The Law Enforcement Directive – data protection challenges in practice

Crime prevention and criminal investigations generate vast amounts of personal data, from victims’ statements and witness information to biometric identifiers and digital traces. These can include some of the most sensitive personal data and are routinely processed by law enforcement and judicial authorities. According to the European Commission, 85 % of criminal investigations rely on electronic evidence, coupled with a significant increase of requests for data from service providers (covering both internet and over-the-top service providers) in the past years [4] Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions – Roadmap for lawful and effective access to data for law enforcement, COM(2025) 349 final of 24 June 2025.
. Ensuring that such data are used effectively to combat crime while safeguarding fundamental rights is a central, yet challenging, concern of EU data protection law.

This report provides insights into the experiences, practices and challenges of law enforcement and supervisory authorities when implementing data protection law, based on the EU Law Enforcement Directive (LED) [5] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).
.

The LED governs the processing of personal data for law enforcement purposes. More precisely, Article 1 of the LED imposes rules and principles to ensure ‘the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. Competent authorities include both law enforcement and judicial authorities and are defined in Article 3 of the LED as ‘any public authority competent for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security’. Supervisory authorities refer to the national data protection authorities (DPAs) in charge of monitoring the application of the LED at the national level.

The LED is considered a lex specialis of the General Data Protection Regulation (GDPR) [6] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).
. It is less well known than the GDPR and has been under-researched since its entry into force in May 2016 and has not benefited from much guidance [7] See Kosta, E. and Boehm, F. (eds), The EU Law Enforcement Directive (LED): A commentary, Oxford University Press, Oxford, 2024; and Communication from the Commission to the European Parliament and the Council – First report on application and functioning of the Data Protection Law Enforcement Directive (EU) 2016/680 (‘LED’), COM(2022) 364 final of 25 January 2022.
. Although deemed to be as complex as the GDPR, DPAs and, at the EU level, the European Data Protection Board (EDPB) have developed very few guidelines to support data controllers in correctly applying its principles,as interviews highlighted. The findings of the European Union Agency for Fundamental Rights (FRA) provide unique insights into the practices and challenges of both competent authorities and supervisory authorities, supporting informed decision-making for EU and national institutions.

Several significant judgments of the Court of Justice of the European Union (CJEU), however, were delivered during and after FRA’s fieldwork. While their implications are not yet be fully reflected in the practices documented in this report, this corpus of judgments provides practitioners with guidance on issues that the interviewees raised during fieldwork. Legal clarifications developed by the CJEU notably include the delineation between the LED and the GDPR [8] Judgment of the Court of Justice of 4 June 2026, CL v Prokuratura na Republika Bulgaria, C-312/24, ECLI:EU:C:2026:449, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62024CJ0312.
, the fact that the processing of special categories of personal data should be strictly necessary [9] Judgment of the Court of Justice of 19 March 2026, criminal proceedings against Ministère public, C-371/24, ECLI:EU:C:2026:219, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62024CJ0371.
and the application of core LED principles such as data minimisation and storage limitation [10] Judgment of the Court of Justice of 20 November 2025, JH v Policejní prezidium, C-57/23, ECLI:EU:C:2025:905, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0057.
. This developing case-law provides a firmer basis for the consistent application of the directive across the EU.

The LED was adopted to address the specific needs of competent authorities in the field of criminal law. Its scope covers the processing of personal data by police, prosecutors, courts and other competent bodies for the purposes of prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties. While the LED shares core principles with the GDPR (e.g. lawfulness, fairness, purpose limitation, accuracy and data security), it differs in key areas, notably in the broader exemptions and restrictions it permits to protect investigations and public security, as well as its tailored rules on data subjects’ rights, oversight and international cooperation. More specifically, whereas Article 6 of the GDPR sets out a list of the different cases under which processing of personal data is lawful, Article 8 of the LED requires processing to be necessary and provided for by law. Data subjects’ rights are also more restricted to safeguard law enforcement objectives. In addition, the LED contains more explicit operational requirements around law enforcement processing, including safeguards on data quality/accuracy and security, alongside data storage and logging.

While the GDPR directly applies in the EU Member States, the LED requires Member States to transpose its provisions into national law. The LED sets minimum standards for the processing of personal data by law enforcement and judicial authorities, while allowing Member States some discretion regarding implementation. As a result, while the LED’s objectives and principles are reflected across national legislation, differences in legal definitions, supervisory frameworks (including investigatory powers or remedial avenues) or optional clauses (e.g. the rules on data transfers to non-EU countries) exist across Member States [11] European Commission: Directorate-General Justice and Consumers, Report on the Transposition of Directive (EU) 2016/680, Brussels, 2023.
. Member States had until May 2018 to finalise their transposition into national law of the LED. In July 2022, the European Commission published its first report on the application and functioning of the LED [12] Communication from the Commission to the European Parliament and the Council – First report on application and functioning of the Data Protection Law Enforcement Directive (EU) 2016/680 (‘LED’), COM(2022) 364 final of 25 July 2022.
. The report concluded that the LED has generally been transposed satisfactorily across Member States and represents a key pillar in the EU’s data protection framework for criminal law enforcement. The report also flags a number of unresolved issues, particularly in relation to inconsistent national transpositions, limited statistical monitoring, varying data breach procedures and complaint notification practices and continuing legal uncertainty due to ongoing case-law. While most infringement procedures were closed by the end of 2025, in June and July 2026, the European Commission opened infringement procedures by sending letters of formal notice to Belgium, Bulgaria, Czechia, the Netherlands, Poland, Slovenia and Spain, as well as a reasoned opinion to Germany, for failing to comply with the LED [13] European Commission, ‘June infringements package: Key decisions’, 4 June 2026; and European Commission, ‘July infringements package: Key decisions’, 8 July 2026.
. The second report of the Commission on the application and functioning of the LED is expected to be published in the second half of 2026.

To ensure an accurate, detailed and comprehensive analysis of the LED’s application in practice, FRA collected experiences from professionals working in, or with, competent authorities under the LED. These research findings can inform and feed into the European Commission’s forthcoming evaluation of the LED (similarly to the FRA report published in June 2024 on the GDPR in practice, which focused on the experiences of DPAs; see box ‘2024 FRA report: GDPR in Practice – Experiences of data protection authorities’). To learn about experiences in practice, FRA conducted interviews with relevant actors involved in implementing and supervising the implementation of data protection law under the LED, including:

1. operational staff working in law enforcement and judicial authorities (61 interviews);
2. data protection officers (DPOs) working in law enforcement and judicial authorities (prosecutors and investigating judges) (42 interviews);
3. staff working on questions related to the supervision of the LED in national DPAs (29 interviews).

FRA conducted between three and six interviews in each of the 27 Member States, conducting a total of 132 interviews. Fieldwork was carried out in the first half of 2025. More details on the methodology can be found in Annex 1.

This report aims to support the evaluation of the LED with respect to fundamental rights protection based on the experiences of practitioners and experts. It provides unique insights into the practices and challenges of those processing personal data in a law enforcement context, as well as of those supervising such practices. The results provide findings from a variety of practitioners in the field without claiming to be representative of all relevant stakeholders, given that the findings are based on in-depth qualitative interviews, which are – by their very nature – limited in number.

The interviews covered questions about:

• the practical implementation of the LED, looking into requirements related to the core data protection principles of the LED;
• experiences and challenges related to inspections and investigations of potential interferences with the LED;
• experiences and practices of seeking or providing advice;
• existing cooperation networks or cooperation systems supporting the enforcement of data protection, namely between DPOs, between competent authorities or between competent authorities and DPAs.

During the interviews, some interviewees (from all groups interviewed during this research, that is, DPAs, law enforcement authorities and judicial authorities) raised what they perceived to be incorrect transpositions of some of the LED requirements into their national legislation. These concerns of potential incorrect transpositions linked to specific LED provisions related to, notably, data subjects’ rights and criminal/judicial proceedings exemptions. While these concerns may give indications of a need to review some of the national acts transposing the LED, these were not further analysed by FRA, given its mandate, and therefore are not reported in detail in this report.

The report starts with an analysis of the experiences of officers from law enforcement and judicial authorities when handling personal data under national data protection laws transposing the LED. It highlights issues linked to the awareness and knowledge of data protection law, as well as operational practices for implementing data protection requirements. While Chapter 1 focuses on the experiences of operational staff processing personal data, it incorporates the views of DPOs in relation to the understanding and awareness of the LED principles within their organisation.

The second chapter focuses on experiences and views of DPOs within competent authorities (from both law enforcement and judicial authorities), focusing on their roles, experiences and relationships within their authority. Chapter 2 includes the perceptions of DPOs’ role within the organisation (both by them and by their colleagues), the evolution they witnessed since the entry into force of the LED and the limitations or challenges they have identified in their day-to-day work.

Chapter 3 reports on the experiences of DPAs in overseeing data protection law with respect to personal data processing in the law enforcement context. It looks at their available resources and the specific challenges related to the enforcement of the LED by these supervisory authorities.