Processing of personal data by the police and other law enforcement authorities

By Lefteris Chelioudakis

General Regulation 2016/679 for the processing of personal data (GDPR) has monopolised interest recently. You may have already read articles by Homo Digitalis on GDPR or have read articles on newspapers, websites, etc.

But what do you know about GDPR’s younger sister, Directive 2016/680? Probably nothing.

EU Directive 2016/680 regulates a very important part of the processing of personal data, which must concern every citizen of a democratic country. The Directive concerns the processing of data by the national law enforcement authorities for the prevention, investigation, tracking or prosecution of crimes or the implementation of criminal sanctions.

Which are these authorities? Greek Police, the Hellenic Coast Guard and the Special Secretary of the Economic Crime Prosecution Authority, which is part of the Ministry of Economics, are some of them. Furthermore, Directive 2016/680 also applies on the activities of the national judiciary.

Regarding the judiciary, the acts and procedures of processing of personal data, which are included in court decisions or archives of criminal procedures, may be further elaborated by every EU Member States through its national legislation on criminal procedure (i.e. the Criminal Procedure Code in Greece).

The same national rules should regulate the implementation of the right to get informed, the right to access, the right to correction, the right to erasure and the right to limit the processing of personal data in the context of a criminal investigation and criminal procedure in the national courts.

Additionally, to safeguard the impartiality of the judiciary, the national monitoring authorities (such as the Authority for the Protection of Personal Data in Greece) do not have jurisdiction upon the processing of personal data when the courts act under their judicial power.

Furthermore, the EU Member States may provide that the national monitoring authorities do not have jurisdiction upon the processing of personal data by other judicial authorities, which act in their judicial power, such as the prosecuting authorities.

It must be noted though that the proper implementation of the Directive 2016/680 by courts and other judicial authorities should always be subject to impartial inspection, according to the EU Charter of Fundamental Rights Article 8, paragraph 3.

So, why is Directive 2016/680 important?

The first reason is that it replaces a very poor legislative framework, Decision 2008/977/ΔΕΥ, which unfortunately has a very limited scope – the transboundary exchange of data between law enforcement authorities of the EU Member States- and did not strike a fair balance between the necessities of law enforcement authorities in the context of their investigations and the rights of the persons involved in these investigations. As a result, the legal values on processing of personal data, were not respected and the rights of the data subjects were significantly weakened.

The second reason is that it constitutes the first step for the residents of the EU area to enjoy an equal level of protection when their personal data are processed by the police and the other law enforcement authorities. For the first time, a legal act regulates in a uniform fashion in the EU the way that the police officer in your neighborhood, the border guards, etc. may process your personal data. Therefore, when incorporated in the Greek legal order, the provisions of Directive 2016/680 must clearly regulate the way in which you will be able to exercise your rights before the police or the other law enforcement authorities.

It is for sure that in relation to the GDPR, your rights and the legal values regarding the processing of your personal data are significantly weaker.

However, there are provisions in which Directive 2016/680 is stricter than the GDPR. For instance, the recordings (Article 25) constitute one of these provisions. Thanks to them, when a police officer searches or shares information on you, your identity, the reason for his act and the precise date and time on which this act occurred must be recorded. Thus, these recorded files may subsequently be used to verify the legality of the processing, as well as the protection of objectivity and the safety of personal data in the context of criminal proceedings. Recordings constitute an extra obligation, which adds to the one of simple filing of the acts of processing (Directive 2016/680, Article 24 and GDPR Article 30).

Caution! Directive 2016/680 does not concern the processing of your personal data by intelligence services of the EU Member States, such as the National Intelligence Service in Greece. This happens because Directive 2016/680 is part of the EU legislation and EU law does not include issues of national security in its scope; these remain on the exclusive legislative discretion of each Member State. In this case, national law must be harmonized with the Council of Europe law and more particularly the European Convention on Human Rights kai the Convention on the protection of natural persons from automated processing of their personal data (“Convention 108”), which includes national intelligence services in its scope.

Directive 2016/680 must be transposed by all Member States in their national legal orders; this transposition is very important for the interpretation of its provision in the national level.

Although Member States should have adopted and published the necessary national legal reforms to comply with this Directive until 6 May 2018, until the day when this article was published, Greece had not adopted any law on the issue. Only Czech Republic, Ireland, Croatia, France, Italy, Austria, Luxembourg, Malta, Portugal, Germany, Lithuania, Sweden, United Kingdom and Slovakia have done so until today.

Homo Digitalis watches closely the procedure regarding the draft law for the Protection of Personal Data to comply with EU Regulation 2016/679 and incorporate EU Directive 2016/680. Thus, when the procedure is completed and the final provisions are voted, Homo Digitalis will inform you on your rights and the obligations of the law enforcement authorities.