The Law Enforcement Directive – data protection challenges in practice
TABLE OF CONTENT
Search inside this publication
To collect first-hand experiences of the understanding of, and potential challenges related to, the application of data protection principles, FRA interviewed three staff members of competent authorities (as per the LED, see box ‘Competent authorities within the scope of the LED (Article 3(7))’) per Member State: two in law enforcement authorities and one in a public prosecutor’s office.
For the police, interviews were conducted with 16 officers working as criminal investigators, 15 cybercrime investigation specialists, four officers working in border criminal investigations, three officers with legal or data protection specialisations (other than DPOs), two data analysts, two officers in charge of international cooperation and one officer in charge of staff management. For judicial authorities, interviews included 12 prosecutors, three judges, two state attorneys and one investigator, with specialisations including cybercrime, digital investigations, international cooperation and data protection (see Annex 1).
Overall, the analysis shows that, within competent authorities, the staff interviewed were aware of the requirements stemming from data protection legislation, but often lacked a clear understanding of the exact meaning and purpose of these requirements. A few interviewees also questioned the extent of their responsibility towards data protection requirements.
This chapter looks in detail at the main patterns identified of how competent authorities understand and implement legal requirements stemming from data protection legislation.
The first section reports on the awareness, and on the understanding of the meaning, of the LED’s core requirements as listed in Article 4 of the LED. It looks in particular at interviewees’ awareness of the legal basis allowing them to collect and process personal data, at the challenges of correctly understanding the notions of ‘data minimisation’ and ‘purpose limitation’ and at how these requirements can be confused with data security and police effectiveness.
The second section describes some of the obligations of competent authorities and the challenges that operational staff may face when implementing those obligations. This section focuses on questions related to ensuring the security of personal data, addressing data breaches, handling data subjects’ requests and cooperating with DPAs when the competent authority is being inspected or investigated.
Finally, the third section details how interviewees from competent authorities seek and receive advice.
Article 4 of the LED clarifies the meaning and objective of the six core principles enabling the effective protection of individuals when their personal data are processed by law enforcement and judicial authorities (see box ‘LED core principles (Article 4 of the LED)’).
FRA asked interviewees about their awareness of, understanding of and – where relevant – difficulties in relation to the practical implementation of these principles.
Under the LED, the principle of lawfulness set out in Article 4(1)(a) is given concrete expression in Article 8. Pursuant to that provision, the processing of personal data by competent authorities is lawful only when it is necessary for the performance of a task carried out for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security, and when it is based on EU or Member State law. Such law must, at a minimum, specify the objectives of the processing, the categories of personal data to be processed and the purposes of the processing.
In relation to this principle, FRA asked interviewees whether they were aware of the legal basis allowing them to collect and process personal data. In a large majority of interviews, operational staff from law enforcement competent authorities were well aware of the legal basis, referring to the national criminal proceedings code, to the national law transposing the LED and/or to the national act establishing law enforcement powers. This also extends to interviewees from judicial authorities, who mostly referred to national criminal procedural laws as the basis for data processing, with some of them also referring to the national legislation transposing the LED.
In parallel, some interviewees working as operational staff within law enforcement authorities said that assessing the lawfulness of data processing and compliance with related legal requirements was not their responsibility. They considered these issues to have already been addressed by other actors, particularly prosecutors, who authorise data collection and processing, and information technology (IT) experts, who provide systems designed to incorporate data protection requirements.
In my view, [ensuring the protection of personal data] is not our responsibility to guarantee that. We have rights and obligations defined by the Criminal Procedure Code.
An officer at a law enforcement authority
The databases are fully compliant with the law when we receive them. We do not need to contact the DPO because everything has already been taken care of by the time the databases reach us as the end users.
An officer at a law enforcement authority
Some interviewees working as operational staff in law enforcement mentioned that they were aware of several laws applying to them and that this multiplication of legal requirements makes the understanding of the legal basis and related requirements that apply to their data processing more difficult. Some interviewees also emphasised that, in their view, the current legal framework is not adapted to the reality of criminal investigations, notably when it comes to new technologies or when conducting cross-border investigations.
In my view, it has been a mistake to design the regulation so that the laws continuously refer to each other with expressions such as ‘to the extent that’ and ‘where applicable’. It would be clearer if all the necessary provisions were written directly into a single law, so that they could be read consistently in one place without constant searching and interpretation. The current structure of cross-references creates many practical problems.
An officer at a law enforcement authority
Distinction between the General Data Protection Regulation and the Law Enforcement Directive
Potential difficulties related to the lawfulness of data processing were also discussed with DPOs working in competent authorities. They were asked whether they found it difficult to distinguish between the GDPR and the LED. Some of the respondents acting as DPOs indicated that, while this might have created some confusion at the beginning (notably in relation to traffic policing, administrative sanctions or border controls, in relation to which Member States have adopted different approaches), it is not the case any more. Several of the DPOs interviewed stated that these were not, in fact, real difficulties, but only ‘residual’ difficulties. As mentioned by a few of them, uncertainties on the approach to follow remain for data processing that involves a ‘combination of principles from both the LED and the GDPR’. Some of the examples given referred to digital file management systems for collecting personal data that may be related to both criminal and non-criminal investigations. However, among judicial authorities, some interviewees called for more guidance and clarification on the interpretation of the LED in relation to the GDPR, also noting that the LED is not well known enough among professionals.
When it comes to international transfers of personal data processed for law enforcement purposes, the LED sets out in Articles 35–40 specific requirements to ensure that such transfers occur only when there are adequate safeguards to protect individuals’ rights and freedoms, including limits on onward transfers, purpose limitation and proportionality. Such transfers will be lawful only if one of the following legal bases is in place: an adequacy decision adopted by the European Commission; in the absence of an adequacy decision, appropriate safeguards; or, in the absence of both an adequacy decision and appropriate safeguards, derogations for specific, exceptional, situations (e.g. to protect the vital or legitimate interests of the data subject or to prevent an immediate and serious threat to public security). An adequacy decision under Article 36 of the LED is a formal determination by the European Commission that a non-EU country ensures a level of personal data protection that is essentially equivalent to that guaranteed within the EU for law enforcement purposes. At the time of writing, the European Commission has adopted one adequacy decision under the LED, namely with the United Kingdom. The limited availability of adequacy decisions places greater weight on appropriate safeguards under Article 37 and, in their absence, derogations for specific situations under Article 38. Reliance on these more decentralised mechanisms may lead to differing approaches across Member States.
The requirements set out, among others, in Article 35 of the Law Enforcement Directive (LED) and the guidelines of the European Data Protection Board (EDPB) place a heavy burden on data controllers. Specifically, data controllers are expected to conduct an in-depth analysis of the relevant legislation for each country they cooperate with – a task that proves unfeasible in practice due to language barriers and limited capacity.
An officer at a law enforcement authority
DPOs working in competent authorities were asked to describe the processes followed by their authority to ensure the protection of personal data when these data are transferred to competent authorities in non-EU countries and international organisations. Almost all of them demonstrated being well aware of the legal framework (and notably the necessity to have an adequacy decision in place). A few DPOs interviewed by FRA stated that they, as DPOs, do not deal with such transfers, as these are exclusively under the responsibility of their international cooperation unit. None of them reported having consulted their DPA for further guidance on this. Some of them referred to the International Criminal Police Organization (Interpol) legal framework, with one interviewee mentioning that this framework is ‘easier’ and another one clarifying that this is a ‘strategic choice’, as ‘Interpol provides a framework that offers certain safeguards and … a lot of guidance’.
Our primary approach is to first explore whether the data transfer can be addressed through existing channels like Interpol, rather than immediately engaging with the complex hierarchy of third-country transfer conditions. The adequacy decision has been particularly beneficial in simplifying our data transfer processes. We prioritise using established international frameworks and maintain a cautious approach to transfers that fall outside these standard mechanisms.
A DPO at a law enforcement authority
Several DPOs also mentioned that they do not have many cases involving international data transfer. However, some DPOs did mention challenges, referring notably to transfer to non-EU countries with no adequacy decisions and the difficulty of precisely defining what appropriate safeguards consist of. As one interviewee puts it: ‘consequently, there is a tendency to rely on the exceptions instead in individual cases. But exceptions are not intended to be used repeatedly and systematically.’
So, practically, now, there are no data protection agreements on law enforcement with data protection with Asian countries. But we have the old ones, that we use. The directive says that old agreements remain in force until they are amended. If you ask me, this is a loophole in the directive.
A DPO at an interior ministry
In addition, specific cases were mentioned as more challenging, such as the use of software or databases (including cloud storage) in which companies are based outside the EU, specifically in the United States. One DPO working in a law enforcement authority referred to the wish expressed by operational staff to access and use data collected by companies offering genetic services based on the collection of DNA information. Finally, one DPO working in a prosecutor’s office identified as a recurring issue the lack of a definition of what ‘structural transfers’ consist of (as opposed to ‘incidental transfers’), since, in their view, ‘a request for legal assistance is by definition incidental, as it relates to a specific criminal case’. These concerns from DPOs echo concerns raised by operational staff working in law enforcement, as discussed earlier. Interviewees from competent authorities (DPOs and operational staff alike) who raised these concerns agreed that these issues stem from a lack of legal clarity and that further guidance at the EU level would be beneficial.
If you do not have the skills [to work in a technical area, such as genetic genealogy] in [Member State] or Europe, and they do in third countries, then these rules become a problem.
A DPO at a law enforcement authority
Article 4(1)(b) and (c) of the LED establish, respectively, the principles of purpose limitation and data minimisation. Purpose limitation requires personal data to be collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes. Data minimisation requires the data processed for a given purpose to be adequate, relevant and not excessive. Recital 26 further clarifies that the purposes should be determined at the time of collection and that personal data should be processed only when the purpose cannot reasonably be achieved by other means.
The two principles are closely connected, but perform distinct functions. Purpose limitation determines what personal data may be used for, whereas data minimisation constrains the number and type of data processed for that purpose [14] See Article 4(1)(b) and (c) of the LED, recital 26 of the LED and Article 29 Data Protection Working Party, ‘Opinion 03/2013 on purpose limitation’, WP 203, 2 April 2013.
. Data minimisation may in this sense be understood as an operational consequence of purpose limitation: whether data are adequate, relevant and not excessive can be assessed only in relation to a sufficiently specified purpose [15] See De Hert, P. and Sajfert, J., ‘The fundamental right to personal data protection in criminal investigations and proceedings: Framing big data policing through the purpose limitation and data minimisation principles of Directive (EU) 2016/680’, Brussels Privacy Hub Working Paper, Vol. 7, No 31, December 2021, p. 13.
.
Purpose limitation under the LED does not impose an absolute prohibition on subsequent processing for another law enforcement purpose. Under Article 4(2), processing by the same or another controller for a purpose set out in Article 1(1), other than that for which the data were collected, is permitted only when the controller is authorised to process the data for that purpose under EU or Member State law and the processing is necessary and proportionate to that other purpose. In the case of Inspektor v Inspektorata kam Visshia sadeben savet, the CJEU confirmed that these conditions apply even when both the original and the subsequent purposes fall within the scope of the LED. The CJEU held, in particular, that data collected for the detection and investigation of a criminal offence and subsequently processed to prosecute a person following the conclusion of that investigation are processed for another purpose within the meaning of Article 4(2). [16] Judgment of the Court of Justice of 8 December 2022, Inspektor v Inspektorata kam Visshia sadeben savet, C-180/21, ECLI:EU:C:2022:967, paragraphs 43–44, 50–56 and 61, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0180; see also Wahl, T., ‘CJEU ruled on scope and concepts of Law Enforcement Data Protection Directive’, eucrim website, 10 January 2023.
Operational staff described a range of ways in which purpose limitation and data minimisation are applied in practice. Only a few interviewees explicitly highlighted the data protection impact assessment (DPIA) as a key moment when these principles are examined, namely when launching or changing processing activities. At the same time, several operational staff in law enforcement described applying these principles as part of everyday casework: lead investigators determine what information is necessary for the case, decide what should be retained or deleted and make case-by-case judgements on what is relevant and proportionate to the investigative purpose. Several interviewees working as operational staff in law enforcement also referred to the existence of internal guidance supporting this work, including policies, system-specific internal directives or practical tools and support measures such as checklists, training or DPO-led guidance.
Similarly to what was mentioned in relation to the lawfulness of processing (see Section 1.1.1), some interviewees pointed to prosecutors’ and judges’ decisive roles in constraining what data may be collected or used in a given case, while others referred to IT-system configurations (e.g. logging and access restrictions) as practical safeguards.
Purpose limitation
When discussing purpose limitation, some interviewees working as operational agents in law enforcement authorities stated that reusing data for other purposes was not possible. They referred to the facts that (1) data that are directly linked to a case are not useful for other cases and (2) once the data are transferred to the prosecutor and/or the investigation is closed, the data are deleted, anonymised or encrypted. Nevertheless, several interviewees stated that the reuse of data is possible when:
- the grounds for the reuse of data are established in law;
- the prosecutor authorised the reuse;
- the investigator in charge of the original investigation for which data were collected agreed to the reuse.
Some interviewees also stated that, in their views, the reuse of data for other criminal investigations is generally permissible, given that the purpose would ‘stay the same’. Two interviewees mentioned that the purpose is covered by the necessity to reuse data for crime prevention purposes, with one interviewee referring to their ‘duty to act’.
And there is naturally the question ‘What is actually the purpose now?’ … I’ll just give an example: the police has a stated task for which I collect personal data. So quite classically ‘XY is suspected of bodily harm’. Then I have the dataset available. And this dataset, I can now use it for all possible police purposes … The narrower the purpose is, the more complex the construct becomes and nobody can handle that any more.
A DPO at a law enforcement authority
Data minimisation
When it comes to data minimisation, most interviewees working as operational staff in law enforcement authorities linked this principle to police effectiveness (see Section 1.1.4): collecting irrelevant or unnecessary data was seen as hindering, rather than helping, an investigation. Some interviewees also said that ‘bulk collection’ was unrealistic because processing large volumes of data requires significant technical and human resources.
The principle of data minimisation was often seen as problematic, as it can conflict with the obligation to preserve the integrity of evidence, on one hand, and with the essence of conducting investigations, on the other hand – by both judicial and law enforcement authorities. Deleting data only because their relevance cannot be asserted at the beginning of the investigation would, for example, hamper the investigation itself; some interviewees referred to this as the principle of ‘better to have than to need’, clarifying that this principle does not apply for data falling under the scope of Article 9 of the GDPR (special categories of personal data). Special categories of personal data include data that reveal information such as racial or ethnic origin or political opinions, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health and data concerning a natural person’s sex life or sexual orientation. The processing of these data categories warrants special protection, is authorised only when strictly necessary and is subject to safeguards as set out in Article 10 of the LED (see box ‘ Fundamental rights implications of the use of remote biometric identification in the context of law enforcement’).
It is difficult to assess what information is unnecessary. If it is clearly unnecessary – for example if it is discovered that coercive measures have yielded information about some third party that is in no way related to the matter – then that is easy. But if the information might possibly relate to the specific subject of the investigation or the matter under investigation, then it is hard to draw a clear-cut line and say that this can simply be deleted, because it may indeed contain relevant evidence. And even if it does not, it leaves open the possibility that the suspect can later claim in court that it contained exculpatory evidence supporting their innocence.
An officer at a law enforcement authority
Issues raised in relation to both principles
FRA findings show that, in several cases, operational staff working in law enforcement authorities (and, to a lesser extent, from judicial authorities), were not well aware of the exact meaning of the principles of data minimisation and purpose limitation; these staff referred mainly to data security measures – which can also support these principles in practice – as safeguards for both (see Section 1.1.3). Two types of measures, notably, were described as a way to ensure either purpose limitation or data minimisation: first, several interviewees referred to features of their electronic devices (e.g. logging access, limited entry data or automatic deletion) and, second, several interviewees referred to the protocols requiring specific authorisation for staff to access the data. In addition, some interviewees confused the two: when asked about purpose limitation, they referred to the fact that they collect only necessary data (i.e. referring to measures linked to data minimisation rather than purpose limitation).
The law stipulates 18 types or categories of data we can collect from an air carrier. If within the data (received from the air carriers) appears the data that we are not authorised to collect … automated procedures within the system automatically ignore such data in a way that such data is no longer visible to us at all.
An officer at a law enforcement authority
Among judicial authorities, two interviewees challenged requirements linked to purpose limitation, arguing that if data relevant to one criminal investigation are obtained during another investigation for a different purpose, the use of these data in newly initiated or ongoing criminal proceedings should be permitted. Similarly, some interviewees (from both law enforcement and judicial authorities) expressed irritations towards what is perceived as rigid and/or time-consuming requirements, arguing that these requirements are taking away the possibility to focus on material agendas for the sake of administrative tasks of limited added value.
If I am to be honest, from my point of view, instead of dealing with the actual protection or effective handling of personal data, we are dealing with an incredibly bloated amount of administration that uses amazing formulations (like ‘purpose limitation’ or ‘data minimisation’). Even though I am a lawyer, I do not understand these.
An officer at a law enforcement authority
Guidance and data protection officers’ role in supporting the implementation of both principles
Several of the DPOs interviewed by FRA stated that the question of purpose limitation is one of the core issues on which they are consulted upon. They indicated that the guidance provided by them is case specific and, generally, the main issue is to define whether the purpose should be understood broadly or narrowly. Indeed, while several agents working in law enforcement could not refer to the existence of written guidelines on either the purpose limitation principle or the data minimisation principle, a few interviewees in law enforcement did refer to their DPO as a source for further guidance, as a mandatory validation step or in relation to general guidelines developed by their DPO. As an exception to the general absence of written guidance reported to FRA, one interviewee working with a database stated that their department has established an ‘internal methodological instruction that contains specific rules and protocols for responding to requests’.
Do any rules or guidelines on how to collect as little data as possible exist? That’s not something I have seen. From our perspective, it is a matter of collecting the data that is necessary after our assessment to solve the task. I am sure, if you go through the preparatory works pertaining to the [country] Police Act you will see different considerations to be taken into account, but this is not put in a frame and hung up on the wall.
An officer at a law enforcement authority
To summarise, FRA interviews reveal significant challenges in applying the LED’s purpose limitation and data minimisation principles in practice. While it is clear that the LED core principles are not unknown by operational staff working in law enforcement and judicial authorities, staff could benefit from guidance and clarification on their exact purpose and meaning, as well as on the technical and organisational measures attached to them. Purpose limitation appears to be frequently stretched, with the reuse of data justified by broad interpretations of ‘crime prevention’ or investigative duties, despite recital 26’s emphasis on explicit, narrow purposes. Meanwhile, data minimisation is perceived to clash with evidentiary needs, as indicated some practitioners, who state that they fear that deletion could compromise investigations or future proceedings. While technical safeguards (e.g. automated deletion and access logs) help, they do not replace substantive necessity and proportionality assessments. To align practice with the LED, stronger DPA oversight, targeted training and harmonised interpretations of ‘necessity’ and ‘proportionality’ are essential, ensuring that law enforcement’s legitimate needs are aligned with fundamental rights protections.
As detailed in the previous subsection, a majority of interviewees stated that the strict protocols (data storage, access limitation, logging, etc.) implemented by law enforcement authorities to ensure that only certain individuals are allowed to access specific files or databases were the main measures used to ensure that each of the data protection principles discussed are respected. From the perspective of several of the interviewees in law enforcement authorities, once the data are collected, they belong to the investigators. Consequently, access to data is restricted not based on purpose, but based on staff access rights.
When asked about data security, several operational staff did not identify significant challenges and stated that this is ‘generally not an issue’ and that most security breaches result from human errors. By contrast, one interviewee noted that, in their organisation, everything was legally in order, but personal data were not sufficiently protected from a technical perspective, leading to data breaches.
On data storage, most interviewees in law enforcement and judicial authorities were aware that the law sets time limits for deleting personal data or for periodically reviewing whether continued storage is necessary. Some noted that these limits vary depending on the type of data, the purpose of processing or the seriousness of the offence. A few interviewees also stressed that retention rules are complex and fragmented, with different legal provisions sometimes overlapping or conflicting. A couple of interviewees complained about these rules, namely a DPO working in law enforcement, who explained that they need to regularly negotiate deletion periods with DPAs, and an officer working in a judicial authority, who disagreed with data storage time limits because they limit the possibility to further analyse the data in the future, for example with the help of AI (see the following quote).
What I don’t like about this is a practical reason. By destroying such files, we lose the ability to further analyse that data in the future, for example with the help of artificial intelligence. Because what does it mean to destroy data? Yes, I may not use it … But I can use it to establish patterns of criminal activity, behaviour … I must try to review the reasons for the crime, and so on. Moreover, I can use old, closed files to determine that there are, for example, connections with my current case.
An officer at a judicial authority
Most operational staff rely on automatic features of their file management systems (e.g. automatic deletion, blocking or flags of the data). When asked whether they were aware of regular revision of the need to keep the data, most interviewees in judicial and law enforcement authorities stated that they did not know of any case in which internal controls of the data storage time limits were conducted. Only two interviewees referred to periodic reviews of the need to store data.
Several DPOs stated that the LED was ‘not as revolutionary as announced’: in their views, most of the concepts and requirements set out in the LED already existed. Interestingly, several operational staff explained that, for them, data protection principles such as data minimisation were already being applied to guarantee effective investigations. Similarly, the findings suggest that considerations of investigative effectiveness also shape approaches to data quality and to personal data based on facts or assessments.
Accuracy of personal data
Almost all interviewees stated that it is ‘in the interest of the investigator’ to work with accurate data. However, when questioned on how they ensure the accuracy of personal data, some of them could not describe specific measures and others noted explicitly that continuous or proactive monitoring to ensure data quality was not in place. As one interviewee put it, data are updated through day-to-day work, but regular check-ups are simply not feasible.
Respondents who did indicate ways to ensure the accuracy of data referred to the cross-checking of data with other national databases ‘when time allows’. In one Member State, a control mechanism exists whereby, before information is added to the central law enforcement database (covering people, vehicles, places and facts), designated staff review the content and key terms for data quality and check whether retention remains necessary.
In a few cases, interviewees explicitly mentioned that police databases are linked to authoritative governmental sources (e.g. municipal registers) to support data quality. However, a few interviewees referred to the fact that, sometimes, the same data are stored separately and in different databases, meaning that updates made in one system do not automatically apply to others, which can result in duplicate records that become outdated and/or differ from each other. A few interviewees noted, for example, that the police and the courts use separate information systems that are not interoperable.
At the same time, several interviewees from the judiciary claimed that their responsibility for ensuring data quality was limited, as the data are collected by other actors in pretrial investigations, notably the police. Thus, they do not engage in extensive control of accuracy of the data collected by the police, possibly only checking when certain data are questioned. Nevertheless, a few interviewees shared that, in their institutions, there are several mechanisms ensuring the quality and adequacy of personal data, such as:
- the existence of data repository systems that allow corrections to be made to input data, which are then automatically updated across all existing records;
- existing safeguards that prevent the entry of inconsistent data;
- automatic updates;
- formal procedures when handling corrections of data;
- the inclusion of records of incorrect data for traceability.
The workload for police officers is currently so high that the incentive to enter and manage superfluous data is low.
A DPO at a law enforcement authority
Personal data based on facts versus personal assessments
The question of effectiveness and professionalism was also raised by several interviewees in law enforcement and judicial authorities when discussing how they approach the obligation of the LED to distinguish between personal data based on facts and data based on personal assessments, to ensure data quality in line with Article 7 of the LED. While respondents had contradicting replies, interestingly, both approaches were justified by the effectiveness of the investigations.
- Several respondents stated that the police or the prosecutor could simply never work with data based on personal assessment, as this would endanger the investigation itself. Investigators analysing forensic evidence clearly stated that they would never come across data based on anything but facts.
[P]ersonally, I have always found it difficult to know … what is meant by data based on personal assessments because in police work, everything is always factual. Everything they record … must be facts, and it is on the basis of these facts that the judicial authorities must judge whether or not the person is guilty. So, I find it difficult to see what, in the context of police work, [could be] based on … personal assessments.
A DPO at a law enforcement authority
- For other respondents, by contrast, integrating data based on personal assessment is an inherent part of the work of operational staff, building on experiences, hearsay or extracts from communication during surveillance operations.
- Some interviewees indicated that such data should be flagged in the system, labelling them as, for example, ‘soft data’ (as opposed to ‘factual data’) or flagging their reliability and importance. However, another interviewee from a judicial authority, by contrast, claimed that differentiating between factual data and personal assessments would conflict with the national procedural norms of criminal law and the fundamental principles of evidentiary evaluations. A few operational staff also noted that, in the absence of guidelines, it is difficult to distinguish between data based on facts and data based on personal assessments.
[Our work] does not focus on citizens’ rights but is concerned with ensuring that data quality is high so that the data can be used as evidence in court.
A DPO at a law enforcement authority
- While several interviewees from judicial authorities explicitly noted that they do not work with personal data based on personal assessments, some of them observed that it may be difficult or even impossible to make this distinction and implement the requirement formally, justifying this as the approach required to achieve effective criminal investigations.
FRA interviews revealed a pragmatic, but sometimes inconsistent, approach to data accuracy and quality under the LED, driven primarily by investigative effectiveness rather than strict compliance. While practitioners recognise that accurate data are critical for investigations, proactive measures (e.g. regular reviews or cross-system updates) are rarely implemented. Interviewees highlighted specific issues, such as interoperability gaps between police and judicial systems and dependency on external actors (e.g. prosecutors for deletion triggers), as potential areas for further inaccuracies, which may in turn create accountability blind spots.
FRA interviews also showed that there is an uneven understanding among operational staff working in law enforcement authorities of the requirement to distinguish between factual data and personal assessments in line with Article 7 of the LED. While some practitioners reject the notion of ‘assessment-based’ data entirely, insisting that all information must be factual to ensure evidentiary validity, others acknowledge that operational work inherently relies on subjective inputs (e.g. intelligence and hearsay). The interviews revealed the need to tie data accuracy not only to police effectiveness, but also to data protection compliance. Effectiveness-driven approaches can undermine accuracy and therefore can compromise both investigations and fundamental rights.
The LED framework provides competent authorities with targeted instructions and processes to address requests from data subjects and handle potential breaches. Data subjects’ rights are described in Chapter III of the LED and include the right to request that competent authorities provide them with specific information related to the processing of data pertaining to them, the right to access these data and the right to rectify or erase data held by competent authorities about them. Limitations to these rights are permitted, in cases that are clearly defined in Article 15 of the LED. That is, these rights can be restricted for the following purposes: to avoid obstructing official or legal inquiries, investigations or procedures; to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties; to protect public security; to protect national security; or to protect the rights and freedoms of others.
Obligations of competent authorities are described in Chapter IV of the LED. These include specific data security requirements, for instance the obligation to implement data protection measures ‘by design and by default’ in line with Article 20 of the LED. Further obligations include keeping records and logs of specific processing activities and implementing appropriate technical and organisational measures to ensure the security of the data in accordance with Articles 20, 24, 25 and 29 of the LED. The LED also includes targeted measures to prevent or mitigate interference with the protection of personal data, including cases in which a DPIA should be conducted as mandated by Article 27 of the LED, and processes to be followed to ensure appropriate notification and communication of data breaches as set out in Articles 30 and 31 of the LED.
The LED defines in detail the cases in which ‘technical and organisational measures’ should be taken to ensure the security of data. Interviewees working as operational staff in both law enforcement and judicial authorities were asked whether there were any challenges that they had experienced in their work with respect to the security of personal data.
Overall, interviewees had not witnessed and did not identify major challenges, and several expressed trust in their IT department and the technical safeguards they implemented. Among those who did identify challenges (several interviewees working in judicial authorities and several interviewees working in law enforcement), they referred almost exclusively to human errors, such as the loss of a universal serial bus (USB) key or a handwritten note with passwords on it. Some interviewees did identify IT-related challenges, including a lack of cybersecurity training, specific risks that modern technologies could potentially introduce (without clarifying what risks/technologies they were referring to) and unauthorised access. Within judicial authorities, interviewees identified the following issues as challenging for data security: the inability to anonymise sensitive information, the need to protect personal data when the identity of injured parties must remain confidential and managing the growing volume of data.
Interviewees working in law enforcement authorities also described examples of measures that they take to ensure data security. When it comes to preventing human mistakes from happening, some interviewees referred to cybersecurity training, to working ‘in isolation’ (i.e. alone) and to avoiding using a USB stick or similar devices. Interviewees also emphasised the clear and strict protocols and procedures that they have in place to ensure data security. As an example, in one case, a law enforcement authority decided to remove all shared accounts, allowing users to log into the information systems only through their individual credentials. A few interviewees also observed that the topic is always a challenge, noting that security is costly and requires the allocation of certain resources. A lack of resources was indeed highlighted by a few interviewees as a challenge to ensuring data security. One interviewee, for instance, lamented that their authority focuses its attention on human resources, at the expense of technical infrastructure.
As described earlier, most operational staff working in law enforcement perceived risks related to cybersecurity as secondary (i.e. to risks posed by human mistakes). In general, digital data are believed to be sufficiently protected within the organisation. In one case, however, the interviewee insisted that data security was of the utmost importance, following leakages of police information to the press. However, this interviewee believed that the main challenge in ensuring data security in that case lay in their difficulty to identify ‘the source of the leak’. Several respondents insisted that a ‘zero-risk’ policy was not realistic when it comes to cybersecurity, exactly because, in their views, the ‘real risks’ lie in mismanagement of data by staff.
There’s no doubt about it, there’s going to be challenges going forward. Technology changes. So, what’s a challenge today? There could be a new challenge again tomorrow.
An officer at a law enforcement authority
Finally, when asked whether they have specific software to identify data breaches, some interviewees in law enforcement and judicial authorities explicitly indicated that they were aware of dedicated solutions or software that existed in their competent authorities. Others stated that there are procedures in place, but they could not elaborate further, as this specific topic falls under the responsibility of other actors in their institutions (e.g. higher management or IT departments). One interviewee noted that the reason why their authority does not have dedicated software is because limited resources in IT do not allow new systems to be developed, with resources only being available for existing systems to be updated.
Some interviewees mentioned that, while they do not have automated warning systems, they apply other measures to identify personal data breaches or detect abnormal incidents. For instance, one interviewee said that they check log data when there is a suspicion of a personal data breach, while another interviewee noted that investigative actions are taken when they receive a complaint. Another interviewee said that issues are identified through targeted inspections conducted by designated personnel whose responsibilities include checking how data are processed and whether the particular database is accessed or used on a lawful basis.
DPOs were also asked whether they had developed a procedure for identifying personal data breaches, and several of them confirmed that they did. They were further asked if they were aware of guidelines that had been developed by their national DPA or the EDPB to guide the assessment of what is considered a breach and when it needs to be reported to the DPA. Some of them explicitly noted that they were aware of such guidelines and confirmed that these are very valuable in their work on the matter, with one of them indicating that EDPB opinions were the basis of that work to develop the procedure to identify breaches.
In our country, the [national DPA] serves as the supervisory authority, and the primary guidelines are set forth in the law. The EDPB provides excellent guidelines and produces invaluable materials. The EDPB has also reviewed and adopted many of the opinions issued by the Article 29 data protection working party, which have proven to be extremely valuable.
A DPO at an interior ministry
The interviews reveal some tendency to over-rely on technical safeguards and human vigilance to uphold data security under the LED. Most operational staff working in law enforcement and judicial authorities express confidence in their IT systems, highlighting that actual challenges stem primarily from human error (e.g. lost devices or poor password practices) rather than systemic vulnerabilities. Although procedural safeguards (e.g. individual logins and access reviews) exist, their effectiveness can be undermined by resource constraints and a lack of cybersecurity training. Some authorities indicated that they struggle with outdated systems or unauthorised access risks, particularly when new technologies introduce unexpected threats (without elaborating on what these technologies/threats are). In addition, breach detection and response seem to remain reactive rather than proactive. A strong security environment (including IT measures and staff awareness) is key both for the protection of data subjects under the LED and for the effectiveness of law enforcement, given that it supports the confidentiality, integrity and availability of law enforcement data, reduces operational risks and supports public trust in police authorities. As such, the security environment would benefit from reinforced cybersecurity measures and training, strengthened IT resources and infrastructures and clear accountability rules.
The LED has established several rights for data subjects: the right to be informed (Article 13), the right to access their personal data (Article 14), the right to rectification, erasure or restriction of processing (Article 16), the right to lodge a complaint with a supervisory authority (Article 52), the right to an effective judicial remedy (Article 54) and the right to receive compensation for unlawful processing (Article 56). FRA asked both the DPOs and the operational staff of competent authorities whether they were entitled to handle data subjects’ requests. Interviewees had varying responses, showing that the understanding of who is in charge of processing these requests differs across Member States.
Among the DPOs interviewed by FRA, several of them indicated that they are in charge of handling such requests, with some of them clarifying that they are the central contact point when it comes to data subjects’ requests (meaning that other departments would forward them the requests that they receive). As highlighted by one interviewee, the centralisation of requests allows there to be consistency in the replies.
However, many DPOs stated that they do not handle these requests, with several of them stating that they do not believe this to be part of their mandate. When they do receive requests, they do not process them and instead transfer them to operational agents. One DPO clarified, however, that they would intervene in cases presenting problems or ambiguities. Finally, in one case, the DPO indicated that requests can be handled by either the DPO or the operational agent and that they had developed guidance and a template on this, which are available on their website.
FRA asked operational staff whether they were consulted on data subjects’ requests. A majority of them indicated that they have not been involved in any such processes, with some also clarifying that they believed their authority had not encountered such requests. Other interviewees working as operational staff in law enforcement and judicial authorities indicated that they are consulted on such requests but that the requests are primarily handled by their DPO. All of them were aware of the existence of these subjects’ rights.
Several of the interviewees (operational staff in law enforcement and judicial authorities and DPOs alike) who indicated that they handled and/or processed data subjects’ requests did not report any significant issues. In a few cases, they indicated that they do not receive many requests, stating that the public is not well aware of the national legislation transposing the LED.
Among DPOs, a few interviewees mentioned that it could be difficult for them to confirm the identity of the individual asking to have access to their data. In their view, ‘a signature alone cannot be considered a reliable means of identification’ and, therefore, ‘it is essential to update the [legal] provision regarding the data subject’s right to access personal data to align with current authentication standards’. Another challenge identified by one DPO is the repetition of identical requests by non-EU nationals, which their office still needs to assess and respond to individually. One interviewee described a proposal for overcoming this challenge, namely limiting those who are authorised to represent data subjects to only lawyers who are authorised to work in the territory of the EU or the European Economic Area (the DPO of another Member State clarified that, in their case, all requests related to the Schengen information system (SIS) are dealt with by another department). Finally, a few DPOs mentioned that some requests are either ‘unarticulated’ or too generic (i.e. requesting to have access to ‘all data’) and that this creates time-pressure challenges in clarifying with the data subjects the exact content of their request within the period set out in the national legislation. Several DPOs indicated that, in the case of doubts, they would ask the operational unit for further information on the case and/or on whether the data subject’s request could be answered positively.
When operational agents are directly involved in assessing data subjects’ requests, a recurrent complaint is that dealing with such requests is time consuming and therefore takes up the time that could otherwise be spent on other ‘valuable’ investigating tasks. Some interviewees working as operational staff, prosecutors or DPOs did complain about the number of requests that they receive or about requests being burdensome. Some of them pointed out that the biggest share of requests are related to SIS and/or concern non-EU nationals. In one Member State, the DPO indicated that they receive around 900 requests annually, of which approximately 10–15 % are appealed. This work was described by the DPO as being very time consuming; however, the DPO insisted that all requests are treated individually, on a case-by-case basis, and that each individual is informed of the decision and of the possibility to appeal. While some DPO interviewees indeed confirmed that each request is assessed individually, the DPO of one Member State indicated that ‘some restrictions are built into specific systems. For example, no citizens are given access to data of the [specific system name] because the specific purpose of the database is to collect confidential information about potential suspects.’
This employs a huge number of people within the police force, and it produces a huge amount of administration. [When] the subject asks what information the police have on them, the DPO sends out that request to all the regional headquarters where the local records are kept … This involves [the work of] dozens of people across the entire police structure to that one specific request … And very often [the response] is just simply stating ‘Thank you for the inquiry. We’ve got nothing for you.’ … Underneath the surface of that ordinary request and response, there is a huge agenda involving the whole structure of the force.
An officer at a law enforcement authority
Should the request endanger the pursuit of criminal investigations, competent authorities may deny the request. Restrictions to data subjects’ rights can only be permitted on the basis of specific grounds in order to avoid obstructing inquiries, investigations or procedures; to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences; and to protect public security, national security or the rights and freedoms of others as set out in Article 15(1) of the LED.
Most of the interviewees working within law enforcement and judicial authorities did not report any complications with regard to potential restrictions to data subjects’ rights. The few challenges identified during the interviews related to cases when the data subject was under surveillance measures or when information needed to be exchanged with other Member States that impose restrictions on the use of shared information, potentially resulting in conflicts between national legislations. One interviewee highlighted that this may create tension between national law and international obligations and would require policy-level coordination.
One interviewee clarified that, in the case of doubt, they would first consult with colleagues internally and, if the doubt persisted, they would consult with the public prosecutor. In one Member State, the DPO indicated that they are obliged to first consult with the national DPA before restricting any of the rights of the data subjects. In another case, a prosecutor explained that their DPA requested that any restriction of these rights needed to be considered a postponement, not a denial. This means that, in this case, requests need to be re-examined at a later stage, when the grounds for refusal no longer apply.
A further procedural safeguard was reported in Austria. When the police restrict the information provided in response to the exercise of data subjects’ rights on grounds recognised by the LED, such as the protection of an ongoing investigation or national security, the DPA can conduct a confidential assessment. The DPA receives all of the relevant information from the police and assesses the lawfulness of the processing, the necessity of using the procedure in the specific case and whether the storage and other processing of the data comply with the law. Restricted information is not disclosed during the proceedings, but the data subject receives a reasoned decision indicating whether the complaint has been upheld or rejected [17] Austria, Data Protection Law (Datenschutzgesetz – DSG), Section 42, paragraph 8.
. This reflects Article 17 of the LED, under which data subjects’ rights may also be exercised through the supervisory authority in the cases referred to in Articles 13(3), 15(3) and 16(4) of the LED. As clarified by the CJEU in case C-333/22, when the direct exercise of data subjects’ rights has been restricted, Article 17 constitutesan additional guarantee for the data subject to verify that their data have been processed lawfully, rather than a general substitute for the direct exercise of their rights. Any restriction must apply only to the extent that, and for as long as, it is necessary and proportionate, and the DPA’s decision must be subject to an effective judicial remedy. In Austria, the entire file, including the restricted information, is transmitted on appeal to the Federal Administrative Court, which may amend or overturn the DPA’s decision [18] Judgment of the Court of Justice of 16 November 2023, Ligue des droits humains ASBL and BA v Organe de contrôle de l’information policière (OCIP), C-333/22, ECLI :EU:C:2023:874, paragraphs 41-42 and 55.
.
Finally, some interviewees in both judicial and law enforcement authorities expressed concerns over the mere possibility of requests for the erasure of personal data, as this could tamper with the evidence of the file and the conduct of the investigation. In two Member States, interviewees declared that any requests to erase data were automatically denied.
From the moment an investigation is running, given that it’s confidential, there is no reason to disclose information about the investigation, including personal data. So during the investigation, there is no reason to give access to personal data. We systematically refuse. This can be more easily accepted once the case is closed. Then we give access.
A DPO at a judicial authority
FRA interviews outlined some inconsistencies in how law enforcement and judicial authorities manage data subjects’ rights. While awareness of these rights is high, their practical enforcement varies, with different roles attributed to DPOs and operational staff across Member States. Some DPOs centralise requests to ensure consistency, yet others defer entirely to operational teams or limit their role to advisory support. Operational staff, meanwhile, often lack direct involvement, with many reporting few or no requests, suggesting low public awareness of LED rights.
FRA interviews highlighted significant practical challenges. The identification hurdles mentioned by some interviewees (whereby verifying requesters’ identities delays their responses) can put them at risk of non-compliance with LED timelines. In addition, the lack of clarity on the rules regulating restrictions can lead to ad hoc refusals. While some promising practices demonstrate how structured processes can improve transparency and legality, some interviews seemed to highlight more systemic issues (e.g. authorities automatically denying erasure requests).
The LED mandates DPAs with supervisory and investigatory powers to verify the correct implementation of the directive by competent authorities (see box ‘ DPAs’ investigation competence and investigatory powers’), with a notable exemption for judicial authorities, as stated in Article 45(2).
All interviewees working in law enforcement and the judicial authorities (operational staff and DPOs alike) were asked whether they were aware of any investigation conducted by the DPA in their authority. Among the DPOs working in law enforcement authorities, some stated that they were investigated once, and one DPO stated that they were investigated several times. Two reported that they had only experienced GDPR-related investigations, and three stated that they had never been investigated. Among the 14 DPOs working in prosecutors’ offices, most reported that their office underwent one or several investigations, three did not recall any investigation (although one insisted that they were not exempt from any supervision by the national DPA) and one recalled that the prosecutor’s office was exempt from DPA supervision.
Most DPOs working in law enforcement indicated that their authority was regularly inspected (or audited) by the DPA. Some interviewees working in law enforcement authorities indicated that they believe that the DPA has no authority to investigate them. One interviewee from a law enforcement authority, for example, stated that ‘the national DPA is not responsible for them, since police matters are state affairs’.
Among the 43 operational agents interviewed who were working in law enforcement, one third of them (from 10 Member States) were generally aware of their authority being investigated or audited. Two of these (from the same Member State but from two different entities) indicated that they actively participated in the inspections. Finally, among the interviewees working as prosecutors or judges, one prosecutor indicated that they believed that the prosecutor’s office had undergone an investigation by the DPA, but they were unsure. Of the remaining interviewees, several were not aware of any investigation, a few stated that they had never been investigated, some were aware of complaints by data subjects to the DPA (without clarifying whether these led to investigations) and some of them stated that judicial authorities are exempt from the DPA’s supervision.
Most DPOs (in both law enforcement and judicial authorities) insisted that they had a very good relationship with the DPA, with some of them indicating that they actively participated in the inspections or investigations (e.g. accompanying the DPA agents). The good cooperation with, and crucial role of, DPOs was also highlighted by several respondents from DPAs (see Section 3.2.2).
However, among DPOs, a few of them (working in law enforcement) who were involved in inspections conducted by the DPA did report some communication challenges. These were related to what they considered to be a theoretical perspective of data processing from the DPA or to a time-consuming necessity ‘to prepare the DPA’s employees for the task, especially if the DPA sends young and inexperienced employees who do not know or understand the specific systems the police use’.
In judicial authorities, one public prosecutor and a few DPOs raised concerns regarding the supervision powers given to the DPA (especially when it comes to providing access to the files). In their view, a conflict between data protection and criminal procedural legislation may emerge when faced with investigations by the DPA.
It’s simply difficult for us to always explain to the data protection authority how we work and why this is necessary and to recognise the differences, that we have to work differently and that the data protection regime, the LED regime, doesn’t really suit us in this form, that’s difficult.
A public prosecutor at a judicial authority
The main law regulating criminal proceedings is the procedural criminal code, which governs all actions and appears to preclude the need for involvement of any other regulation. The secrecy of pretrial information must be protected, and the requirement to disclose pretrial investigation information to the DPA conflicts with the provisions of the procedural criminal code.
A DPO at a judicial authority
Two operational staff from one Member State working in law enforcement who actively participated in an inspection by a DPA indicated that the inspection proved to be demanding in terms of workload. One of these interviewees stated that requests from the DPA included statistics and data that ‘they would not collect’ and the second interviewee stated that the requests included ‘written information, technical information, a presentation on procedures and processes, as well as demonstrations and logs’. The first interviewee clarified that all of the shortcomings were addressed; however, the second interviewee stated that this inspection proved to be particularly stressful, notably because of the difficulty to ‘understand each other’; in the view of the interviewee, the DPA agents’ understanding of their work was too ‘theoretical’ and ‘disconnected from day-to-day law enforcement’.
The national DPAs … continue to enforce rules whose meaning has since shifted through interpretation.
An officer at a law enforcement authority
Some DPOs and one operational staff member working in law enforcement clarified that they consider these inspections and investigations to be very constructive. They have added value beyond the objective of the inspection, as DPAs use this time to provide them with advice. The corrective measures mentioned by interviewees include changing internal practices, issuing new guidelines, conducting targeted training sessions and communicating directly with the individual office, their entire unit or similar units. Several DPOs and a few operational agents clarified that specific procedures govern these inspections, including follow-up steps to be implemented by the DPO office to correct any misprocessing detected and implementing measures to identify and prevent the reoccurrence of such mismanagement. Interestingly, in one case, another operational staff member working in law enforcement (more specifically in the legal department in charge of legal surveillance through cameras and drones) not only was aware of the inspections by the DPA, but believed that these are ‘not as frequent as they should be’.
In one Member State, the DPA has developed guidelines to detail the procedure of investigating competent authorities. In this guidance, the DPA is instructed not to address the DPO, in order to protect its independence. This was viewed positively by the DPO staff interviewed by FRA.
The [national] DPA has published a kind of guidance on their cooperation with the DPO. It explicitly states that in the case of specific enforcement requests, the DPO will be informed, but will be kept at a greater distance, because the DPO must remain independent if the DPA and the data controller communicate with each other. We are very pleased with this, because otherwise, it puts you in a difficult position – if there is a formal request for information and the organisation wants to respond in a certain way, but you may have a different perspective or different information, you don’t want to be caught in the middle. Additionally, if you have a different perspective or different information that requires you to act, you can do so accordingly.
A DPO at a judicial authority
Despite the LED’s clear mandate when it comes to DPAs’ supervision over competent authorities, as set out in Articles 45–47 of the LED, the FRA interviews with staff working in law enforcement and judicial authorities revealed uneven (and sometimes contested) DPA supervision. While most DPOs reported regular inspections (and often described them as constructive), some operational staff assume that their authority is exempt from any DPA supervision. Several competent authorities’ operational staff insisted on what they perceived as a lack of institutional knowledge of law enforcement systems from DPAs and complained about resource-intensive requests. However, positive findings (e.g. collaborative DPA–DPO relationships and post-inspection improvements) show how proactive engagement can bridge gaps. However, systemic reform is needed to avoid supervision being perceived as burdensome rather than a safeguard for lawful processing. The LED’s accountability framework depends on effective, trusted enforcement.
The LED provides that data protection experts should be consulted by staff working in law enforcement and judicial authorities when these staff require advice and guidance, both internally (DPOs) and externally (DPAs).
Article 34 of the LED provides that DPOs should ‘inform and advise the controller and the employees who carry out processing of their obligations’ and, specifically when it comes to DPIAs, they should ‘provide advice where requested as regards the data protection impact assessment and monitor its performance’.
Article 46(1) of the LED provides that DPAs should ‘promote the awareness of controllers and processors of their obligations under this directive’ and ‘provide advice on the processing operations referred to in Article 28’. To do so, Article 47 clarifies that DPAs should have ‘effective advisory powers to advise the controller’. Article 28 refers to specific cases when competent authorities should consult their DPA. These cases concern the processing of data which ‘will form part of a new filing system to be created’ if one of the following two conditions apply: (1) a DPIA has shown that the processing would result in a high risk to the rights and freedoms of individuals in the absence of measures taken by the controller to mitigate the risk or (2) the type of processing (in particular when using new technologies, mechanisms or procedures) involves a high risk to the rights and freedoms of individuals.
Among 43 operational staff working in law enforcement authorities, just over half (23) reported that they experience good and fruitful cooperation with their DPOs and consult them on a regular basis. By contrast, 12 operational staff working in law enforcement authorities claimed that they are not in contact with their DPO at all or are not aware of consultations. One respondent observed that the DPO is not visible in their daily work, and the interviewee stated that they are not aware whether the DPO operates at the unit level or as a centralised function. When necessary, the interviewee contacts the lead investigator or the legal department of the police. On the other hand, another operational agent from the same Member State noted that they consult their institution’s DPO and described the DPO as responsive and understanding of their operational needs. Furthermore, one respondent noted that interactions with the DPO are highly hierarchical and conducted in writing through the chain of command. Another noted that they are allowed to contact the DPO only through a superior.
We have a very good relationship with the data protection office. And indeed, there would be certain things that, of course, we would look for advice on. And you know, indeed, when I want to talk about even things like recent judgments, it wouldn’t be just a DPO, it would also be legal, our internal legal section as well.
An officer at a law enforcement authority
Two operational staff working in law enforcement authorities explicitly mentioned structured consultation between data protection experts and operational staff, notably through discussions with police services when amending regulations to specify a new processing purpose or through discussions with end users during system development to determine which data elements are truly essential. One interviewee noted that, while they consult their DPOs, there is a misalignment between the understanding of the organisation’s data protection experts and that of its operational personnel (see the following quote).
What also characterises these challenges in applying the LED is that we often have, on one hand, the operational law enforcement officer understanding and expertise about what type of data processing the police operationally would need. And on the other hand, we have the data protection experts’ and related understanding of what the requirements are for processing according to the GDPR/LED or in national law. Somehow these two don’t align. There ought to be some kind of ‘dictionary’ or interpreter in between or the list of data protection measures (toolkit) typically used to avoid certain types of problems in processing. When we ask the data protection side … whether such processing is allowed or possible, the default answer tends to be: ‘No, it isn’t.’ But no guidance or advice or toolkit is given on how to modify data processing to fulfil properly the GDPR and/or LED requirements.
An officer at a law enforcement authority
Interviewees from law enforcement were also asked if there are any cases in which it is mandatory to consult DPOs. Eleven of them explicitly reported that they are required to consult DPOs, and 16 noted that it is not mandatory (or they are not aware of it being mandatory). Nevertheless, operational agents continue to refer to DPOs’ guidance, even if it is not mandatory. One interviewee noted that, while the advice of the DPO is not legally binding, they have never seen implementation proceed without the agreement of the DPO.
As for seeking advice from DPAs, some interviewees working in competent authorities noted that contact with the DPA is facilitated by DPOs in their institutions. One operational staff member working in a law enforcement authority wished that the DPA was involved at an earlier stage in assessing the police’s actions, rather than only providing guidance after the development of products, which the police would then have to implement. Several interviewees claimed that they have never sought advice from their DPA, and most respondents indicated that they are not aware or have they made use of guidelines issued by the EDPB or their DPA.
Basically, guidelines are the basis of our work, because of course we stick to it. It provides a clear direction, how we work, how we handle data. If we didn’t have that, then everyone would do what he believes is right. There has to be a clear line and it is also a certainty of action for each individual, because he knows exactly, if I stick to that, then I’m not doing anything wrong. Yes, that is very important, that such a thing exists.
An officer at a law enforcement authority
In contrast, within judicial authorities, most interviewees indicated that they do not consult their DPOs, and there are no mandatory requirements obliging them to do so. Only some of them mentioned some consultations that they participated in, and only one interviewee noted that there are cases when they are obliged to consult the DPO. The same patterns are visible in cooperation with DPAs – most interviewees claimed that they do not seek advice from DPAs or are not aware of such cooperation. No interviewees referred to other types of consultations, such as external legal or IT experts, but some of the DPOs working in the judicial authorities who were interviewed claimed that they are sometimes contacted by prosecutors.
When asked about their experiences with DPIAs, a majority of interviewees from law enforcement noted that they do not have direct experience with the process and that they consider this as something that the DPOs would be involved in. Operational staff interviewed by FRA that indicated they were involved in DPIAs reported having an overall good experience in this process. Among judicial authorities, the majority of respondents stated that they were either unaware of whether a DPIA was conducted, had never conducted a DPIA or had no experience in this regard. Some of them had never heard of the term ‘DPIA’ or were unfamiliar with what it was.
Some interviewees in law enforcement reported challenges when it comes to implementing DPIAs. A few operational agents described DPIAs as being ‘unclear’, ‘formalistic’, ‘burdensome’ or ‘overly rigid’ and lamented the lack of methodical guidance. One interviewee described that, while in the past DPOs had participated in the development of data processing, a change in the law requiring no conflict of interest between the DPOs and the police resulted in the DPO becoming extremely cautious, providing minimal consulting support to avoid conflicts of interest. The interviewee’s state police force responded to this problem by introducing ‘operational data protection’ services to obtain the advisory support that official DPOs were now refusing to provide.
Despite this, as reported under Section 1.1.4, according to some DPOs working in law enforcement, police officers generally focus on the operational benefits and overlook matters of compliance or data protection. Nevertheless, for a majority of DPOs, education and training are key: police officers need to receive more guidance and assistance when it comes to data protection.
The FRA interviews reveal a fragmented approach to consulting DPOs and DPAs, with law enforcement and judicial authorities facing distinct challenges. Many operational staff in law enforcement report positive, regular engagement with DPOs, valuing their responsiveness and operational awareness, but others described hierarchical barriers and even sometimes a complete lack of interaction, revealing inconsistent integration of data protection advice. A cultural divide persists between operational needs and compliance expectations, with some practitioners still perceiving DPOs as obstructionist, despite general improvements. Judicial authorities exhibited lower engagement, with most interviewees reporting no DPO consultations, often reflecting assumptions of exemption under Article 45(2) of the LED. DPA interactions with competent authorities appeared to be limited, with some practitioners mistrusting DPAs’ supportive role or being unaware of their guidance. This knowledge deficit extends to DPIAs, in relation to which law enforcement staff often defer to DPOs but criticise the process as overly rigid or unclear, while judicial actors display near-total unfamiliarity, with some of them never having heard the term. Advice seeking is key to avoiding compliance being viewed as an obstacle rather than a safeguard, yet FRA findings show that DPOs’ and DPAs’ expertise remain underutilised.
To support harmonised and effective implementation of the LED, both the European Commission and the European Union Agency for Law Enforcement Cooperation (Europol) have established networks so that DPOs of competent authorities can meet, exchange experiences and practices and discuss challenges or doubts. The European Commission’s DPO Network is made up of DPOs from both law enforcement and judicial authorities, while the Europol Data Protection Experts Network (EDEN) is made up of DPOs only from law enforcement authorities. In the interviews, DPOs in law enforcement and judicial authorities were asked whether they were aware of such networks at the European and national levels and about their engagement in these networks.
While most of the DPOs interviewed by FRA confirmed that they were aware of EU networks – with some of them also confirming that they do participate in these networks – only some of them indicated that they cooperated at the national level. Some DPOs regretted the absence of forums at the national level to have discussions among experts. One interviewee, however, noted that, although no formalised network exists, the professionals in the field know each other through shared training experiences and keep collegial communications. In Member States that do have a network of experts at the national level, interviewees indicated that, given the specificity of the topic, such networks are indeed very useful (see box ‘Promising practice: national network established among DPOs in the competent authorities (Belgium and Denmark)’).
Concerning their relationship with national DPAs, the views of the DPOs in the law enforcement and judicial authorities were contrasting. Several of them observed good cooperation with national DPAs during investigations that the authority conducts. In a few Member States, however, DPOs expressed frustration and a rather negative opinion, as they complained about their national DPA not replying when contacted, not providing training or information adapted to the work conducted by law enforcement authorities or not providing adequate support that was tailored to their work. One interviewee noted that their DPA is reluctant to provide definitive interpretations of data protection law transposing the LED, in order to retain flexibility during enforcement actions.
While EU-level networks are positively recognised as fostering cross-border dialogue, the FRA research reveals uneven and underdeveloped cooperation among law enforcement and judicial authorities at the national level. Belgium and Denmark’s structured national networks (facilitating shared interpretations, case discussions and guideline development) demonstrate the value of systematic exchange. Relationships with national DPAs are mixed, ranging from constructive partnerships to frustration over a perceived lack of tailored guidance or a reluctance to clarify LED interpretations. This lack of cooperation is often a missed opportunity for harmonised, effective LED implementation.
