The Law Enforcement Directive – data protection challenges in practice
TABLE OF CONTENT
Search inside this publication
Article 32 of the LED states that all competent authorities shall designate a DPO; however, it is not mandatory for courts and other judicial authoritieswhen acting in their judicial capacity. Article 33 introduces a broad mandate for the DPO, requiring the DPO’s involvement ‘in all issues which relate to the protection of personal data’. Article 34 of the LED (see box ‘Article 34: tasks of the DPO’) sets out a list of tasks that represent the minimum that DPOs should be doing in competent authorities.
Despite the limited availability and awareness of practical guidance and measures to apply the LED requirements in operational staff’s daily work (as identified in the first chapter of this report), most DPOs expressed that they had witnessed improvements in both the awareness of staff of data protection and the recognition of them as supportive co-workers. Several of them also raised the positive impact on their work of the national law transposing the LED, in terms of both recognition by colleagues and useful tools, notably the DPIA. This confirms what the European Commission identified in its first report published in 2022: ‘This [the designation of DPOs] has resulted in competent authorities becoming more aware of their data protection obligations as well as having a positive impact on competent authorities’ compliance with data protection rules’ [19] Communication from the Commission to the European Parliament and the Council – First report on application and functioning of the Data Protection Law Enforcement Directive (EU) 2016/680 (‘LED’), COM(2022) 364 final of 25 July 2022, p. 19.
.
However, a number of issues still remain: many DPOs pointed out that they are lacking human resources to efficiently conduct their tasks. In parallel, several DPOs raised the fact that they are lacking appropriate tools, namely IT tools and expertise, LED-specific guidance and criteria (e.g. in relation to DPIAs, which were referred to by several DPOs as a useful tool) and training material adapted to law enforcement. Finally, some of them indicated that they still do not feel recognised, either by the staff or by their authority’s management. This chapter will discuss these challenges in detail.
Importantly, and without ruling out the improvements identified by several DPOs as noted earlier, FRA’s research did show some level of discrepancy between this positive development identified by DPOs (particularly the positive impact of awareness-raising activities, such as newsletters and guidance) and the feedback FRA received from operational staff working in law enforcement authorities and interviewed by FRA. While several interviewees were aware of (and stated that they had used) guidance that was developed by their DPO, by the national DPA or, even in one case, by the EDPB, in most cases, the operational agents interviewed by FRA were unaware of any guidance on specific data protection requirements or stated that, while they believed that some guidance existed, they had not seen or read it.
Among those who were aware of the existence of guidelines, most praised the added value of DPOs and of their work. Some interviewees working as operational staff in law enforcement had some less positive comments, referring to there being too many data protection guidelines or these being too complex or consisting ‘mainly of a brief description of the provisions of the legal instrument’.
The colleagues from the data protection department are very active and are constantly guiding us. They actively publish information, awareness and guidance materials. Also, they have standardised certain activities (e.g. answers regarding access requests) all made available in the internal communication network for all police units.
An officer at a law enforcement authority
Article 33(2) of the LED provides that data controllers shall support their DPO by ‘providing resources necessary to carry out [their] tasks and access to personal data and processing operations, and to maintain [their] expert knowledge’.
FRA interviewed 42 DPOs: 28 in law enforcement (covering structures belonging to both the police and interior ministries) and 14 in prosecutors’ offices. All but two DPOs indicated that they were working for one authority. One DPO working in law enforcement indicated that they were acting as the single point of contact for several law enforcement authorities on international cooperation, and one DPO working in a judicial authority indicated that they had been appointed for several ‘prosecution units’. A large majority of them indicated that they had indefinite contracts, whereas only a few had fixed-term contracts.
Most DPOs clarified that they either work alone or are supported by one or two assistants and/or legal experts. Several work with a team ranging from four to seven people, and two work in large teams (of 13 and 15 people). As a general rule, DPOs working in judicial authorities mainly work alone. Despite these differences, almost all of the DPOs interviewed were either dissatisfied or moderately satisfied, indicating that their current situation was fine, but that additional resources would allow them to do more or be more efficient, given the level of resources available in their organisation. Some of them indicated that they were satisfied with the current resources allocated to them to perform their work; of these, two work alone in a judicial authority and three work in a team in a law enforcement authority. As an example, one interviewee indicated that they worked alone and part-time as a DPO but had ‘1300 hours of overtime’. A large majority of DPOs noticed a serious increase in workload and, as a result, some of them indicated that they had to prioritise their work, generally prioritising either specific requests that were mandatory or had clear deadlines defined in law or requests that had a political dimension and therefore needed to be treated as a priority. In general, DPOs who were ‘moderately satisfied’ complained of the fact that they did not have any time left to conduct deeper and/or proactive work within their authority, as their time only allowed them to focus on day-to-day tasks. Finally, some of them (all working in law enforcement authorities) stated that they are lacking technological knowledge and that they would welcome the recruitment of IT specialists.
We are constantly working in emergency mode.
A DPO at a law enforcement authority
Because the staff of the police is much more aware, the data protection office receives a lot more requests about different issues in connection with data protection, as well as more requests for staff training.
A DPO at a law enforcement authority
Similar to FRA’s findings in its analysis of DPAs’ challenges in implementing the GDPR [20] FRA, GDPR in Practice – Experiences of data protection authorities, Publications Office of the European Union, Luxembourg, 2024, Chapter 1, Section 1.1.
, the shortage of resources has a multilayered impact on the work conducted by data protection officials. Notably, some DPOs emphasised that the lack of human resources prevents them from conducting more internal training or providing targeted guidance, which they see as a crucial element for ensuring effective implementation of data protection requirements within their authority. A few also mentioned that, although they were aware of the necessity to conduct regular reviews of the need to keep data and the obligation to delete, the lack of resources and subsequent lack of time was preventing them from doing so on a consistent basis.
The fact that competent authorities should have a full office dedicated to data protection (and not only one DPO) was also highlighted by some DPAs’ experts interviewed by FRA.
Some interviewees also mentioned that they face recruitment difficulties: competent authorities receive too few applications for positions within the DPO’s office, and very often applicants do not meet the required expertise. One interviewee indicated, as an example, that the recruitment of an assistant DPO took several years and many attempts.
[More superficial controls] are the most serious consequence [of the DPO’s insufficient resources]. Controls in the classic sense, in the sense of an audit, where you really go into depth [are now difficult] – because of course I check things, when I receive a complaint from an employee or someone, I look at what’s behind it. But I can’t go into that in depth and analyse it from the ground up. It’s just not possible because of the lack of resources.
A DPO at an interior ministry
Several DPOs indicated that their institution (be it the police, the prosecutor’s office or the interior ministry) conducted an evaluation and/or restructuring of data protection resources. Some indicated that either the DPO function or a dedicated DPO office was set up after the entry into force of the national law transposing the LED (four in judicial authorities and nine in law enforcement authorities). Although most were positive about this, one interviewee indicated that, despite the initial restructuring prior to the adoption of the national law that led to the establishment of a dedicated data protection office consisting of 20 people, the office has now been reduced to five people.
Some DPOs indicated that Schengen evaluations had some positive impacts in the strengthening of their office, namely by supporting their stand regarding the lack of human resources, by reinforcing the importance of the independence of the DPO or by pushing the initiation of audits (internal or external) and subsequently implementing recommended measures.
Almost all of the DPOs interviewed insisted that they are facing heavy workloads. More than half of them cannot focus on tasks related to data protection and have other tasks to do. Among the 42 DPOs interviewed, 19 stated that they are full-time DPOs. While DPOs working in law enforcement authorities include both full- and part-time DPOs (eight are full-time DPOs and eight work on other tasks), most DPOs working in a prosecutor’s office work on other tasks. All DPOs working in interior ministries are full-time DPOs. In most cases, additional tasks are related to other legal questions. A few of them conduct IT or cybersecurity-related tasks, and one of them stated that they are also the archivist of the authority (dedicating only 10 % of their time to DPO-related tasks).
Despite the workload, several DPOs pointed to some requirements of the LED as proving to be helpful in supporting their work. The DPIA was notably referred to as very useful for identifying at a very early stage any potential misprocessing of data that, eventually, would have caused more time-consuming and difficult issues for the authority as a whole and for their function in particular. Even though DPIAs were often referred to as being a complex and challenging exercise, the ultimate benefits of conducting timely, detailed and appropriate DPIAs were highlighted by several interviewees. Most of them, however, indicated that they mainly have to navigate the process of the creation of a DPIA template alone and that detailed and case-specific guidance should be developed at the EU or national level to support and guide them.
The DPIA is not a paper tiger, it is useful and regularly used.
A DPO at a law enforcement authority
We’ve tried certain prefabricated [DPIA] forms or even programmes on offer, but they were not suitable. So now we always customise these DPIAs, depending on the application. But this takes a long time, sometimes an extremely long time.
A DPO at an interior ministry
Article 32(2) of the LED provides that ‘the data protection officer shall be designated on the basis of his or her professional qualities and, in particular, his or her expert knowledge of data protection law’.
DPOs in competent authorities mainly indicated that they have legal backgrounds (some did not clarify their background, and only one DPO (working in a judicial authority) had an IT profile). Recital 63 of the LED clarifies that a DPO can be ‘a member of the existing staff of the controller who received special training in data protection law and practice in order to acquire expert knowledge in that field’. Indeed, almost all of them indicated that they were already working within the authority and were appointed as DPO either based on personal interest or because they worked on a related topic (some of them were recruited after 2018 directly as DPOs). A few indicated that they were part of the team that prepared for the transposition and/or entry into force of the national law transposing the LED and, therefore, already had substantial knowledge.
Many of the DPOs interviewed reported having not been provided with specific LED training. A recurring complaint relates to the fact that only GDPR-based training is available, but that this training is not adequate for data processing within law enforcement or judicial authorities. As a result, several DPOs indicated that they taught themselves and continue to train themselves regularly. A few DPOs also mentioned the meetings organised by the European Commission’s DPO Network or the Europol Data Protection Experts Network (EDEN) as ‘a source of training’. Several mentioned that they learned a lot by attending these meetings and that exchanging experiences with peers working in similar situations is very helpful (see Section 1.3.2). The ways that interviewees indicated that they self-train include desk research, consulting guidance, memos and attending external lectures. However, regarding external training or conferences, many interviewees reported that these generally focused on the GDPR and not on the LED. A few interviewees mentioned that they attended training organised by Interpol, which proved useful when it comes to cases related to concrete law enforcement, but was not always relevant given that the legal framework used as a reference is different.
One area where we believe we are lagging behind is that we have not received the necessary training. The training we have received is very basic. Our knowledge of the directive and the regulation is derived from our own experience and study.
A DPO at a law enforcement authority
DPOs working in judicial authorities also indicated that there was an absence of training that was adapted to the specificities of the legal framework applying to their colleagues and to their work.
[B]ut we have the LED now for three years or so, and I have been working in this data protection regime for about three years or so, and there has not yet been a specific training event, no handout, no information material; the judiciary has obviously had to work this out on its own, and that is my biggest challenge. So, it would have been better, from the beginning on … to actually address the issue, to network, to get many stakeholders, perhaps international ones too, on board and to manage it centrally. That would have been easier than having to work it out yourself, because for me and for many others it’s trial and error and you try it and that’s actually the issue.
A DPO at a judicial authority
Finally, a few interviewees in the DPAs raised as an issue the fact that some DPOs were nominated when they did not have the relevant expertise, making the relationship difficult. One interviewee from a DPA stated that some DPOs were appointed as a mere ‘formality’ (see Section 3.2.2). DPA experts also mentioned the lack of appropriate training and education for DPOs, with one expert explaining that they (the DPA experts) ‘do the education of the DPOs’, which, in the view of the interviewee, should not be their responsibility. While a majority of them praised the key role that DPOs are playing within law enforcement and judicial authorities to ensure effective implementation of the LED principles, some interviewees raised concerns about, on one side, the expertise and understanding of LED legal principles and, on the other side, the exact scope and tasks of their role.
Sometimes it seems that they do not have enough understanding of what their mandate is and what they have to do, because most often, they appoint as a data protection officer someone who has to combine these positions, well, unless you count some very large organisations, but insofar as they are staff members and they are also probably state officials, special service officials, they have, of course, also this hierarchical command and subordination, which perhaps does not always promote their independence and autonomy in carrying out their tasks.
An officer at a DPA
DPOs in public authorities fail to comply with their duty and do not have the appropriate knowledge. Our DPA in fact frequently ends up performing DPOs’ duties just because public administration DPOs say the topic is complex and they don’t understand it and they don’t perform their duties as they should.
An officer at a DPA
The interviews reveal critical gaps in the training and expertise of DPOs in law enforcement and judicial authorities, despite the LED’s requirement for specialised knowledge (Article 32(2)). While most DPOs transitioned from existing roles (often with legal backgrounds), their preparation has largely been self-directed, with formal LED training scarce or non-existent. Many rely on GDPR-focused courses, which fail to address law enforcement specifics, or EU-level DPO networks for practical insights. However, despite the significant efforts of DPOs to ensure expertise and efficiency, the absence of tailored programmes can undermine operational staff’s confidence and consistency in applying the LED.
Recital 63 of the LED clarifies that ‘data protection officers should be in a position to perform their duties and tasks in an independent manner in accordance with Member State law’.
When asked about how their role is perceived by their colleagues in the authority, several of the DPOs indicated that their role was initially perceived negatively, but through continuous education and information this perception has changed.
[Y]our role in the organisation, your relationship with the colleagues, is one of the most essential things as DPO. In the police context, people are sceptical to everything data protection, something that is hindering them, something that is stopping them from doing what they want … But I do have to say that one of the things I’m actually most proud of here is that I managed to install data protection culture in the sense that people are now thinking about data protection … By being able to give solutions to colleagues, they perceive my role as more positive, it’s an evolution. It’s something that takes time and you must convince them of it. But it is working.
A DPO at a law enforcement authority
The interviews show that, when DPOs are located at the top of the hierarchy, they generally report that their role is perceived positively by the organisation and that the relationship with the hierarchy is fluid and easy. By contrast, DPOs who are not positioned at the managerial level say that they perceive some resistance from their colleagues when it comes to recalling appropriate data protection procedures to be followed, either because they are seen to be precluding the efficiency of their work or because they are considered internal auditors or controllers. However, in both cases, most DPOs reported having witnessed a positive evolution in the way they are perceived within their organisation, and several of them stated that they actively worked to reinforce cooperation and build trust to develop a positive attitude towards data protection.
A recurring complaint from DPOs relates to the false perceptions that some colleagues have regarding their job: for example, one DPO located at the top level and who considers that his job is respected complained that ‘a disadvantage is that everything is taken as an instruction, while giving instructions is not the job of a DPO’. Indeed, almost all of the DPOs interviewed believe that their role is almost exclusively of an advisory nature when it comes to their relationship with operational agents acting as data controllers. Several of them complained that operational agents sometimes expect them to conduct assessments or take decisions on their behalf.
Despite this, most DPOs emphasised that they found their colleagues to be quite cooperative and solution oriented when a concrete data protection issue or challenge was identified. Indeed, most operational agents interviewed by FRA stated that they consult their DPO not on a systematic basis, but on a case-by-case basis. From the controllers’ perspective, some interviewees showed a clear understanding that, as operational or investigating agents, they must always be prepared to explain and justify their actions and that the DPO is a key ally to ensure this.
I quickly understood that we would make more progress by working collaboratively rather than having the DPO position themselves as a supervisory body. We already have so much work that the control phase will have to come later.
A DPO at an interior ministry
Finally, several operational agents interviewed by FRA showed a lack of awareness of tools developed by their DPOs. While all DPOs state they provide regular oral guidance to their colleagues when requested, several of them also referred to written guidelines. A few of them stated that these are published on their intranet, and one of them stated that they regularly send guidance to all staff per email. However, when asked whether they know of internal guidelines to address specific data protection requirements, most operational agents did not know of any written guidelines. This lack of awareness of the rules is confirmed by the fact that some DPOs knew of cases in which they should have been consulted, but were not.
Only one DPO interviewee flagged that they lacked effective independence within their organisation, stating that the issues they report can be blocked by their management. Although the interviewee noted that, after the adoption of the LED, this situation has improved from a formal perspective, they stated that, in practice, they still have a lack of independence with regard to their decisions.
Despite being reported by only one DPO, the crucial importance of the independence of DPOs was also emphasised by experts working in DPAs. One interviewee, for instance, highlighted that they do notice a difference in their relationships with DPOs depending on how independent they are from their management (see the following quote).
When the data protection officers are not in a subordinate relationship, they have more experience in data protection issues, it’s easier to work with them, it’s quicker, well, we are more or less on the same page, and they are also able to identify those potential problems internally in advance and perhaps consult with us beforehand to find the right solution to address one or the other issue.
An officer at a DPA
The interviews reveal a shift in perception, from scepticism to cautious acceptance, of DPOs within law enforcement and judicial authorities. Many DPOs have actively reframed their role, with some of them adopting a ‘service provider’ approach with the aim of building trust. However, DPOs reported that challenges persist in embedding their role effectively. Operational staff increasingly recognise DPOs as allies in justifying actions, but the awareness of tools (e.g. intranet guidelines and email updates) remains worryingly low, suggesting either communication failures or a lack of interest from operational staff. While DPOs who are positioned higher hierarchically report smoother integration, those at lower levels may still face resistance and be perceived as obstructive ‘auditors’ rather than enablers of compliance. DPAs’ observations confirm this, noting that independent DPOs (free from hierarchical pressure) collaborate more effectively and flag risks proactively, aligning with supervisory expectations.
