Law Enforcement

Legal Framework

Processing of personal data for law enforcement purposes falls primarily under Directive (EU) 2016/680 (the Law Enforcement Directive, or LED), which governs processing by competent authorities for the prevention, investigation, detection, or prosecution of criminal offences. The GDPR expressly excludes such processing under Article 2(2)(a). The LED requires a legal basis under national law for each processing operation, along with necessity and proportionality safeguards. Article 7 CFR (respect for private and family life) and Article 8 CFR (protection of personal data) operate as overarching constitutional constraints, as confirmed in Digital Rights Ireland v. Ireland, where the CJEU held that mandatory data retention in itself constitutes an interference with Article 7 CFR, and that subsequent access by national authorities constitutes a further, separate interference requiring its own justification.

The AI Act imposes additional obligations where law enforcement authorities deploy high-risk AI systems. Article 16 AI Act requires providers to ensure conformity with Section 2 requirements, maintain quality management systems under Article 17, and retain technical documentation and automated logs under Articles 18 and 19. The DSA complements this framework by providing recipients of services a right to lodge complaints with Digital Services Coordinators under Article 53, with each Member State designating a single coordinating authority per Recital 110.

Key Developments

The CJEU has established critical thresholds for lawful enforcement-related processing. In Digital Rights Ireland, the Court invalidated blanket data retention obligations, requiring targeted retention with clear scope limitations and prior judicial or independent administrative review before access. In Ryneš v. Úřad pro ochranu osobních údajů, the Court accepted that domestic video surveillance capturing public spaces for the purpose of protecting property could fall within the household exemption, but recordings handed to police for criminal proceedings were deemed processing subject to data protection law. In Breyer v. Bundesrepublik Deutschland, the Court held that IP addresses constitute personal data where the online service provider has legal channels to obtain identifying information through competent authorities and ISPs, even where direct identification is not possible (paragraphs 47–48). In Minister voor Immigratie v. M, the Court clarified that legal analysis applied to an applicant's situation constitutes personal data when grounded in that individual's circumstances (paragraph 40).

The EDPB has been actively evaluating the LED under Article 62, assessing Member State implementation gaps and harmonization needs. Recent enforcement signals include the Slovenian DPA fining a utility company €6,600 for insufficient legal basis and the Romanian DPA imposing €20,000 on Tensa Art Design S.A. for processing deficiencies during investigation. License plate reader deployments for purposes beyond their original scope—such as school residency verification and noise complaints—continue to attract scrutiny as function creep.

Practical Guidance

• Establish a specific national law basis for each processing activity. The LED requires that every law enforcement processing operation be grounded in a precise, accessible national legal provision—not merely internal policy or general police powers.

• Apply necessity and proportionality at the access stage, not merely at collection. Digital Rights Ireland requires that access to retained data by competent authorities undergo independent review and be limited to what is strictly necessary for the specific investigation.

• Treat IP addresses and surveillance footage as personal data regardless of whether direct identification is immediately possible. Breyer confirms that the existence of legal channels to obtain identifying information through authorities suffices to trigger data protection obligations.

• Implement purpose limitation controls to prevent function creep when deploying surveillance technologies such as license plate readers. Expanding use beyond the original law enforcement purpose—e.g., to administrative verification—requires a separate legal basis and impact assessment.

• Where AI systems are deployed for law enforcement, ensure Article 16 AI Act compliance by maintaining quality management documentation, retaining automated logs, and verifying conformity with high-risk system requirements before deployment.