Three Routes Through the CCF: Access, Deletion and Preventive Requests Compared
You already know the problem exists. What you do not yet know is which legal instrument actually solves it. When a client comes to us because a US NCIC record is surfacing in background checks, visa interviews, licensing reviews or foreign police cooperation channels, the first question is rarely “what is an NCIC record?” The first question is: which of the three procedural routes available through the Commission for the Control of INTERPOL’s Files (CCF) fits my situation right now? The answer determines your evidence burden, your timeline, and ultimately whether you remove US NCIC data from the international information flow or merely learn what is being circulated about you.
This comparison treats the three routes as parallel tracks rather than sequential steps. In practice, many clients combine them, but each track has its own logic, its own documentary requirements and its own realistic timeframe. Choosing the wrong track first can cost six to twelve months. Choosing the right one can compress the process considerably. Below, we map each route on its own terms, then close with a decision matrix you can apply to your own facts.
Track One: The CCF Access Request as a Diagnostic Instrument
The access request is the entry-level instrument, and it is fundamentally diagnostic. Its purpose is not to delete anything. Its purpose is to establish, on the record, what data INTERPOL actually holds and whether that data is being processed in a way that is lawful. For a client whose US NCIC-derived information may have been transmitted internationally, the access request answers a threshold question that no amount of speculation can resolve: is there an INTERPOL file, and what does it contain?
The evidence burden here is comparatively low. You are not required to prove that a record is inaccurate or that its retention violates the applicable rules. You are required to identify yourself, establish your standing as a data subject, and submit the request through the correct channel with adequate identity documentation. The CCF then conducts its own review of the files and responds with the information it is permitted to disclose. In practice, this often means a summary rather than a verbatim printout, because certain source-protection rules limit full disclosure, but the summary is usually enough to determine whether a Red Notice, Diffusion, or other notice exists and which national authority requested it.
Timelines for access requests are measured in months, not weeks. The CCF processes a high volume of requests, and the identity verification and file retrieval stages each consume time. A realistic expectation is several months from submission to substantive response, with the possibility of extension where the request touches multiple notices or multiple requesting countries. The strategic value of the access request is that it converts uncertainty into a documented factual baseline. Without it, every subsequent filing is built on assumptions.
One practical caution: the access request is not a substitute for legal analysis. The response tells you what exists. It does not tell you whether the underlying notice is vulnerable to challenge, whether the requesting state’s conduct creates grounds for deletion, or whether a preventive filing would be more effective than a deletion filing. Those judgments require a lawyer who reads the CCF’s response against the applicable rules and the client’s broader exposure.
Track Two: The Deletion Request as a Corrective Instrument
The deletion request is the corrective track. It assumes you already know a record exists, or you are prepared to file on the basis of strong circumstantial evidence, and it asks the CCF to order the removal of data that should not be processed. This is the track most clients instinctively want, and it is also the track with the highest evidentiary demands.
To succeed on deletion, you must typically establish one or more of the following: that the data is inaccurate or incomplete; that it was obtained or processed in violation of INTERPOL’s rules; that the underlying national proceeding was politically motivated or otherwise abusive; that the requesting state has withdrawn or abandoned the basis for the notice; or that continued processing serves no legitimate purpose proportionate to the harm to the data subject. Each of these grounds carries its own documentary burden, and the CCF applies a structured review rather than a general fairness assessment.
The evidence package for a deletion request is therefore substantial. It may include court judgments, prosecutorial decisions, witness statements, expert affidavits on the requesting state’s legal system, proof of acquittal or discontinuance, documentation of asylum or refugee status, and in some cases evidence of the requesting state’s pattern of abusive notices. The quality of this package, not the volume, determines outcomes. A tightly organized submission that maps each document to a specific rule violation will outperform a thick bundle of undifferentiated attachments.
Timelines for deletion requests are longer than for access requests, typically extending well beyond the access timeline because the CCF must review the merits, may seek observations from the requesting state, and must deliberate on contested facts. Where the requesting state opposes deletion, the process can run a year or more. Where the requesting state does not respond or affirmatively supports deletion, the process can move faster. The deletion track is where the strategic choice of forum and the quality of legal representation matter most.
It is worth noting that deletion requests often follow an access request rather than preceding it. Filing for deletion without first confirming what exists risks attacking a record that has already been removed, or attacking the wrong notice entirely. The disciplined sequence is access first, then deletion, unless the client’s circumstances make immediate deletion filing unavoidable.
Track Three: The Preventive Request as a Forward-Looking Instrument
The preventive request operates on a different logic entirely. It is not reactive. It is designed to prevent the future processing of data that has not yet been circulated, or to pre-empt a notice that the client has credible reason to believe is being prepared. This track is underused, and it is often the most valuable for clients who are still in a position to act before a notice goes live.
The evidentiary burden for a preventive request is unusual. You are not proving that existing data is unlawful. You are establishing a factual and legal record that demonstrates why any future notice based on the identified national proceeding would violate INTERPOL’s rules. This typically requires evidence that the underlying proceeding is politically motivated, that it lacks basic fair-trial guarantees, or that it concerns conduct that should not give rise to international police cooperation. The CCF then considers whether to issue a preventive decision that constrains the organization’s future processing.
Timing is the critical variable. A preventive request filed before a notice is published can spare the client years of reputational and professional damage. A preventive request filed after publication is essentially a deletion request in different clothing. The window for preventive relief is therefore narrow, and it closes the moment a notice is uploaded. Clients who suspect they are at risk, whether because of a pending foreign investigation, a politically charged prosecution, or a pattern of requests from a particular jurisdiction, should evaluate the preventive track early rather than waiting for a notice to appear.
Timelines for preventive requests vary with complexity. A well-documented request addressing a single identified proceeding can be resolved within a timeframe comparable to a deletion request. A request touching multiple potential notices or multiple jurisdictions can take longer. The advantage is that preventive relief, once granted, shapes future conduct rather than merely correcting past conduct, which makes it structurally more efficient than waiting to litigate a deletion after the damage is done.
Decision Matrix: Matching the Instrument to the Situation
The three tracks can be organized into a simple decision matrix based on what you know and what you need.
If you do not know whether a record exists: file an access request. It is the lowest-burden instrument and the only reliable way to establish the factual baseline. Do not file for deletion on speculation.
If you know a record exists and it is inaccurate, abusive, or obsolete: file a deletion request. Build the evidence package around specific rule violations rather than general hardship. Expect a longer timeline and prepare for the requesting state to participate.
If no record exists yet but you have credible reason to believe one is coming: file a preventive request. Act before publication. The evidentiary burden is comparable to deletion, but the strategic payoff is higher because you are preventing harm rather than repairing it.
If you are uncertain which track applies: begin with access, then reassess. The access response frequently clarifies whether deletion or prevention is the right next step, and it prevents the common error of filing a deletion request against a notice that has already been deleted or that was never a notice at all.
In practice, sophisticated clients often run access and preventive tracks in parallel where the facts support it, using the access response to inform the preventive submission. This is a tactical decision that depends on the specific jurisdiction, the nature of the underlying proceeding, and the client’s tolerance for a longer overall timeline in exchange for a more complete record.
How National Data and International Notices Interact
A recurring source of confusion is the relationship between national databases such as the US NCIC system and INTERPOL’s international notices. These are distinct systems with distinct legal bases, but information can flow between them. A US NCIC record may be referenced in a foreign investigation, and in some circumstances that reference can contribute to the issuance of an INTERPOL notice or diffusion. This is why clients seeking to remove US NCIC data from international circulation often need to address both the national record and any derivative international processing.
The CCF’s jurisdiction is limited to INTERPOL’s own data processing. It does not directly order the deletion of national records. However, a CCF decision can have practical consequences for how national data is shared internationally, and it can create a documented record that supports parallel efforts in national jurisdictions. Understanding this interaction is essential to sequencing the three tracks correctly, because a deletion request that ignores the national source may leave the underlying data available for future re-circulation.
For clients facing both a national record and an international notice, the practical approach is usually to pursue the CCF tracks while simultaneously addressing the national record through the appropriate domestic channels. The two efforts reinforce each other: a favorable CCF decision strengthens the case for national correction, and a corrected national record removes the raw material for future international processing.
Frequently Asked Questions
Who is eligible to file an access request with the CCF?
Any individual who believes INTERPOL may hold data about them can file an access request. You do not need to be the subject of a published notice. You need to establish your identity and standing as a data subject, and you need to submit the request through the correct channel with adequate identity documentation. If you are uncertain whether a record exists, the access request is the appropriate first step.
Can I file a deletion request without first filing an access request?
Yes, but it is usually not advisable. Filing for deletion without confirming what exists risks attacking the wrong record or a record that has already been removed. In most cases, the disciplined sequence is access first, then deletion, unless the client’s circumstances make immediate deletion filing unavoidable. The access response also helps identify the specific grounds for deletion and the requesting authority, which sharpens the deletion submission.
How long does a preventive request remain effective?
A preventive decision constrains INTERPOL’s future processing of the identified data. Its effectiveness depends on the scope of the decision and whether the underlying circumstances change. If the requesting state later submits new information or a new legal basis, the preventive decision may need to be revisited. This is why preventive relief is best understood as a durable but not permanent shield, and why ongoing monitoring of the client’s exposure is part of a complete strategy.
What happens if the requesting state opposes my deletion request?
Where the requesting state opposes deletion, the CCF will consider its observations alongside your submission. This extends the timeline and raises the evidentiary stakes. Your submission must anticipate the requesting state’s arguments and address them directly, ideally with documentary evidence rather than assertion. Contested deletion requests are where the quality of legal representation has the greatest impact on outcomes.
Does a CCF decision automatically remove a US NCIC record?
No. The CCF’s jurisdiction is limited to INTERPOL’s own data processing. A CCF decision does not directly order the deletion of national records such as those held in the US NCIC system. However, a favorable CCF decision can support parallel efforts to correct or remove national data, and it creates a documented record that is useful in those proceedings. Clients seeking to remove US NCIC data from international circulation should pursue both the CCF tracks and the appropriate national channels.
