On January 25, 2012, the EU Commission set forth a proposal for a Directive to regulate data protection in the law enforcement sector. The Proposal Directive is designed to replace the current Framework Decision enacted in 2008 which has been widely criticized for being laden with loopholes, difficult to apply in real-world situations and generally incoherent. As such, it is unsurprising that when viewed in comparison to the Framework Decision, the Proposal Directive can be seen to raise the proverbial bar for data protection rights in the law enforcement context.
First, and most basically, the Proposal Directive will be capable of having direct effect which means that individuals should be able to enforce the rights conveyed in the Proposal Directive in the courts of EU Member States. Furthermore, and in a substantial departure from the Framework Decision, the Proposal Directive will apply equally to both cross-border data processing and all data processing activities by the police and judiciary authorities at a purely national level. The result of this new provision will be to eliminate many difficulties for the police and other competent authorities who have found it hard to distinguish between purely domestic and cross-border processing in practice.
Also unlike the Framework Decision, the Proposal Directive requires the distinction, as far as possible, between data based on facts and data based on opinions or personal assessments. This will help clarify the accuracy and reliability of the data before it is made available in compliance with the data quality principle. Similarly, the Proposal Directive distinguishes between personal data of different categories of data subjects (e.g. witnesses, victims). This is relevant in determining, first, whether the processing of the personal data is proportionate to the objective pursued and, second, whether additional safeguards are required to protect the specific needs of individuals. Furthermore, the Proposal Directive establishes supervisory authorities, attempts to address the complicated issue of profiling and seeks to increase transparency in the field by requiring, among other things, data breach notifications.
The Proposal Directive, however, could have gone much further towards strengthening individual data protection rights. By opting for a separate directive addressing data protection in the law enforcement context rather than creating a single, comprehensive regulation for data protection with general application across the EU, the Proposal Directive fails to recognize the growing involvement of the private sector in law enforcement. That is, increasingly, data moves between the private sector to the law enforcement sector, the result of which has been a blurring of the different categories of data and an obfuscation of the legal rules.
While the Proposal Directive seeks to narrow the derogations to the purpose limitation principle that were set forth in the Framework Decision, there still remains a lack of legal certainty about the onward processing of personal data by law enforcement authorities beyond the initial purpose for which the data was collected. This uncertainty is, of course, highly problematic from the perspective of the data subject who, pursuant to the basic guidelines of the Council of
Europe Convention No. 108, should be in a position to reasonably foresee how his or her data will be processed. This is particularly true in the law enforcement context where the power of the State is at its pinnacle.
Furthermore, the Proposal Directive fails to sufficiency clarify the procedure for sending data to third countries which is especially disappointing in light of the increasingly global and networked environment. It also creates a fragmented and uncertain legal environment to the extent that it does not apply to processing by Union institutions, bodies, offices and agencies.
For more analysis, please see a memo that I have written on this topic.
