experts, and law enforcement to standardize the internal security approach. Finally, lawmakers aim to promote the development and deployment of AI tools by 2028 to enable authorities to process large volumes of seized data lawfully.
Robin Wilton, Senior Director at the Internet Society, expressed concern regarding the move towards data decryption. Wilton stated, “Efforts to develop decryption techniques almost inevitably introduce new vulnerabilities that could be exploited by anyone with the motivation and know-how; they may also encourage the ‘hoarding’ of vulnerabilities, which is contrary to good cybersecurity practice.” These concerns echo previous warnings from technologists, cryptographers, and privacy advocates.
Government bodies, including the FBI and CISA in the US, have encouraged citizens to use end-to-end encrypted services in response to increased cyberattacks. The European Commission has also previously recognized encryption as necessary to protect cyberspace integrity. A previous proposal to create an encryption backdoor, known as the Chat Control bill, has struggled to gain a majority since 2022.
EU Commissioner for Internal Affairs and Migration, Magnus Brunner, stated that lawmakers are committed to balancing “allowing for efficient and future-proof solutions to facilitate law enforcement’s lawful access to digital information, while respecting the right to privacy and maintaining high levels of cybersecurity.”
Wilton emphasized, “Strong encryption isn’t the enemy of security – it’s the starting point for it.”
