# Decision on how the EU Agency for Law Enforcement Cooperation (Europol) dealt with the moves of two former staff members to positions related to combatting online child sexual abuse (case 2091/2023/AML)
- Author: European Ombudsman
- Date: 2025-02-21T00:00+01:00[Europe/Paris]
- [URL](https://www.ombudsman.europa.eu/en/decision/en/200017)
---
> The case concerned how the EU Agency for Law Enforcement Cooperation (Europol) dealt with the moves of two of its former staff members to Thorn (a private entity developing AI-based software solutions to detect child sexual abuse material online) while the EU was considering adopting rules on the matter. The complainant raised concerns about potential conflicts of interest with the moves.
> 
> The Ombudsman found that how Europol had dealt with the move of one staff member to the private sector amounted to maladministration. However, in the course of the inquiry, Europol indicated its willingness to revise its existing processes. The Ombudsman welcomed this, and asked Europol to report back, within six months, indicating how the revision addresses the shortcomings identified in this inquiry.
> 
Background to the complaint
---------------------------

**1.** When public officials leave the administration to take up positions in the private sector, they are described as going through the 'revolving door'. Due to the effect that these moves can have on citizens' trust and on the integrity of the public service, it is of utmost importance that the challenges they may raise are handled properly.[\[1\]](#_ftn1){#_ftnref1}

**2.** To address such challenges, the EU administration has specific rules in place, which are set out in the EU Staff Regulations.[\[2\]](#_ftn2){#_ftnref2} The principle underpinning these rules is that while former staff members have a fundamental right to engage in work after they leave the EU administration, this must be balanced against the risks that any such moves may pose to the interests of the EU institution. In practice, this means that, under certain circumstances and during a certain period of time, EU institutions may prohibit or impose conditions of the intended moves of their (former) staff members (so-called 'post-service activities').

**3.**The moves at issue in this inquiry are those of two former staff members of the EU Agency for Law Enforcement and Cooperation (Europol), both of whom joined Thorn, a US-based entity specialised in the detection of online child sexual abuse material (CSAM). After leaving Europol at the end of 2021, the first former staff member immediately started to work as an employee for that organisation. The second former staff member, after leaving Europol in 2022, joined Thorn's board of directors in 2023.

**4.** In September 2023, amid growing controversy over the alleged influence of Thorn over the content of a legislative proposal of the Commission in the area of scanning of online content,[\[3\]](#_ftn3){#_ftnref3} media reported on the two moves and raised concerns over a possible conflict of interest situation.[\[4\]](#_ftn4){#_ftnref4} Following these reports, an exchange of views between Members of the European Parliament (MEPs) and Europol took place, during which Europol discussed its framework for handling revolving door situations, and explained how it had handled the two cases at issue.[\[5\]](#_ftn5){#_ftnref5}

**5.**On 25 October 2023, dissatisfied with the replies provided by Europol, the complainant, then an MEP, turned to the Ombudsman.

The inquiry
-----------

**6.**The Ombudsman opened an inquiry into how Europol dealt with the moves of two former staff members to positions in the private sector related to combatting online child sexual abuse.

**7.** In the course of the inquiry, the Ombudsman inquiry team inspected Europol's file on the post-service activity requests of the two former staff members.[\[6\]](#_ftn6){#_ftnref6} The Ombudsman inquiry team had two meetings with the Europol representatives to seek clarifications in relation to the documents inspected.[\[7\]](#_ftn7){#_ftnref7} The Ombudsman then received the comments of the complainant on the meeting report.

**8.** In October 2024, the Ombudsman informed Europol of her preliminary findings in this inquiry.[\[8\]](#_ftn8){#_ftnref8} Subsequently, Europol provided written replies to the preliminary findings.[\[9\]](#_ftn9){#_ftnref9} Europol declared its willingness to revise its existing processes in order to ensure that they are free from error.

**9.**The case raises in essence two issues, the first one being how Europol assessed the risk of conflict of interest in relation to post-service activities. The second one concerns how Europol dealt with other consequences of the first staff member's job move, notably the question as to measures taken while the staff member was still in service after the staff member had informed Europol of the move.

How Europol assessed risks of conflict of interest in relation to post-service activities
-----------------------------------------------------------------------------------------

### Arguments presented to the Ombudsman

##### By the complainant

**10.**The complainant took issue with the moves of the two former Europol staff members to Thorn.

**11.**The complainant emphasised that although Thorn describes itself as a non-profit organisation, it generates significant income through software sales, and heavily invests in lobbying and public representation. In light of this, he considered that Europol had not properly assessed all the risks generated by the moves of its former staff members, by focusing too narrowly and exclusively on commercial risks and on protecting solely the Agency's integrity.

##### By Europol

**12.**Europol took the view that there were no factual indications suggesting that a conflict of interest had actually occurred in the two cases at issue.

**13.** More precisely, after explaining the process for handling authorisation requests for post-service activities,[\[10\]](#_ftn10){#_ftnref10} Europol emphasised that, in both cases, no internal preparatory instance had identified a conflict of interest.

**14.**Europol underlined that, in both cases, it had assessed the risks associated with the moves in a broad manner, without limiting itself to commercial considerations. Moreover, Europol stated that the request form used by the Agency prohibits staff members engaging in lobbying and advocacy activities.

**15.**Finally, Europol noted that it had not, to the day of its reply, purchased any product from Thorn.

### The Ombudsman's assessment

**16.**EU staff members must follow the highest standard of ethical conduct. Some of their obligations, in particular those related to integrity, continue to apply after staff members have left the service.

**17.**Against this background, Article 16 of the EU Staff Regulations foresees that when staff members intend to take up a new job or start a new activity in the two years after leaving the service, they must inform their institution of their intention. The institution may prohibit or impose conditions on the move when two cumulative conditions are met, namely:

a) The activity is related *in any way* [***\[11\]***](#_ftn11){#_ftnref11} to the work of the former staff member during the last three years of service; and,

b) The activity could lead to a conflict with the legitimate interests of the institution. Case law has clarified that it is sufficient that the envisaged activity *may* *be perceived* [***\[12\]***](#_ftn12){#_ftnref12} as giving rise to an actual or potential conflict of interest.

**18.** As regards this second condition, when assessing the possibility of any actual, potential or perceived conflict of interest, Europol must take into consideration a number of factors. These include: any overlap of duties or files, risks of reputational harm, the quality of the employer, interest representation vis-à-vis the institution, and whether the position is paid or not.[\[13\]](#_ftn13){#_ftnref13}

**19.**Crucially, there is no general or 'blanket' prohibition for staff members to engage in certain types of activities, such as lobbying or advocacy. Rather, it is the responsibility of the EU institution, to which the staff member belongs, to take a decision on the activity on a case-by-case basis. In doing so, it must balance the individual's fundamental right to engage in work with the risks that the move may pose to the institution's interests.

**20.**On 11 October 2024, based on the inspection and meetings conducted by her inquiry team, the Ombudsman took the preliminary view that Europol had relied on a too narrow understanding of conflict of interest when dealing with two moves at issue. In her view, this narrow approach - which appeared too focused on commercial considerations - was at odds with the applicable framework, and resulted in Europol's failure to take account of all risks associated with the moves. The Ombudsman further considered that, for the first former staff member, the authorisation should have contained a prohibition against lobbying for a certain period.

**21.**The Ombudsman received Europol's reply to her preliminary findings in November 2024, followed by an additional reply in December 2024. After assessing these replies, the Ombudsman takes the view that Europol failed to deal properly with all risks of conflict of interest in the case of the first former staff member, for the reasons set out below.

**22.** **First, as regards how Europol assesses post-service activity requests:** while the Ombudsman takes note of Europol's reassurances that it applies a broad approach to conflict of interest and that all risks were duly taken into consideration in the two cases at issue, she regrets that this was not sufficiently evidenced during the inquiry.

**23.** The responsibility for assessing the risk of a conflict of interest in relation to post-service activities lies*with Europol itself*. Although the input of internal instances, such as line managers and the Joint Committee (a committee of staff members who must be consulted by the institution before taking certain decisions with implications for staff members), informs Europol's decision-making, it cannot replace the assessment of risk that Europol must conduct. In other words, Europol cannot rely exclusively on a declaration from the Joint Committee that it has considered the applicable rules, to demonstrate the 'broad approach' to conflict of interest that the Agency says applies.

**24.**Against this background, the Ombudsman regrets that in only one of the two cases at issue the entity within Europol that took the decision documented its assessment.

**25.** In the other case - that of the first former staff member - there is no record of the substantive assessment from the entity within Europol that took the decision. This absence of any recorded assessment by Europol is exacerbated by the fact that due to human error,[\[14\]](#_ftn14){#_ftnref14} the recommendation of the Joint Committee to grant conditional authorisation was apparently not considered by that entity before the final decision to grant an unconditional authorisation was taken. This suggests that the move was unconditionally authorised without the Agency having effectively assessed the risks it could pose.

**26.** **Second, as regards the outcome of Europol's assessment in the two cases at hand** , the Ombudsman acknowledges Europol's wide discretion when deciding on post-service activity requests. Against this background, she does not take issue with Europol's decision on the second staff member.[\[15\]](#_ftn15){#_ftnref15}

**27.**The Ombudsman, however, cannot agree with Europol's assessment in relation to the request of the first former staff member. In the Ombudsman's view, the authorisation request met the two conditions set out in Article 16 of the Staff Regulations, that is:

* There was a relation between his work during the last three years in service and his intended future employment;
* Several of the factors indicating the risk of an actual or potential conflict of interest in the applicable rules[\[16\]](#_ftn16){#_ftnref16} were clearly fulfilled. This is the case, for instance, as regards reputational risks (as illustrated by the outcry faced by Europol when the move of their former staff member became known to the public), or contacts with Europol in his new capacity (the possibility of which was outlined by his manager,[\[17\]](#_ftn17){#_ftnref17} and then documented in press articles[\[18\]](#_ftn18){#_ftnref18}).

**28.**The fact that the staff member had no financial or middle management responsibilities does not suffice to remove the risk of a conflict of interest, as such risk can concern staff at any level. Otherwise, the purpose and meaning of the Article 16 procedure would be lost for the vast majority of EU civil servants.

**29.**Therefore, in the Ombudsman's view, the intended post-service activity raised risks of a conflict of interest, which Europol should have handled as such - that is, by imposing adequate mitigation measures to protect the Agency's integrity and reputation.

**30.**The Ombudsman notes that while Europol had the right to forbid or impose conditions on the move of its staff member when the staff member submitted a post-service activity request in 2021, it no longer has that option. Not only has the staff member acted on the authorisation granted by Europol, but, in any case, the two-year period of notification under Article 16 has expired. Therefore, there would be no purpose served by the Ombudsman making a recommendation in this case.

How Europol dealt with the other consequences of the first former staff member's job move
-----------------------------------------------------------------------------------------

### Arguments presented to the Ombudsman

##### By Europol

**31.**As the first former staff member was still in service when he submitted his request to join Thorn, the Ombudsman inquired into the steps taken by Europol to deal with a potential conflict of interest for the remainder of his time in service.

**32.**Europol explained that the risk of a conflict of interest arising from the move was assessed under the post-service activity authorisation procedure. No other assessment took place. As no conflict of interest was identified as regards future employment, there was no indication that there could be a conflict of interest for the remaining time in service.

**33.** Europol further explained that the recommendations of the Joint Committee did not include restrictions for the staff member's remaining period in service, because this represented an acceptable risk, where the benefits for the Agency and victims of child sexual abuse outweighed a potential risk for a conflict of interest situation.

**34.**Moreover, Europol explained that the possibility to implement mitigation measures for the remaining time in service of staff members is constrained by the existing legal framework. Specifically, it explained that:

* Europol does not have, a legal basis to unilaterally impose conditions on the remaining time in service;
* Article 11a of the Staff Regulations, which is the provision related to in-service conflict of interest, requires as a first step that the staff member first reports a conflict of interest situation. Only following this could Europol take the appropriate mitigation measures. However, in that case, neither the staff member nor his line manager nor the Joint Committee identified a conflict of interest situation;
* In Europol's view, it may unilaterally take preventive measures only on the basis of Article 7 of the Staff Regulations (assignment and transfer of staff members in the interest of the service). Europol explained that, considering the impact on the rights of the individual that this would represent, such measures would need to be based on strong factual indications of a conflict of interest - which was not the case here. Alternatively, measures could be enacted where a breach of professional obligations is suspected (Article 23 of Annex IX of the Staff Regulations), but again, clear factual evidence of such a breach would be required.

**35.** In its second reply, Europol nonetheless informed the Ombudsman of its decision to work on an '*enhanced complementary assessment framework for applying Article 7',*which would allow Europol, starting in early 2025, to take additional measures to proactively address risks of conflict of interest. Such measures could include a transfer to another position, adjusted tasks, and/or removal of access to information.

### The Ombudsman's assessment

**36.** A conflict of interest arises when staff members have any personal interest such as to impair their independence, in particular family and financial interests.[\[19\]](#_ftn19){#_ftnref19}

**37.** In the performance of their duties, staff members are prohibited from dealing with a matter in which they have, directly or indirectly, such a personal interest.[\[20\]](#_ftn20){#_ftnref20} Ensuring that this prohibition is observed is the shared responsibility of staff members and their institution, as staff members must immediately notify any conflict of interest situation, and institutions have the power to investigate situations of possible non-compliance.[\[21\]](#_ftn21){#_ftnref21}

**38.** Future employment is part of a staff member's personal interests.[\[22\]](#_ftn22){#_ftnref22} In the past, the Ombudsman has already taken the view that when a staff member hopes to take up a position in an entity, the staff member's personal interests become, at least to some extent, aligned with those of that entity.[\[23\]](#_ftn23){#_ftnref23} In that context, it would not be appropriate for a staff member to continue working on matters of relevance to their future employer, as this would put their impartiality at stake. Such impartiality is a core value of the EU civil service and a condition for the trust of citizens in the action of the Union. Thus, any risk of a conflict of interest must be handled swiftly and diligently.

**39.**In the case at hand, the staff member declared his intention to join Thorn about two months before joining the organisation. Europol was in contact with Thorn, and the tools developed by that entity are relevant to Europol's activities. The staff member himself was working in Europol on matters directly related to Thorn's interests, and, according to publicly available information, led the team specialised in that area. There was therefore a clear risk of a conflict of interest for a staff member in service.

**40.**Europol failed to deal with the above conflict of interest situation, putting at risk the integrity and impartiality of its actions.

**41.**That being said, the Ombudsman welcomes Europol's constructive engagement with her preliminary findings, and in particular Europol's willingness to revise its existing processes in order to ensure that they are free from error. Ensuring that Europol's decision-making process is beyond reproach is all the more important considering the regular turnover of staff inherent to Europol, as well as the topics Europol works on.

Conclusion
----------

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

**How the European Union Agency for Law Enforcement Cooperation (Europol) dealt with the move of one staff member to the private sector amounted to maladministration.**

**However, the Ombudsman, welcomed Europol's willingness to revise its existing processes and asked it to report back, within six months, describing in particular how the revision addresses the shortcomings identified in this inquiry.**

The complainant and the European Union Agency for Law Enforcement Cooperation will be informed of this decision**.**

Emily O'Reilly  
European Ombudsman

<br />

Strasbourg, 21/02/2025

[\[1\]](#_ftnref1){#_ftn1} See for instance the OECD report 'Post-public employment. Good practices for preventing conflict of interest', 2010, available at: <https://www.oecd.org/en/publications/2010/08/post-public-employment_g1gh9fe8.html>

[\[2\]](#_ftnref2){#_ftn2} Available at: <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501>

[\[3\]](#_ftnref3){#_ftn3} For instance: <https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/>

[\[4\]](#_ftnref4){#_ftn4} <https://balkaninsight.com/2023/09/29/europol-sought-unlimited-data-access-in-online-child-sexual-abuse-regulation/>

[\[5\]](#_ftnref5){#_ftn5} Available at: <https://multimedia.europarl.europa.eu/en/webstreaming/libe-committee-meeting_20231025-0900-COMMITTEE-LIBE>

[\[6\]](#_ftnref6){#_ftn6} Inspection request available at: [https://www.ombudsman.europa.eu/en/opening-summary/en/179467](/en/opening-summary/en/179467)

[\[7\]](#_ftnref7){#_ftn7} Meetings report available at: [https://www.ombudsman.europa.eu/en/doc/inspection-report/en/192216](/en/doc/inspection-report/en/192216)

[\[8\]](#_ftnref8){#_ftn8} Preliminary findings available at: [https://www.ombudsman.europa.eu/doc/preliminary-finding/199899](/doc/preliminary-finding/199899)

[\[9\]](#_ftnref9){#_ftn9} First reply to the preliminary findings available at: [https://www.ombudsman.europa.eu/doc/correspondence/199900](/doc/correspondence/199900) ; second reply available at: [https://www.ombudsman.europa.eu/doc/correspondence/199901](/doc/correspondence/199901)

[\[10\]](#_ftnref10){#_ftn10} Detailed in part 1 of the meeting report, "Europol's framework for handling risks of conflict of interest", available at: [https://www.ombudsman.europa.eu/en/doc/inspection-report/en/192216](/en/doc/inspection-report/en/192216)

[\[11\]](#_ftnref11){#_ftn11} *Van de Water v Parliament,* Case F‑86/13, para 48, available at: [https://curia.europa.eu/juris/liste.jsf?language=en\&num=T-667/18](https://curia.europa.eu/juris/liste.jsf?language=en&num=T-667/18)

[\[12\]](#_ftnref12){#_ftn12} *Pinto Teixeira v EEAS,* Case T‑667/18, para 51, available at: [https://curia.europa.eu/juris/liste.jsf?language=en\&num=T-667/18](https://curia.europa.eu/juris/liste.jsf?language=en&num=T-667/18)

[\[13\]](#_ftnref13){#_ftn13} Such as listed in Article 21 of the Commission Decision C(2018) 4048 final on outside activities and assignments and on occupational activities after leaving the service, applicable to Europol following the Management Board Decision of 14 December 2018, and available at: <https://www.europol.europa.eu/publications-events/publications/management-board-decision-commission-decision-2018-4048-outside-activities-and-assignments-and-occupational-activities-after>

[\[14\]](#_ftnref14){#_ftn14} As set out in the meeting report in case 2091/2023/AML, section 2, 'The case of the first staff member'.

[\[15\]](#_ftnref15){#_ftn15} Where the entity within Europol that took the decision recognised the possibility of a conflict of interest and imposed conditions on the move, as detailed in footnote 19 of Europol's reply of November 2024.

[\[16\]](#_ftnref16){#_ftn16} Article 21 of Commission Decision C(2018) 4048 final

[\[17\]](#_ftnref17){#_ftn17} Europol reply of November 2024, p.4.

[\[18\]](#_ftnref18){#_ftn18} As reported in the press article quoted in footnote 4, and visible on the staff member's professional profile and Thorn's Impact Report 2023.

[\[19\]](#_ftnref19){#_ftn19} Articles 11 and 11a of the EU Staff Regulations

[\[20\]](#_ftnref20){#_ftn20} Article 11a of the EU Staff Regulations

[\[21\]](#_ftnref21){#_ftn21} Article 11a(2) and Article 86(2) of the EU Staff Regulations

[\[22\]](#_ftnref22){#_ftn22} Guidance to Europol staff on Conflict of interest, available at: <https://www.europol.europa.eu/sites/default/files/documents/guidance_to_europol_staff_-_conflict_of_interest.pdf>

[\[23\]](#_ftnref23){#_ftn23} Recommendation in 2168/2019/KR, para 50: [https://www.ombudsman.europa.eu/en/recommendation/en/127638](/en/recommendation/en/127638)