Filing a CCF request: a step-by-step guide

The Commission for the Control of INTERPOL’s Files is not a department of INTERPOL but an independent body: Article 4 of its Statute is headed exactly that, Independence of the Commission. Member countries must respect its competence, respond diligently to its requests and ensure that no national authority interferes in its work (Article 5).

The Commission has seven members and is divided into two chambers (Articles 6 and 8). The Supervisory and Advisory Chamber oversees data processing in general and advises the Organization. Your request never reaches it.

Requests from individuals are handled by the Requests Chamber — five lawyers with strictly defined expertise: a lawyer with data-protection expertise; a lawyer with recognised international experience in police matters, in particular international police cooperation; a lawyer with international criminal law expertise; a lawyer with human rights expertise; and a lawyer who holds or has held a senior judicial or prosecutorial position, preferably with experience in international judicial cooperation (Article 8(4)).

Draw the practical conclusion from that list before writing a single line. Five lawyers will read your submission, and they will read it as a legal document. A letter about how unfairly you were treated is not an argument to them — not because they are unfeeling, but because that is not what they are empowered to decide.

It is the Requests Chamber that holds the exclusive power to examine requests for access to, or correction and deletion of, data and to take final decisions on them (Article 3(1)(c)). Neither the General Secretariat, nor the requesting country, nor any court reviews those decisions.

Formally you do not file a complaint against INTERPOL but one of two requests, and confusing them is expensive.

A request for access answers a single question: whether data concerning you are being processed in INTERPOL’s systems. It needs no reasons — asking is enough. The Statute allows four months from the date the request is declared admissible (Article 40(1)).

A request for correction or deletion is an assertion that the processing breaches INTERPOL’s rules, together with a demand that this be put right. Article 30(2) expressly requires the reasons to be set out: a submission without them is not a request within the meaning of the Statute. The deadline is nine months from the same starting point (Article 40(2)).

You may file both at once, and often that is sensible. In the Commission’s statistics a combined request is counted only as a deletion request, but both aspects are addressed.

Which to choose depends on what you already know. If you only suspect a record exists, starting with an access request is logical: without knowing what is actually being processed, any reasoning will be speculative. If the ground is obvious and documented — asylum granted, extradition refused in the same matter, proceedings discontinued — a combined request saves months, because otherwise you wait four months to learn whether data exist and then nine more for a decision on the merits.

How the caseload actually splits is shown by the Commission’s 2024 report: roughly 37 per cent were requests for access, 45 per cent requests for deletion and 18 per cent applications for revision of earlier decisions.

On 26 March 2026 the way requests are filed changed, and that is the single most out-of-date item in every older guide. Requests are accepted only through the Commission’s dedicated secure online portal. Postal and e-mail submissions are no longer accepted save in exceptional circumstances. Advice to send a bundle of documents to Lyon now means lost time.

Language. Article 30(2) requires a request to be submitted in writing in one of the Organization’s working languages, and Article 18(1) names them: Arabic, English, French and Spanish. A submission in any other language is not a technicality to be overcome by persistence; it is a reason for the request not to proceed.

Who may file. The person concerned or a duly authorised representative (Article 30(2)). A lawyer is not formally required.

Cost. There is none: Article 30(3) provides that no charge is made for the submission of a request, and the Commission confirms that it collects no fee of any kind. Any offer to arrange payment for removal from INTERPOL’s database is selling something that does not exist.

The portal’s technical limits are worth planning around, or part of your evidence simply will not upload. Attachments are accepted in pdf, doc, docx, xls, xlsx, csv, txt, rtf, html, jpg, jpeg, png and gif. Video and audio files are not accepted at all — a recording has to be submitted as a transcript.

A request has two parts: who you are, and why the processing breaches the rules. The first is administrative — the applicant’s identity and an address for correspondence. The second decides the outcome.

The grounds are set out by reference to specific rules: Article 3 of INTERPOL’s Constitution on matters of a political, military, religious or racial character; Article 2 on human rights; the provisions of the Rules on the Processing of Data concerning accuracy, currency, proportionality and the existence of a purpose. The phrase the case is fabricated is not a rule and gives you nothing to stand on.

Evidence is produced as documents, not as narrative. What works: a chronology with the dates of departure, of a public position and of the case being opened; decisions of other states’ courts in the same matter; a refusal of extradition; asylum or refugee status granted; materials showing the dispute is in substance commercial.

One requirement is written into the Statute yet almost never mentioned. In determining remedies the Requests Chamber takes into account, among other things, the steps that have been taken or should reasonably have been taken by the applicant before the competent authorities of the source of the data, and any remedy already provided to the applicant by those authorities or available from them (Article 39(4)). In practice: show that you tried to resolve the matter where it arose. A submission that reveals nothing was attempted at home is weaker than one that attaches the national complaints and the replies to them.

Volume by itself does not help. The Commission’s 2024 report names the growing complexity and bulk of annexes as one cause of delay. Three hundred unstructured pages are not the strength of a position; they are months of waiting.

The first thing that happens to your submission is an admissibility check. The Requests Chamber must inform the applicant at the earliest opportunity and no later than one month from the Commission’s receipt of the request (Article 32(1)).

Any request considered incompatible with the Statute and with the admissibility criteria defined by the Commission in its Operating Rules is declared inadmissible (Article 32(2)). Where a request is declared inadmissible in whole or in part, the reasons are explained to the applicant (Article 32(3)).

That date matters more than it appears, and it is where people miscount most often. The four- and nine-month periods run not from the day you sent your documents but from the day the request was declared admissible. A month can pass between those dates, and more if anything needs completing.

The Commission’s report also names a typical way of falling outside its mandate: submissions presented as deletion requests but pursuing aims beyond its competence — for instance, asking for national proceedings against the applicant to be discontinued. The Commission cannot grant such requests at all.

That produces a short list of reasons a submission never reaches the merits: the wrong language, no grounds set out in a deletion request, relief the Commission has no power to grant, an incomplete set of documents. None of them has anything to do with how strong your position is.

The Commission notifies the General Secretariat of the request and makes the information in it available to the Secretariat (Article 33(1)), then asks it to check whether data concerning you are being processed in the INTERPOL Information System. The Secretariat has 45 days to answer (Article 33(2)).

If no data are being processed, the Requests Chamber decides on appropriate measures taking confidentiality requirements into account (Article 33(3)). The answer in that situation is sometimes less direct than one would like — precisely because of that confidentiality proviso.

If data are being processed and the request seeks deletion or correction, a review of compliance with INTERPOL’s rules begins. The scope of that review is limited to this and nothing else (Article 33(4)). If the request concerned only access, the Chamber may nonetheless decide to examine compliance on its own initiative.

The Chamber then seeks information or clarification from the source of the data and from the General Secretariat, and where necessary from other entities (Article 34). Proceedings are conducted on written submissions; hearings are held only if the Chamber deems them necessary (Article 36), which in an ordinary case means not at all.

There is also a distinct cause of delay worth knowing about in advance. If the General Secretariat is itself examining the compliance of the same data at the time your request is pending, the Chamber examines the request only after the Secretariat has decided and implemented its decision. The Statute expressly treats this as circumstances warranting an extension of the time limit (Article 33(5)).

This is the most underestimated part of the procedure, and almost nobody warns about it. Information connected with a request is accessible to the applicant and to the source of the data, but subject to restrictions that the Statute sets out in an article of their own (Article 35(1)).

Before disclosing anything, the Chamber consults the owner of that information — you or the source country (Article 35(2)). Disclosure may be restricted by decision of the Chamber, on its own initiative or at the request of the source, the General Secretariat or the applicant, on one of four grounds: to protect public or national security or prevent crime; to protect the confidentiality of an investigation or prosecution; to protect the rights and freedoms of the applicant or third parties; or to enable the Commission and the Organization to discharge their duties properly (Article 35(3)).

One detail here works in your favour. Any restriction must be justified and must specify whether some information, such as a summary, may still be provided. The absence of justification will not by itself lead to disclosure, but it may be taken into account by the Chamber in assessing and deciding the request (Article 35(4)). In plain terms, unexplained secrecy on the requesting country’s part counts against it.

The Chamber may also direct the applicant to contact the competent authorities of the source of the data, provided this does not compromise the confidentiality of the case (Article 35(5)).

And the reality the Commission states plainly in its 2024 report: agreeing with national bureaux on what may be disclosed to the applicant consumes a great deal of time, and in some cases the restrictions are such that the Commission is not in a position to share even its reasoned decision with the parties. Be ready for that: you may win and never learn exactly why.

On paper: four months for a request for access and nine for a request for correction or deletion, both running from the date the request was declared admissible (Article 40). The Chamber may extend the limit where the circumstances of a particular request warrant it; any extension must be reasonable, promptly communicated to the parties and explained in the decision itself (Article 40(3)).

In life it is otherwise, and the Commission says so itself. In 2024, 70 per cent of access requests took more than four months and 30 per cent of deletion requests more than nine. The Commission calls the delays problematic for applicants, for national bureaux and for INTERPOL itself.

The reasons are listed in the same report: a record number of requests, a backlog from earlier years, late responses from the General Secretariat units involved, lengthy exchanges with bureaux about how much may be disclosed, and the growing complexity of the requests themselves. In November 2024 the General Assembly granted the Commission additional resources — staff, member time and new technical tools.

The calendar matters too. From 2026 the Commission holds three longer sessions a year — in late January, early June and at the turn of September and October — with an optional fourth in December. A case is examined at a session; between sessions the Chamber mainly disposes of clear-rule breaches.

The Commission itself asks not to be chased: enquiries about an outcome should wait at least three months after the date of the session. Once a decision becomes final the applicant is notified within one month, and for correction and deletion requests the General Secretariat has a further month to comment before that final notification.

A decision of the Requests Chamber is final and binding on the Organization and on the applicant (Article 38(1)). It is given in writing and reasoned: a summary of the proceedings, the parties’ submissions, a statement of the facts, the application of INTERPOL’s rules, an analysis of the legal arguments and the operative parts (Article 38(2)).

Then implementation begins. The written decision goes to the General Secretariat within one month of being taken; the Secretariat implements it within one month of receipt, or within one month of receiving any clarifications it needs (Article 41).

Decisions on access requests are provided to the applicant within one month of adoption. Decisions on correction or deletion requests are provided promptly and no later than one month after the Chamber is notified of their implementation (Article 41(3)). The difference is simple: in the second case the data must be removed first, and only then are you told.

Where data have been corrected or deleted, the General Secretariat promptly notifies the members that had previously received those data, other than the source (Article 41(4)). Copies already dispersed into national databases do not vanish automatically — the notification starts the process, and what follows is up to each country.

Deletion is not the only possible outcome. The Chamber may decide on any appropriate corrective action, and where it finds a breach it may also grant other appropriate remedies, within the Organization’s own responsibilities and the processing of data in its system (Article 39).

There is no appeal in the ordinary sense. The decision is final, there is no higher instance within INTERPOL, and no court reviews it on the merits.

The one mechanism provided for is revision under Article 42. An application may be made only where it is based on the discovery of facts that could have led the Chamber to a different conclusion had they been known when the request was being processed.

Read that wording literally: a new fact, not a new argument. The same file rewritten more persuasively, or a reference to a rule you forgot, is not a revision.

The deadline is six months after the discovery of the fact (Article 42(2)). The time limits for deciding an application for revision are those that apply to ordinary requests (Article 42(3)).

Revision is not exotic: in 2024 applications for revision made up 18 per cent of all new admissible requests to the Commission.

And the main thing. A refusal does not close the other routes, and parallel proceedings generate new facts by themselves. An extradition refused, asylum granted, a case discontinued at home, a national court ruling — each such event both changes your position and gives you grounds to return to the Commission.

The Commission publishes an annual activity report, and it is the only open source from which the procedure can be judged on something other than impressions.

2024 was a record year on both sides: 2,586 new admissible requests and 2,717 closed — more than ever in the Commission’s history. It attributes the growth to the general expansion of personal-data processing for law-enforcement purposes and to the attention now paid to data-protection standards.

The most useful figure for anyone still deciding whether to file an access request: of 948 admissible access requests, 57 per cent (544) came from people about whom INTERPOL’s systems held no data at all. Among deletion requests the share was 36 per cent (423). More than half of these fears are not borne out.

Among those whose data were in fact being processed — 1,157 people — the records broke down as 59 per cent (687) notices, 29 per cent (335) diffusions and 12 per cent (135) other categories of data, such as lost travel documents or stolen vehicles.

The Commission publishes anonymised extracts from its decisions on its website, grouped by topic and going back to 2017, and in 2024 it specifically noted the expansion of that practice as a transparency measure. It is the only open material on which arguments actually work, and it is worth reading before filing rather than after a refusal.

Filing in a language other than the four working ones. A formal reason not to take the request forward; the lost time is the most expensive part, because admissibility has to be gone through again.

A deletion request with no grounds set out. Article 30(2) requires them expressly, and please check and delete does not meet the requirement.

Asking for relief the Commission cannot grant: discontinuing a criminal case, cancelling a national wanted listing, ordering a country to act. Such submissions fall outside the mandate and are filtered out.

Arguing guilt instead of arguing the rules. The scope of review is limited to whether the processing complies with INTERPOL’s rules (Article 33(4)) — the Commission does not weigh criminal evidence and has no power to.

Staying silent when the country’s position is put to you. You are told the date of the session and the deadline for additional submissions (Article 31(3)); that deadline is set once, and after the session there is no returning to your arguments.

No trace of any attempt at national level. Article 39(4) expressly directs the Commission to consider what the applicant has done, or should reasonably have done, before the authorities of the source country.

Counting on speed, or on an intermediary promising a result by a date. Cases are examined at three sessions a year; neither money nor connections affects that calendar.

Everything involving the Commission itself is free. Article 30(3) of the Statute: no charge is made for the submission of a request. The Commission confirms that it collects no fee, either for access requests or for challenges. There are no filing fees, no expedited tariffs and no paid database checks.

What costs money is legal work, and it begins long before the portal: analysing the case and assessing its prospects, gathering and translating evidence, building the position on specific rules, drafting in one of the Organization’s working languages, and running proceedings that last months and require submissions by set deadlines.

The scope varies. For some people an access request is enough to establish that there are no data. Others need a full challenge with human-rights argument and parallel proceedings across several jurisdictions.

A promise to delete by a date for a fixed sum is a reliable sign of a bad-faith provider. The decision is taken by a chamber of five lawyers on the written file at its session; no one can guarantee the outcome, speed up the review or know the result in advance.

Indicative figures by format are on the Pricing page. A consultation with a lawyer costs 100 € and is credited against the cost of the work; the first reply to an enquiry is free.