To attend the championship this year, fans must use a digital ticket provided through UEFA’s Ticket application. According to Heise, this app requires access to personal data, including name, email, phone number, and GPS permissions. While app store descriptions note the collection of personal information and activity data for analysis purposes, they omit any mention of location sharing.
You seem to be operating on a mistaken understanding of the EU. While the EU works to protect citizens within the EU from being monitored, tracked, and monetized by foreign entities and private EU companies, they have no concept of personal privacy of citizens within the EU from the EU governments themselves. If the data is being sent to the police, it is legal. See the EU Councils position on encryption and what level of access law enforcement within EU nations should have.