EU Agencies and Information Systems collect and exchange personal data with Member States but also between each other. In this context, law enforcement agencies such as Europol increasingly get access to data originally serving other purposes. Europol already has access to the Visa-Information System; plans to allow the access to Eurodac also exist. The rules regulating this exchange are so far not harmonised. The article illustrates the existing exchange and access possibilities in light of the EU data protection reform.