How can an advocate defend a client whose data is processed by the Interpol system?

The absence of a last name on the Interpol website does not necessarily mean that no one is looking for that person. How can you find out exactly what information police databases in 196 countries hold about a client, and does the removal of a record mean that the problems are behind you?

Four databases out of nineteen

The UNBA Committee on cybersecurity and virtual assets held an online lecture titled «The Interpol information system as a personal data database: digital human rights in criminal investigations». The speaker was advocate Dmytro Konovalenko.

The speaker noted that Interpol is, first and foremost, an organization that processes personal data for criminal investigation purposes, and that information about individuals circulates among the police forces of its 196 member countries. Therefore, a defense attorney must understand how to ensure the lawfulness of a client’s data processing, up to and including its removal from the system.

The first question a client typically asks is whether they are listed in the Interpol database. The organization’s website is of little help here: it publishes only a portion of the red and yellow notices — specifically, those that the country initiating the search has chosen to make public. A more reliable approach is to submit a request to the Interpol Commission for the Control of Files (CCF), a quasi-judicial body whose decisions are binding. «We can interact exclusively with the Interpol Commission for the Control of Files. It is the only body that can respond to us, and the sole point of contact», - clarified D. Konovalenko.

Of Interpol’s 19 databases, only four are available to defense lawyers for verification and appeal: the alert system (the so-called «color cards»), databases of stolen vehicles, stolen and lost travel documents, and stolen works of art.

According to the spokesperson, the vehicle database is most commonly encountered by those who buy cars at auctions in the U.S. or Europe: a leased car is sold abroad, and when the leasing company stops receiving payments, it reports the vehicle as stolen. «I have never seen a case where data was removed from this database on the grounds that the person is a lawful purchaser», - the advocate noted.

The travel document database, in turn, can become a tool for exerting pressure: sometimes the commission removes a «red card», but the country responds by revoking the client’s passport and adding them to this database. According to the spokesperson, the former Assad regime in Syria did this on a massive scale, while the new government, following a review, revoked 24,000 such entries.

Clean only at first glance

However, appealing to the commission has its drawbacks. The first is time: one has to wait up to six months for a response to a request. The second, which is becoming increasingly common, is the restriction on data disclosure by the party initiating the search. Article 29 of the commission’s charter guarantees an individual the right to access data about themselves, but Article 35 allows the source country to restrict its disclosure — for reasons of security, the confidentiality of an investigation, or the protection of third-party rights.

«Essentially, these are very vague formulations that can be used to justify absolutely anything. And, unfortunately, when we receive a refusal to disclose information, the commission never explains why it is refusing», - emphasized D. Konovalenko. Thus, the applicant may receive all the information (type of notification, warrant, charges, purpose of the search, authorization, facts of the case), only part of it, or nothing at all.

The most bizarre case in the speaker’s experience was when the restriction even extended to the commission’s decision on a complaint regarding the removal of a record. The complaint was considered at a session, but they refused to send the decision to the applicant because the initiator of the search — the USA National Central Bureau of Interpol — had prohibited the disclosure of any data about the client.

«It’s as if a court had considered a complaint and then came out and said: I’ve considered it, but I won’t say what decision I made», - the advocate explained. The client waited a year and a half and still does not know whether he is in the database. Unofficially, however, the speaker was told that the Americans can do anything.

Four types of alerts cause the most problems for clients abroad. A Red Notice circulates through the global database and calls for arrest followed by extradition. A «Diffusion» notice serves the same purpose but is sent directly from country to country without verification by the General Secretariat — making it harder to detect. According to the commission’s 2024 statistics, Red Notices account for 59% of all alerts, while Diffusion notices account for 29%.

The speaker cautioned that a response from a single country’s police offers no guarantees. Recently, a client checked his status through official channels in Malaysia and Egypt—both countries confirmed that he was «clean». However, the commission reported that he is the subject of a red notice: access to this data is simply restricted for some countries. «That’s why I always recommend that clients contact the commission directly, because it has full access to the database and will provide all relevant information», - advised D. Konovalenko.

A Blue Notice does not lead to arrest but serves to track a person’s movements; however, it too can serve as grounds for passport revocation in countries that grant citizenship through investment, such as Turkey or Cyprus. A Green Notice, on the other hand, applies to previously convicted individuals. «It’s a very unpleasant notice because, essentially, the person has served their sentence but continues to face problems at the border», - the advocate explained.

Ten pages of arguments

The key document for a defense attorney is the Interpol Rules on Data Processing (RPD). Thus, if, following a person’s arrest, the country has not submitted an extradition request, the commission considers this a failure to fulfill the purpose of the red notice, and the data is deleted. The information must be accurate: the number of accomplices or the amount of damages cannot differ from the notice of suspicion. Additionally, the data must be of interest to international police cooperation.

To illustrate this last principle, the advocate cited a case from early in his career: a client was charged under Parts 4 and 5 of Article 191 of the Criminal Code, with damages amounting to approximately 70,000 UAH. The commission converted this amount to euros — approximately 6,500 — and concluded that such a crime did not warrant the involvement of police forces from all countries.

Since the beginning of this year, the commission has transitioned to a new portal with two-factor authentication — something akin to «Electronic Court», as the speaker put it. A request for access is reviewed within four months; requests for data deletion or correction take nine months. The statement of grounds is limited to 10 pages, attachments to 20, and requests for access and complaints regarding deletion must be submitted separately.

The commission has also been granted the authority to initiate legal proceedings for the submission of false documents. Therefore, the spokesperson advises drawing up a document transfer letter with the client. In his practice, there was a foreign national who claimed to have served in the Armed Forces of Ukraine; however, upon the commission’s request, the Ministry of Defense reported that no such servicemember had ever existed.

At the same time, according to observations by an advocate who has been working with the commission since 2016, the quality of its work has declined significantly since 2022, and the complaints currently under review were deemed admissible in late 2024 or early 2025. «My colleagues and I divided the number of cases reviewed by the number of sessions and calculated that the commission spends 5–10 minutes on a decision regarding a single complaint», - the spokesperson said. According to him, some clients are already being extradited during that time, so the institution’s effectiveness is currently negligible.

Cases involving asylum seekers and refugees are resolved more quickly: as soon as a country confirms their status for international protection, the data is deleted. This circumstance, as well as clear indications of non-compliance with Article 3 of the Interpol Constitution or silence from the requesting country, may also serve as grounds for temporarily blocking the data until the review is completed.

An indelible record

Data can be deleted by the Commission, the General Secretariat (through the Notices and Diffusions Task Force), and the requesting country itself. The General Secretariat does not explain its reasons, so it is impossible to predict whether a person will reappear in the database. The requesting country, however, often withdraws the data itself when it realizes that the Commission will delete it.

«This gives the country a legal opportunity to re-enter the data after seeing which way the protection is leaning, to resolve any contradictions, or even to submit a new record. I speak and write about this very often: in fact, this is a violation of the right to protection», - the advocate emphasized.

But even the commission’s decision isn’t the end of the story. Some countries do not update their national databases, and a client may be detained for several days while the circumstances are being clarified. The data may remain in the Schengen Information System (SIS) if a European arrest warrant has been issued at the same time, as well as in the private compliance databases World-Check and LexisNexis: in one case, a client experienced visa issues even after being removed from Interpol, and a bank closed his account.

Therefore, as D. Konovalenko advised, after receiving a decision on removal, it is worth analyzing where the client lives, where they travel and which banks they use to minimize such risks.

This article was prepared by Viktoria Yakusha, «Law and Business».