The Law Enforcement Directive – data protection challenges in practice

When asked to describe whether they were satisfied with investigatory powers as granted to them by law, most of the DPA staff interviewed by FRA considered these powers to be sufficient. Several respondents acknowledged, however, that this statement was based on a low number of investigations conducted: given resource shortages, most investigations are reactive (based on a complaint or on notifications of breaches).

Some respondents from DPAs highlighted that they consider it helpful to be involved at a very early stage when a data processing operation is being developed. Indeed, most of the DPA staff interviewed confirmed that they were consulted on issues or asked questions about procedures that were outside the scope of what competent authorities are required to do. Examples include the use of specific technologies, such as AI, CCTV, facial recognition, drones or biometric data, and other topics, such as issues related to seized documents, the superfluous collection of data or disclosure of third-person data during disciplinary proceedings. A few DPA employees flagged some negative effects that these unofficial requests may have, namely that DPAs cannot provide data controllers with legal advice and are already stretched under workloads stemming from official requests, complaints or investigations. A few other interviewees indeed highlighted that it may be difficult for them to assess where to draw a line between requirements to provide guidance.

Some respondents from DPAs emphasised that investigations benefited from good cooperation with competent authorities, and several insisted on the essential role of DPOs during their investigations. Similarly, many interviewees confirmed that their DPA maintains a list of LED DPOs at the national level, although some experts interviewed by FRA stated that they do not have or require such a list, as they know DPOs in law enforcement. FRA also asked about whether, to their knowledge, DPA officials were contacted in confidence by DPOs from law enforcement or the judicial authorities to raise issues confidentially. Several of them stated that this was the case: in some cases, this related to processing of data that the DPO saw as potentially problematic and, in other cases, it related to DPOs’ opinions not being taken on board. In one Member State, the DPA interviewee explained that they know it is difficult for DPOs to be heard by police chiefs and for a balance to be found between operational necessity and data protection, referring to this as being ‘a daily battle’. In another case, a DPA interviewee stated that, ‘while not strictly whistleblowing’, DPOs contacted them to raise issues related to resources and institutional capacities.

[Having the DPO as the main point of contact] is very beneficial, as they are knowledgeable, understand the issues, and know what needs to be done.

An officer at a DPA

Some interviewees from the DPAs indicated, however, that they do not systematically turn to DPOs when there is an investigation and instead contact them only on a ‘needs basis’. They consider that only data controllers should be approached during an investigation and that the DPOs should be approached only if they played an active role in the data processing under investigation. Indeed, FRA’s findings also identified some dissonant perceptions in the appreciation of the role of the DPOs: while a majority consider DPOs as their direct interlocutors, one interviewee considered them as being ‘part of their institution’ and, therefore, not independent enough to be trusted interlocutors of the DPA. Another interviewee considered the DPO to be an ‘internal supervisor’.

Several DPA interviewees identified what they considered to be a serious lack of expertise and understanding of LED requirements within law enforcement and judicial authorities and, remarkably in a few cases, by DPOs. One example of this can be found in challenges identified by DPAs when it comes to notifications of personal data breaches. Some respondents highlighted to FRA that they believe there is ‘little awareness in law enforcement authorities’ of when data breaches should be reported. Two issues were identified: the first was related to the seriousness threshold (one interviewee clarified that competent authorities would only report breaches that pose ‘great risk’, which, in their view, could potentially contradict Articles 10 and 17 of the LED) and the second was in regard to the differentiation between potential and confirmed breaches. The thresholds of the seriousness of the breach were indeed identified as lacking clarity for both operational staff and DPAs by a number of experts interviewed.

One challenge the DPA faces is that the thresholds for identifying data breaches are not as stringent under the LED as they are under the GDPR.

An officer at a DPA

For their supervisory mandate to be effective, the LED provides that DPAs should be entrusted with corrective powers, such as issuing warnings, ordering controllers to bring processing operations into compliance or imposing temporary or definitive limitation – including bans – on processing (Article 47(2) of the LED). DPAs were asked whether they faced any enforcement issues and, in particular, whether the application of criminal procedural law prevented them from using these corrective powers in practice, given the independence and secrecy of criminal investigations.

A majority of DPAs stated that they did not face any resistance stemming specifically from the national criminal procedural law in the application of corrective powers; several of them mentioned that there had been no or very few cases that ended in corrective powers being applied under the LED. Several DPAs insisted that they were very aware of the limited scope of their investigations when it comes to criminal investigations, also recalling that, de facto, this limits the cases in which corrective powers can be applied.

In the few interviews in which respondents identified limitations linked to the application of the criminal procedural law, the following issues were raised.

• In one case, the DPA expressed concerns that the code of criminal procedure could impair data protection in a way that is not justifiable, as it is considered by law enforcement authorities as excluding the DPA from applying both investigatory and corrective powers.

The [law enforcement authorities, including corresponding ministries] are of course also bound by law and order. They therefore ensure that the law is observed, including in their subordinate authority. However, [they believe that] no independent third body such as the [DPA] should come in and presume to know better and exercise legal supervision … I would now counter that with ‘Yes, but that’s how it’s intended by the European legislator’ … [W]e, as the DPA, have special legal supervision over the law enforcement authorities in the duty area, namely for data protection law.

An officer at a DPA

• In another case, the DPA stated, that they have no possibility to prevent the disclosure of personal data after a seizure by the prosecution or by the national bureau of investigation, as it is mandated by criminal procedural law. The interviewee believes that competent authorities perceive this as a case in which a specific law overrides general rules: ‘we were unable to have the names of the other … victims or the defendant’s criminal record removed from the indictment because the … court ruled that the Criminal Procedure Code explicitly allows such disclosure’.
• In a few cases, interviewees reported that their investigations must be stopped when data processing is related to criminal investigations, that is, for secrecy reasons, for reasons related to the protection of the evidence or when an administrative misdemeanour is classified as a criminal offence at a later stage.

While not specifically related to the application of the criminal procedural law itself, some interviewees identified further challenges when it comes to the enforcement of the LED legal regimes, including corrective powers. One interviewee noted that the legislator specified cases when a fine cannot be imposed for violations under the LED legal regime, which has created ‘a skewed relationship between the competent authorities under the LED’, namely those that may receive fines and those that are exempt from the application of such corrections. One interviewee stated that the main challenge stems from the fact that ‘sanctioning public authorities and paralyzing data processing [by these institutions] would have a significant political influence’.

Finally, to ensure its consistent application, the LED sets out that DPAs should provide each other with mutual assistance. In its first evaluation, the Commission reported that mutual assistance had been very rarely utilised to date. FRA’s research confirms this finding: for a majority of the DPAs interviewed, cooperation with other EU DPAs mostly takes place under the GDPR regime. Some of the cases mentioned by the DPAs referred to inquiries asking about the interpretation of provisions of the LED. However, in general, the mutual assistance regime is not seen as valuable or relevant for LED-related matters. A few DPAs also noted that cross-border cases can be dealt with under the Europol Regulation [30] Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53, ELI: http://data.europa.eu/eli/reg/2016/794/oj).
. Similarly, almost all of the DPAs stated that their authority did not investigate transfers of personal data to non-EU countries or international organisations, as, in their view, this would fall outside the scope of the LED or would fall under the national security exemption.

The findings reveal systemic obstacles to DPAs’ effective investigation of law enforcement and judicial authorities. While most DPAs consider their legal powers sufficient, resource constraints relegate enforcement to reactive, complaint-driven actions, leaving proactive oversight neglected. Early engagement with authorities on topics such as AI, biometrics or surveillance technology is valuable but informal, creating blurred boundaries between guidance and enforcement. The lack of in-house IT expertise further hampers the scrutiny of modern technologies, with DPAs struggling to assess risks in facial recognition, drones or big data analytics. Although some outsource or recruit specialists, most lack the capacity to keep pace with technological advances.

Access to data emerges as a recurring friction point. While security clearances generally facilitate access, classified materials and national security exemptions (Article 10 of the LED) create deadlocks, with some interviewees noticing that authorities may invoke procedural laws to withhold information. Disputes over what constitute ‘necessary’ data may further delay investigations, as police push back on disclosure requests.

Expertise gaps can reinforce these challenges. Some DPAs indicated that they struggle with scrutinising law enforcement justifications due to a lack of operational insight. DPOs’ variable competence (from highly skilled to underprepared) adds inconsistency, with some DPAs being contacted in a ‘whistleblowing’ capacity by DPOs who are frustrated by their advice being ignored. Breach notifications also exemplified this, as some respondents indicated that they believe that there is little awareness within law enforcement authorities regarding when data breaches should be reported, leading to misjudged thresholds of only ‘high-risk’ incidents being reported.

Enforcement powers can also face legal and political hurdles. While most DPAs report no resistance from criminal procedural laws, exemptions for ‘ongoing investigations’ shield authorities from corrective actions. Sanctions are rare, with political sensitivities deterring fines or processing bans against public bodies. Mutual assistance (Article 50 of the LED) is largely unused, hindered by divergent national implementations and a cultural reluctance to collaborate.