Between GDPR and Law Enforcement Directive in Security Research: The Use of Personal Data by Law Enforcement Authorities

Authors

  • Stergios Aidinlis Durham University
  • David Barnard-Wills Trilateral Research
  • Leanne Cochrane Trilateral Research
  • Krzysztof Garstka Trilateral Research
  • Agata Gurzawska Trilateral Research
  • Joshua Hughes Trilateral Research

Abstract

European law enforcement agencies (LEAs) increasingly seek to make additional use of the personal data they have gathered, particularly for the purpose of research. This raises practical data protection challenges for these agencies and their research partners. LEAs may be uncertain about which data protection instrument – if any – should govern such processing; a question best answered by disentangling the blurry boundary between operational and research activities. This article takes on that task, by examining the applicability of the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) to LEA research activities, in particular those based on LEA-held personal data. It also considers the practical implications of choosing one instrument over the other and gives guidance on legal choices that follow, with respect to issues such as identifying the legal basis for processing, and setting the data controllership arrangements.

Downloads

Published

30.12.2024

Issue

Vol. 15 No. 3 (2024): EJLT

Section

Refereed Articles

License

EJLT is an open access journal, aiming to disseminate academic work and perspectives as widely as possible to the benefit of the author and the author’s readers.  It is the assumption of the EJLT that authors who publish in the journal wish their work to be available as freely and as widely as possible through the open access publishing channel.

Authors who publish with EJLT will retain copyright and moral rights in the underlying work but will grant all users the rights to copy, store and print for non-commercial use copies of their work. Commercial mirroring may also be carried out with the consent of the journal. The work must remain as published – without redaction or editing – and must clearly state the identity of the author and the originating EJLT url of the article.  Any commercial use of the author’s work - apart from mirroring - requires the permission of the author and any aspects of the article which are the property of EJLT (e.g. typographical format) requires permission from EJLT.

Authors can sometimes become no longer contactable (through, for example, death or retirement).  If this occurs, any rights in the work will pass to the European Journal of Law and Technology which will continue to make the work available in as wide a manner as possible to achieve the aims of open access and ensuring that an author's work continues to be available.  An author - or their estate - can recover these rights from EJLT by providing contact information.

The European Journal of Law and Technology holds rights in format, publication and dissemination.
 
EJLT, as a non-commercial organisation - which receives donations to allow it to continue publishing – must retain information on reader access to journal articles. This means that we will not give permission to mirror the journal unless we can be provided with full details as to reader access to each and every journal article.  We prefer and encourage deep linking rather than mirroring.  Encouragement is thus given for all users – commercial and non-commercial – to provide indexes and links to articles in the EJLT where the index or link points to the location of the article on the EJLT server, rather than to stored copies on other servers.

Please contact the European Journal of Law and Technology if you are in any doubt as to what this statement of use covers.