Even Europol is subject to the GDPR

It appears that Europol has been collecting personal data related to individuals who are not subject to any ongoing criminal investigations (see Gizmodo article), and that Europol has not acted to reduce such data collection or to delete such data. This recalcitrance led the European Data Protection Supervisor to order Europol to delete the personal data of EU individuals who are not subject to any ongoing criminal investigations and to impose a data retention period (see article).

It will be interesting to see how Europol complies with this order.