Law Enforcement

Legal Framework

Processing for law enforcement purposes falls outside the GDPR and is governed by Directive (EU) 2016/680 (the Law Enforcement Directive, or LED), which regulates competent authorities processing personal data for the prevention, investigation, detection, or prosecution of criminal offences. The AI Act overlays additional requirements when law enforcement authorities deploy AI systems, classifying many such systems as high-risk under Annex III, point 1(a).

The AI Act's definition of "deployer" captures public authorities using AI systems:

For high-risk law enforcement AI systems, Article 12 imposes specific logging requirements:

"the logging capabilities shall provide, at a minimum: (a) recording of the period of each use of the system (start date and time and end date and time of each use);"
— AI Act Art. 12

Article 16 places conformity and documentation obligations on providers, while Article 21 requires cooperation with competent authorities upon reasoned request.

Key Developments

In Ryneš (CJEU, 2014), the Court addressed a home video surveillance system that captured footage of criminal conduct later used in criminal proceedings:

"The video surveillance system at issue made it possible to identify two suspects. The recording was handed over to the police and relied on in the course of the subsequent criminal proceedings."
— Ryneš ¶15

The case illustrates the intersection of private processing and law enforcement use — where data collected under one legal regime flows into another.

The Italian Garante has enforced the principle that even public-interest monitoring must respect data minimization:

"The DPA finds that the controller thus violated the principle of data minimization, lawfulness and purpose limitation. The controller should rather have taken less intrusive measures to prevent the private use of the Internet."
— Garante (Comune di Bolzano)

The EDPB has issued Guidelines 01/2023 on Article 37 LED, addressing DPO requirements within law enforcement authorities.

Status of the Debate

This topic is contested in court. Courts diverge on the boundary between private processing that supports law enforcement and processing that constitutes law enforcement activity itself. Ryneš established that private surveillance can lawfully feed criminal proceedings, but the conditions under which such data transfers occur remain actively litigated. The AI Act adds a further layer: whether law enforcement AI systems are properly classified as high-risk, and whether logging and conformity obligations are met, will generate new litigation. No court split has yet crystallized on the AI Act's law enforcement provisions; CJEU preliminary references on LED–AI Act interaction would resolve the open questions.

Practical Guidance

• Determine the applicable regime: Confirm whether processing falls under the LED (competent authority, criminal offence purpose) or the GDPR (private controller). Mixed scenarios require analysis of each processing stage.
• Implement AI Act logging: Ensure high-risk law enforcement AI systems comply with Article 12 logging requirements, including time-stamped records and identification of verifying personnel.
• Respect minimization even in public-interest contexts: The Garante's enforcement confirms that monitoring, even for legitimate purposes, must use the least intrusive means available.
• Maintain cooperation readiness: Under Article 21, providers must furnish conformity documentation and log access upon reasoned request.
• Designate a DPO under LED Article 37: Follow EDPB Guidelines 01/2023 for proper DPO designation within law enforcement authorities.