Criminal investigations rely on large amounts of personal data processed by law enforcement authorities. This sensitive information must be handled in line with EU data protection rules and people’s rights. The Law Enforcement Directive sets out rules for how authorities can process data in a way that safeguards fundamental rights and freedoms. This report looks at how data protection rules are applied in practice in all EU Member States. It highlights challenges concerning understanding and compliance, the role and resources of data protection officers, and effective supervision. The results contribute to an EU-level assessment of how the directive is applied in practice, pointing to areas for future improvement.

Today, a single camera scan from a distance can identify one person in a crowd. Law enforcement authorities in a growing number of EU Member States use or are considering using this AI-driven technique, known as remote biometric identification. While it can support public security and protect people from crime, it also poses serious risks to fundamental rights. FRA’s report draws on legal analysis, interviews with law enforcement practitioners and other experts, observations of police work and a public survey across selected EU Member States. FRA points to the need for a comprehensive legal basis for RBI use for law enforcement, including defined purposes, limits on identifying participants in peaceful assemblies or political gatherings, independent oversight and fundamental rights impact assessments, all of which should be in place before RBI is deployed.