Law Enforcement Directive

Article 1 Subject-matter and objectives

This directive establishes rules for protecting natural persons' personal data processed by competent authorities in criminal prevention, investigation, detection and prosecution, and public security threats. Member States must protect fundamental rights and freedoms, particularly data protection, and must not restrict or prohibit data exchanges within the Union required by law.

Article 2 Scope

The directive applies to personal data processing by competent authorities for criminal and security purposes, whether automated or forming part of a filing system, but excludes processing outside Union law scope and by Union institutions.

Article 3 Definitions

Personal data means information about identified or identifiable natural persons; processing covers any operation on such data; restriction means marking stored data to limit future processing; profiling means automated processing to evaluate personal characteristics; pseudonymisation, filing systems, and competent authorities (public authorities or entities with law enforcement powers) are also defined. Recipients are entities to which data are disclosed, but public authorities receiving data in lawful inquiries are not recipients. A personal data breach is a security breach causing accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access.

Article 4 Principles relating to processing of personal data

Member States must require processing to be lawful and fair, collected for specified purposes without incompatible use, adequate and not excessive, accurate and current, retained only as long as necessary, and secured against unauthorised processing and damage. Processing for other purposes is permitted if authorised by law and necessary and proportionate; controllers are responsible for demonstrating compliance and may retain data for archiving, scientific, statistical or historical use with appropriate safeguards.

Article 5 Time-limits for storage and review

Member States must establish time limits for erasing personal data or reviewing storage necessity, with procedural measures to ensure these limits are observed.

Article 6 Distinction between different categories of data subject

Controllers must, where applicable and possible, distinguish between personal data of suspects or perpetrators of offences, convicted persons, victims of offences, and other parties such as witnesses, informants or associates.

Article 7 Distinction between personal data and verification of quality of personal data

Member States must distinguish factual data from assessments; competent authorities must verify data quality before transmission or disclosure and indicate accuracy, completeness and currency in all transmissions. If incorrect or unlawfully transmitted data are discovered, the recipient must be notified without delay and data must be rectified, erased or restricted.

Article 8 Lawfulness of processing

Requires that processing by competent authorities be lawful only when necessary for tasks under Article 1(1) and based on Union or Member State law. Member States must specify by law the processing objectives, categories of data processed, and purposes.

Article 9 Specific processing conditions

Allows processing of data collected by competent authorities only for Article 1(1) purposes unless other laws permit it; the General Data Protection Regulation applies to other processing unless outside Union law scope. Where competent authorities perform other tasks, the General Data Protection Regulation applies. Transmitting authorities must inform recipients of any conditions attached to data and require compliance, but need not apply such conditions to recipients in other Member States or Union bodies beyond conditions applied domestically.

Article 10 Processing of special categories of personal data

Processing of information identifying ethnicity or ancestry, political affiliation, faith, philosophical positions, union participation, genetic information, biometric identifiers, medical information, or sexual matters is allowed only when strictly needed and with proper protections, and must be authorised by law, necessary to protect someone's vital interests, or concern information the person has publicly disclosed.

Article 11 Automated individual decision-making

Requires Member States to prohibit decisions based solely on automated processing, including profiling, that have adverse legal effects or significantly affect the subject, unless authorised by law with safeguards including human intervention rights. Prohibits such decisions based on special category data unless suitable safeguards exist. Prohibits profiling that discriminates based on special category data.

Article 12 Communication and modalities for exercising the rights of the data subject

Requires controllers to provide information in a clear, concise and accessible form by appropriate means, normally matching the request format, and to facilitate subject rights. Controllers must respond in writing without undue delay and provide information and communications free of charge; controllers may charge reasonable fees or refuse manifestly unfounded or excessive requests if they demonstrate the excessive nature. Controllers may request additional identity information if reasonably doubting the subject's identity for access or rectification requests.

Article 13 Information to be made available or given to the data subject

Requires controllers to make available the controller's identity and contact details, data protection officer contact details if applicable, processing purposes, right to lodge a complaint with the supervisory authority and its contact details, and rights to request access, rectification or erasure and processing restriction. Additionally, in specific cases, controllers must provide legal basis, storage period or criteria, recipient categories including third countries, and further information needed to exercise rights.

Article 14 Right of access by the data subject

Gives data subjects the right to obtain confirmation whether their data is processed and, if so, to access the data plus information on processing purposes and legal basis, data categories, recipients including in third countries, storage period or criteria, rights to rectification or erasure or restriction, supervisory authority complaint procedures, and the data and its origins.

Article 15 Limitations to the right of access

Allows Member States to restrict access rights by law when necessary and proportionate to avoid obstructing inquiries or investigations, prejudicing criminal offence prevention or prosecution, or protecting public security, national security or others' rights. Controllers must inform subjects in writing of refusal or restriction with reasons unless providing information would undermine the restriction purpose, and must document their grounds and make them available to supervisory authorities.

Article 16 Right to rectification or erasure of personal data and restriction of processing

Requires controllers to correct inaccurate data and complete incomplete data without undue delay at the subject's request. Controllers must erase data without undue delay where processing violates Articles 4, 8 or 10 or where erasure is legally required, or instead restrict processing where accuracy is contested or evidence must be preserved. Controllers must notify subjects in writing of refusals with reasons, though Member States may restrict this notification if necessary and proportionate for inquiries, criminal investigations, public or national security, or others' rights, and must inform subjects of complaint and legal remedy options.

Article 17 Exercise of rights by the data subject and verification by the supervisory authority

In certain cases covered by Articles 13(3), 15(3) and 16(4), Member States must enable people to exercise their rights through the supervisory authority. Controllers must inform people of this possibility. When rights are exercised this way, the supervisory authority must tell the person that necessary verifications have occurred and inform them of their right to seek judicial remedies.

Article 18 Rights of the data subject in criminal investigations and proceedings

Member States may restrict the exercise of rights under Articles 13, 14 and 16 when personal data appear in judicial decisions, records, or case files processed during criminal investigations and proceedings, applying their own national law.

Article 19 Obligations of the controller

Controllers must implement appropriate technical and organizational measures to ensure compliance with the Directive, considering the nature, scope and purposes of processing and the risks involved, and be able to demonstrate such compliance through regular review and updates. Where proportionate, these measures must include implementing suitable data protection policies.

Article 20 Data protection by design and by default

Controllers must implement technical and organizational measures such as pseudonymisation at the time of determining processing means and during processing itself, taking into account state of the art and implementation costs, to effectively implement data protection principles including data minimization. Controllers must also ensure that by default, only necessary personal data for each specific purpose are processed and that personal data are not made accessible to an indefinite number of people without individual intervention.

Article 21 Joint controllers

When multiple controllers together set the purposes and means of processing, member states must treat them as joint controllers who transparently assign their responsibilities for compliance through an arrangement, unless law already determines these responsibilities; this arrangement must name a contact point for individuals, and member states may also allow individuals to exercise their rights against each controller separately.

Article 22 Processor

Controllers must use only processors offering sufficient guarantees to implement appropriate measures ensuring Directive compliance. Processors cannot engage other processors without prior written authorization from the controller and must inform the controller of intended changes. Processing must be governed by a contract or legal act specifying subject-matter, duration, nature, purpose, data types, and requiring that the processor acts only on controller instructions, ensures staff confidentiality, assists with data subject rights, deletes or returns data upon request, provides compliance information, and meets conditions for engaging other processors.

Article 23 Processing under the authority of the controller or processor

Processors and any person authorized by the controller or processor who access personal data must process them only on controller instructions, unless Union or Member State law requires otherwise.

Article 24 Records of processing activities

Controllers must maintain records of all processing categories under their responsibility containing the controller's name and contact details, purposes, recipient categories, data subject and personal data categories, profiling use, transfers to third countries, legal basis, erasure timelines, and security measures. Processors must similarly maintain records for categories of processing on behalf of controllers, containing processor and controller details, processing categories, third country transfers, and security measures. Both records must be in written or electronic form and made available to the supervisory authority on request.

Article 25 Logging

Automated systems must maintain logs documenting at minimum the creation, modification, access, sharing (including transfers), merging, and removal of data; logs of access and sharing must show justification, date, time, and where possible the person accessing or sharing data and the recipients; controllers and processors must provide logs to supervisory authorities on request for verifying lawful processing, monitoring, data security and integrity, and criminal investigations only.

Article 26 Cooperation with the supervisory authority

Member States must require controllers and processors to cooperate with the supervisory authority upon request in performing its tasks.

Article 27 Data protection impact assessment

Where processing, particularly using new technologies, is likely to result in high risk to natural persons' rights and freedoms, Member States must require controllers to conduct an assessment before processing begins. The assessment must include a general description of the envisaged processing, risks to data subjects' rights and freedoms, measures to address risks, safeguards and security measures, and compliance mechanisms, considering rights and legitimate interests of data subjects and other persons concerned.

Article 28 Prior consultation of the supervisory authority

Controllers or processors must consult the supervisory authority before processing that establishes a new filing system when a data protection impact assessment shows high risk without mitigation or processing involves new technologies or procedures with high risk to rights and freedoms; member states can establish lists of such processing; supervisory authorities have up to six weeks (extendable by one month) to provide written advice, and may withhold approval if intended processing would infringe the directive, particularly regarding risk identification or mitigation.

Article 29 Security of processing

Member States must require controllers and processors to implement appropriate technical and organisational security measures relative to the risk, considering state of the art, implementation costs, nature, scope, context and purposes, and varying likelihood and severity of risks to natural persons' rights and freedoms, particularly for special categories of data. For automated processing, after risk evaluation, Member States must require implementation of measures for: equipment access control, data media control, storage control, user control, data access control, communication control, input control, transport control, recovery, and reliability and integrity of system functions.

Article 30 Notification of a personal data breach to the supervisory authority

Controllers must notify the supervisory authority promptly, and if feasible within 72 hours of discovering a breach, unless the breach creates no risk to people's rights and freedoms; processors must notify controllers promptly upon discovering a breach; notifications must describe the breach's nature, affected data categories and approximate numbers, protection officer contact details, likely consequences, and measures taken or planned to remedy it; information may be provided in phases if necessary; controllers must document all breaches to enable supervisory authority verification; breaches involving data transmitted to or from other member states must be reported to those controllers without delay.

Article 31 Communication of a personal data breach to the data subject

Member States must require controllers to communicate breaches likely to result in high risk to natural persons' rights and freedoms to data subjects without undue delay, describing the breach in clear and plain language and including information about data protection officer contact details, likely consequences and remedial measures. Communication is not required if: the controller implemented protective measures rendering affected data unintelligible such as encryption, or took measures ensuring high risk no longer materialises, or communication would involve disproportionate effort (replaced by public communication reaching data subjects equally effectively). The supervisory authority may require communication or determine conditions are met; communication may be delayed, restricted or omitted under Article 13(3) grounds.

Article 32 Designation of the data protection officer

Member States must require controllers to designate a data protection officer, except Member States may exempt courts and independent judicial authorities when acting judicially. The officer must be selected based on professional qualities, particularly data protection law and practice expertise and ability to fulfil assigned tasks. Multiple competent authorities may share a single officer considering organisational structure and size.

Article 33 Position of the data protection officer

Controllers must ensure the data protection officer participates properly and promptly in all data protection matters; controllers must support the officer by providing necessary resources, access to data and processing operations, and assistance in maintaining professional knowledge.

Article 34 Tasks of the data protection officer

Member States must require controllers to assign the data protection officer tasks including informing and advising on obligations under the Directive and other data protection law, monitoring compliance and staff training, advising on data protection impact assessments, cooperating with supervisory authorities, and serving as the contact point for supervisory authority matters and prior consultation.

Article 35 General principles for transfers of personal data

Competent authorities may transfer personal data to third countries or international organisations only when the transfer serves purposes in Article 1(1), targets a competent authority in the receiving country, receives prior authorisation from the originating Member State if data came from another Member State, meets adequacy or safeguards requirements, and for onward transfers receives authorisation after assessing criminal seriousness and protection levels. Transfers without prior authorisation are permitted only to prevent immediate and serious threats to public security when prior authorisation cannot be obtained in time. All transfers must maintain the protection level ensured by the Directive.

Article 36 Transfers on the basis of an adequacy decision

Where the Commission decides a third country, territory, sector, or international organisation ensures adequate protection, assessed by examining the rule of law, human rights, legislation including criminal law and public authority access, data protection rules and security measures, independent supervisory authorities with enforcement powers, and international commitments, transfers may occur without specific authorisation. The Commission continuously monitors developments and may repeal, amend or suspend adequacy decisions by implementing act when adequate protection is no longer ensured, applying immediately for urgent imperative grounds, and publishes lists of countries, territories and sectors with or without adequacy decisions. Adequacy suspensions do not prevent transfers under alternative safeguards or derogations.

Article 37 Transfers subject to appropriate safeguards

Without an adequacy decision, transfers may occur where appropriate safeguards are provided in a legally binding instrument or the controller assesses that appropriate safeguards exist. The controller must inform the supervisory authority of safeguard-based transfer categories and document transfers, making records available to supervisory authorities upon request with details including transfer date, recipient, justification and data transferred.

Article 38 Derogations for specific situations

Without an adequacy decision or appropriate safeguards, transfers to third countries or organisations are allowed only when necessary to protect vital interests, safeguard legitimate interests where national law permits, prevent immediate and serious public security threats, or pursue legal claims related to law enforcement purposes; transfers based on the latter two reasons are prohibited if the subject's fundamental rights and freedoms outweigh the public interest; documented transfers must be made available to supervisory authorities on request.

Article 39 Transfers of personal data to recipients established in third countries

Article 40 International cooperation for the protection of personal data

The Commission and Member States must pursue international cooperation to enforce personal data protection laws, including developing cooperative mechanisms, providing mutual assistance with safeguards, engaging stakeholders, and promoting exchange of legislation and practice.

Article 41 Supervisory authority

Each Member State must establish one or more independent public authorities to monitor application of this Directive and protect fundamental rights in relation to processing. These authorities must cooperate with each other and the Commission, and may be integrated with authorities established under other data protection regulations.

Article 42 Independence

Supervisory authorities must act with complete independence, their members must remain free from external influence and neither seek nor take instructions from others. Members must not engage in incompatible activities, and Member States must ensure authorities receive adequate human, technical, financial resources, premises and infrastructure, with separate public budgets.

Article 43 General conditions for the members of the supervisory authority

Members must be appointed through transparent procedures by parliament, government, head of state, or an independent body, and must have qualifications and experience in personal data protection. Members' duties end through expiry of term, resignation or compulsory retirement, and dismissal is permitted only for serious misconduct or failure to meet required conditions.

Article 44 Rules on the establishment of the supervisory authority

Each Member State must establish by law the supervisory authority's structure, members' qualifications and appointment rules, term duration of not less than four years, reappointment eligibility, and obligations and incompatibilities. Members and staff must maintain professional secrecy during and after employment regarding confidential information including reports of infringements.

Article 45 Competence

Each supervisory authority is competent to perform its tasks on its Member State's territory. Member States may exempt supervisory authorities from supervising processing by courts acting in their judicial capacity, and may exempt supervision of other independent judicial authorities in their judicial capacity.

Article 46 Tasks

Supervisory authorities must monitor and enforce the Directive, promote public awareness of risks and rights, advise national institutions on legislative measures, promote controller and processor awareness of obligations, provide information to data subjects on their rights, investigate complaints from data subjects and organisations, check lawfulness of processing, cooperate with other authorities, conduct investigations, monitor technological developments affecting data protection, and provide advice on processing operations. Submission of complaints must be facilitated through accessible means. Services are free for data subjects and data protection officers, though authorities may charge reasonable fees for manifestly unfounded or excessive requests.

Article 47 Powers

Supervisory authorities must have investigative powers to access personal data and information from controllers and processors, corrective powers including issuing warnings, ordering compliance and imposing limitations on processing, and advisory powers to advise controllers and issue opinions on data protection matters. They may bring infringements to judicial authorities and engage in legal proceedings to enforce the Directive, subject to appropriate safeguards including judicial remedy and due process.

Article 48 Reporting of infringements

Member States must establish effective mechanisms allowing confidential reporting of violations of the Directive to competent authorities.

Article 49 Activity reports

Each supervisory authority must produce an annual report on its work, which may list categories of infringements and penalties imposed; reports must be sent to national parliament, government and designated authorities, and made public along with being provided to the Commission and the Board.

Article 50 Mutual assistance

Member states must require supervisory authorities to exchange relevant information and provide mutual assistance to consistently implement the directive through consultations, inspections and investigations; authorities must respond to requests within one month without undue delay; assistance requests must include necessary details and purpose, and information is limited to that purpose; authorities may refuse only if not competent or if compliance would violate the directive or their own law; authorities must report results and explain any refusals; should use electronic means with standardised formats; must not charge fees, though they may agree to reimburse exceptional costs; the Commission sets procedures by implementing acts.

Article 51 Tasks of the Board

The Board shall advise the Commission on data protection matters, examine questions of Directive application and issue guidelines and recommendations, specifically for breach notification and risk assessment standards, review the practical application of its guidance, provide opinions on third country adequacy, promote cooperation and training between supervisory authorities, and exchange knowledge on data protection worldwide. The Commission must provide the Board with necessary documentation for adequacy assessments and inform the Board of action taken on its opinions.

Article 52 Right to lodge a complaint with a supervisory authority

Data subjects may present a complaint to a supervisory authority when they believe personal data processing breaches rules under this Directive, without limiting other remedies available to them. Where the complaint is submitted to a non-competent authority, that authority must forward it to the appropriate one promptly and inform the data subject of this action. The initial authority shall also provide further assistance if the data subject requests it.

Article 53 Right to an effective judicial remedy against a supervisory authority

Natural and legal persons have the right to judicial remedy against legally binding supervisory authority decisions, and data subjects also have this right if the competent authority fails to handle their complaint or does not inform them of progress or outcome within three months of lodging it. Proceedings must be brought before courts in the Member State where the authority is established.

Article 54 Right to an effective judicial remedy against a controller or processor

Data subjects have the right to judicial remedy when they believe their rights under the Directive have been infringed by non-compliant processing of their personal data.

Article 55 Representation of data subjects

Data subjects may mandate not-for-profit bodies, organisations or associations constituted according to Member State law with public interest objectives and active in data protection to lodge complaints and exercise rights on their behalf.

Article 56 Right to compensation

Member States must ensure that anyone who suffered material or non-material harm from unlawful processing or violation of national rules implementing this Directive can claim compensation from the controller or other competent authority.

Article 57 Penalties

Member States must establish penalty rules for breaches of provisions adopted under this Directive and implement them; penalties must be effective, proportionate and dissuasive.

Article 58 Committee procedure

The European Commission is assisted by the committee established under Regulation 2016/679, which operates under Regulation 182/2011; paragraphs 2 and 3 specify which articles of Regulation 182/2011 apply depending on referenced contexts.

Article 59 Repeal of Framework Decision 2008/977/JHA

Framework Decision 2008/977/JHA is repealed effective 6 May 2018; references to the repealed decision are treated as references to this Directive.

Article 60 Union legal acts already in force

Existing Union legal instruments adopted on or before 6 May 2016 that govern personal data protection in police and judicial cooperation, including those establishing procedures for data transfer between Member States and access to information systems, are not changed by this Directive.

Article 61 Relationship with previously concluded international agreements in the field of judicial cooperation in criminal matters and police cooperation

International agreements on personal data transfers to third countries or organisations concluded by Member States before 6 May 2016 and compliant with prior Union law stay in force until they are amended, replaced or revoked.

Article 62 Commission reports

Article 63 Transposition

Member States must adopt and apply necessary national laws and regulations by 6 May 2018; they may defer compliance with Article 25(1) for automated systems set up before 6 May 2016 until 6 May 2023, or in exceptional circumstances where serious operational difficulties exist until no later than 6 May 2026. Member States must notify the Commission of the main national law provisions they adopt and provide a reference to this Directive.

Article 64 Entry into force

Article 65 Addressees

The Directive is directed to the Member States.