Abstract
Directive 2016/680 (the Law Enforcement Directive (LED)) provides two procedures for the exercise of the rights of access to one’s data: a direct one under Article 14 LED (directly addressed to the law enforcement authority) and an ‘indirect’ one under Article 17 (3) LED, i.e., via the intermediary of the data protection authority (DPA). In the present paper we will argue that the latter procedure should be the exception and the Article 14 LED procedure should be seen as the default. We will analyse the weaknesses of the Article 17 (3) LED provision and then criticize its, in our opinion, flawed implementation into the national laws of Belgium, France and Germany. We will demonstrate that Article 17 (3) LED, as read in light of Article 15 LED on the restrictions to the right of access, might be interpreted incorrectly to allow for the ‘indirect’ access procedure to be evoked abusively. We will argue that it lacks the explicit language to guarantee the decision-making powers of DPAs when deciding what information to communicate to the concerned data subjects when answering their request. We will demonstrate how the examined Member State laws further restrict the powers of their DPAs, which endangers the effectiveness of the ‘indirect’ access procedure because they do not guarantee the accountability, transparency, and proper legality check by the DPAs which are called on to exercise the right of access indirectly.
Introduction
The need to discuss the right of access under the LED
The right of access to one’s personal data is understood to mean obtaining some form of access to the data which a certain controller has been processing in relation to the individual requesting access or at least getting a confirmation that data concerning the individual have been or are being processed. 1 Not least because it enables the discovery of mistakes in the data processing and their subsequent correction, does this right play a significant role, especially in a law enforcement context, as we will demonstrate in more detail later in the paper. The right of access to one’s data as processed by the law enforcement authorities has been guaranteed in the EU under the Law Enforcement Directive (LED). 2
The main provisions of the LED have already been succinctly discussed in this journal. 3 Further literature on the LED has elucidated a variety of different aspects under the LED. 4 One under-explored aspect in literature, but also in legal practice, is the procedure for exercising data subjects’ rights, including the right of access to one’s personal data in a law enforcement context. 5
The LED envisages two procedures to exercise the right of access: a default access procedure and an exceptional watered-down access procedure. The former is regulated by Article 14 LED, which provides that the data subject may request access to their personal data by default directly to the respective law enforcement authority (‘the controller’). 6
The exceptional procedure is sparingly regulated in Article 17 LED and boils down to a check of the data by the data protection supervisory authorities (DPAs) at the request of the data subject when the law enforcement authority refuses to give direct (full) access. As is explained later in the paper, Article 17 (3) LED is an exception that applies only in cases of restrictions on the right of access under Article 15 LED:
‘1. In the cases referred to in Article 13(3), Article 15(3) and Article 16(4) Member States shall adopt measures providing that the rights of the data subject may also be exercised through the competent supervisory authority.
[…]
3. Where the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at least that all necessary verifications or a review by the supervisory authority have taken place. The supervisory authority shall also inform the data subject of his or her right to seek a judicial remedy.’ 7 The exact role of the DPAs in this process, however, is barely regulated in the LED. Most scholars and the predecessor to the LED, Framework Decision 2008/977/JHA, 8 refer to this latter procedure as ‘indirect access’, although the LED itself does not contain this term, and this is not without reason. 9
The present paper critically examines the two procedures for the exercise of the right of access to one’s data (under Article 14 LED and Article 17 (3) LED), emphasizing the fact that the LED frames Article 17 (3) LED as the exception and thus leaves Member States a small margin of appreciation to allow law enforcement authorities to refer the data subjects to this procedure. We will demonstrate that this has not prevented certain Member States like Belgium from making the exceptional procedure the rule in their implementing law. We will further criticise the LED and the implementing laws in Belgium, France and Germany because they do not ensure that the DPAs, when exercising the right of access, can properly carry out the necessary legality checks and communicate the outcome of the checks to the concerned data subjects. As concerns the LED, we argue that it should have anchored more explicitly the DPAs’ task to effectively check the legality of the processing of the data and to be accountable in their legality review to the individuals who request access to their data. We will demonstrate that these two weaknesses are exacerbated in the implementing laws of Belgium, Germany and France, which have overstepped their margin of appreciation and unduly restricted Article 14 LED (Belgium) and the review and publicity (transparency towards the respective data subjects) powers of their DPAs (Belgium, France and Germany).
Our paper is structured as follows. First, we will briefly clarify the nature of police work, including how it could clash with the interests of individuals to have access to their data (
The multiple facets of law enforcement work vs the interest of individuals to have access to their data
The reality of police work is that the police and other law enforcement authorities do not process only data concerning serious criminals, such as serial killers and terrorists, 10 while these are under investigation. In those cases, but also in other situations, e.g., to protect the identity of victims (see the discussion on Article 15 LED in Section V below), evidently more secrecy is needed, meaning that the law enforcement authorities might legitimately restrict the exercise of the right of access. As indicated in Article 6 LED, however, the police work also with the data of victims and witnesses, as well as of suspects (who may turn out not to have committed any crime eventually), and of convicts in relation to whom the investigations are over. The different categories of individuals require different degrees of secrecy about the processing of personal data. In addition, the police could also perform duties outside the criminal law field, e.g., related to administrative offences or public order. According to the first Commission report on the ‘application and functioning’ of the LED, these have been included in the scope of the LED implementing laws in some Member States. 11 Without prejudice to the fact that this might constitute an incorrect transposition of the LED, in effect it means that in these Member States, the LED procedures on the exercise of the right of access to one’s data apply much more broadly.
These observations point to the fact that law enforcement work requires different degrees of secrecy and that each request by an individual to have access to their data as processed by a certain law enforcement authority needs to be assessed separately. 12
The need for individuals to have access to one’s data in the law enforcement field was born out of a necessity: there have been documented cases in which law enforcement authorities do make mistakes and engage in other illegal data processing practices when processing personal data. 13 Such occurrences could have grave consequences for the concerned individuals, as they might put restrictions on their everyday lives, e.g. not being subject to police checks or being placed under suspicion without a reason, to get a new job, and these restrictions could affect their fundamental rights. 14 One of the key roles of the right of access is that it enables individuals (and their lawyers) to discover such mistakes and take corrective actions when they are given access to their personal data which are contained in (police) files. 15 In addition, it has been argued that the right of access to one’s data is also important because it is related to and thus enhances fair trial and due process rights, and because it helps restore the informational imbalance between governmental authorities and their citizens. 16 This ‘role’ of the right of access is especially essential in the law enforcement field, due to its impact on one’s life, as mentioned above.
In light of this, it is a welcomed development that the right of access to one’s personal data has been an essential component of different EU data protection instruments in the law enforcement field. 17
The fact that despite the nature of law enforcement work the right of access has existed per se in relation to the law enforcement authorities even before the LED means that some form of transparency is in principle desirable and that granting some degree of transparency in this sensitive field is practically possible. For example, the right of access, albeit in a weaker form, was already anchored in the predecessor to the LED, namely Framework Decision 2008/977/JHA, and was supposed to be implemented in national laws when the law enforcement authorities of the Member States exchanged data with the competent authorities of other Member States. 18 It should not be forgotten that Article 8 of the Charter of Fundamental Rights of the EU (CFREU) includes the general right of access to one’s data: ‘Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.’ 19 The right applies generally both to the non-law enforcement and to the law enforcement context.
Summarizing the above, it becomes clear that a certain balance between the transparency interests of the concerned individuals and the control over the legality of the processing, on the one hand, and the fulfilment of law enforcement tasks, on the other hand, are needed. 20 In the following sections, we will critically assess how the provisions on the right of access in the LED, especially the interaction between Articles 14, 15 and 17 (3) LED and their substantive provisions, strike this balance.
The right of access to one’s data under the LED: The shadows of the past
Before the entry into force of the LED, the procedural aspects related to the exercise of the right of access to personal data in the law enforcement field were largely a matter of national law. This was clearly the case with purely national databases in the field of national security and law enforcement. For example, the French legislator opted for ‘indirect’ access to the French police, judicial and national security databases, i.e. through the intermediary of the French Data Protection Authority (the CNIL). 21 In addition, the EU instruments in the field of police cooperation, as adopted before the adoption of the LED, explicitly allowed Member States to decide whether the exercise of the rights of data subjects should be exercised directly against the law enforcement authorities or via the supervisory authorities. 22 For instance, France, Belgium, Luxembourg and Portugal opted for the latter, e.g. in relation to the EU-wide Schengen Information System (SIS). 23 The choice between the two procedures was left to the Member States also under Framework Decision 2008/977/JHA, the predecessor to the LED, which regulated the data protection provisions applicable to the Member States when their law enforcement authorities exchanged personal data across EU borders. 24
The exact procedures and powers of the DPAs under the national laws of the Member States in relation to the so-called ‘indirect access’ procedure differed, especially as to whether they were given the powers to disclose information to the data subjects or to only inform them that the necessary checks have been carried out. 25 In France, the CNIL did not even seem to have access to the different police systems. It could disclose the concerned personal data only with the approval of the controller. 26 This was also the case where the access request concerned alerts in the SIS, which were entered by another Member State, in which case the approval of the DPA in the respective Member State was sought. Where the controller decided that no personal data should be disclosed to the concerned data subject, then the CNIL could provide only an assurance that the necessary verifications had been carried out. The CNIL seemed to be at liberty to confirm to the data subject that no personal data were being processed where this was the case. 27 Somehow differently from France, in Luxembourg the responsible DPA was allowed only to confirm to the requesting data subject that no illegal processing had taken place, especially in the framework of the Schengen Information System (SIS). 28
The entry into force of the Charter of Fundamental Rights of the European Union (CFREU) in 2009 did not trigger a direct change to the pre-existing procedures in the Member States: Article 8 CFREU on the fundamental right to data protection, which explicitly includes the right to access as a component of the fundamental right, does not contain any procedural requirements concerning its exercise. 29 The Charter contains general requirements on the restrictions to the fundamental rights, though. 30
Throughout the rest of the paper, we will discuss the changes brought by the LED to the procedure for the exercise of the right of access to one’s data and argue that it leaves Member States a much smaller margin of appreciation than the pre-existing or abolished instruments in the law enforcement field. We will critically assess these changes to demonstrate that the LED and the implementing Member State laws nevertheless do not always result in a proper review of the legality of the data processing and proper access to one’s data or information on the findings of the DPAs on the legality of the processing. In other words, we will argue that the LED has not brought into practice a big change in some Member States and that this is contrary to the provisions of the LED, both in the body of the text and in the applicable recitals. 31
Article 14 LED: ‘Direct’ access is the rule
Essentially, if the LED is transposed correctly in Member State law and applied correctly by the controller(s), the data subject should experience the procedure under Article 14 LED as follows. They first have to be given the right to approach directly the controller, e.g. a police authority, with their access request. The said authority should examine the request and decide whether to grant full access. Full access means disclosing the following personal data
32
and further information, as provided for in Article 14 LED: ‘Subject to Article 15, Member States shall provide for the right of the data subject to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of and legal basis for the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject; (f) the right to lodge a complaint with the supervisory authority and the contact details of the supervisory authority; (g) communication of the personal data undergoing processing and of any available information as to their origin.’
33
The above list represents the minimum set of information which should be ideally provided to the requesting data subject 34 and this means that under the national laws implementing the LED, further details might need to be disclosed. The different pieces of information in Article 14 LED can be summarized as follows: Where the controller confirms that the data concerning the requesting data subject are processed, they should ideally disclose the actual personal data which are being processed; inform the data subject of the processing details quoted above and the rights and remedies listed in Article 14 LED. 35 The above information should be provided in response to a request under the national law implementing the LED, independently of whether transparency provisions in other applicable (criminal) law provisions exist. 36
Normally, the controller should provide access to the data subject ‘without undue delay’, 37 i.e. the controller is expected to examine and respond to the request as soon as possible. The implementing laws of certain Member States regulate the deadlines for the response more concretely. For instance, in Bulgaria the deadline is two months (with a possible extension of one month); 38 under Portuguese law it is 30 days (with a possible extension of another 30 days), 39 and in the Netherlands it is six weeks, which can be extended by another four. 40
The reference to Article 15 LED in Article 14 LED above means that the controller may decide to make use of their right to restrict ‘wholly or partially’ the provision of information to the data subject, where such restrictions are provided for in the national law transposing the LED. 41 In other words, they could decide to provide only a confirmation of the processing, or a confirmation and only some of the information listed in Article 14 (a) to (g) LED, or not to provide any information at all (a ‘neither confirm, nor deny’ reply). 42
Furthermore, in these cases the LED obliges the data controller to respond to the data subject within the prescribed time period 43 and ideally to inform them of the reasons for the restriction. This information can also be restricted if it could prejudice the fulfilment of the purpose for which the restriction was imposed, e.g. impede an ongoing investigation. 44 In addition, when any restriction is imposed pursuant to Article 15 LED, the controller should inform the data subject in their response that they may ask the DPA in the said Member State to check the processing of their personal data, i.e. to trigger the Article 17 (3) LED procedure for the exercise of the right of access via the DPA (discussed in detail in Section VI below).
The Article 17(3) LED procedure should be distinguished from the complaints procedure before the DPAs. Although the requests under both procedures are supposed to be addressed to the same authority, i.e. a DPA, they are essentially two different procedures. 45 A data subject may submit a complaint with a DPA ‘if the data subject considers that the processing of personal data relating to him or her infringes provisions adopted pursuant to this Directive.’ 46 Whereas the DPA should investigate the complaint 47 and inform the complainant of ‘the progress and the outcome of the complaint’, 48 the complaint might also be rejected or dismissed. 49 In the scheme of the LED, an Article 17(3) LED request does not automatically count as a complaint. This means that the data subject does not need to present a claim of an infringement of the LED, it is enough that they have not obtained (full) access to their data by the controller and they wish to exercise their right through the DPA and the LED does not offer possibilities for the dismissal of Article 17 (3) requests for indirect access.
To summarize the relationship between Articles 14, 15 and 17 (3) LED as discussed above, there are three stages when it comes to the exercise of data subject rights in the LED: (1) direct access against the controller; (2) restriction imposed by the controller (where applicable) and only then (3) access under Article 17(3) LED via the supervisory authority.50,51 The procedure is visualised in Figure 1 below. The procedures for exercising the right of access under the LED.
51
The following two Sections will discuss in more detail the conditions of the restrictions under Article 15 LED and the Article 17(3) LED procedure. We will argue that Article 15 LED frames the restrictions on Article 14 LED, i.e. on ‘direct’ or ‘proper’ access, as the exception, i.e. Article 17 (3) is a fortiori also the exception. We will also critically analyse the effectiveness of the Article 17 (3) LED procedure as a tool for legality control, access to one’s data, and accountability by the DPA about the legality check they have performed.
Restrictions on the right of access under article 15 LED: Between the exception and the rule
The Article 15 LED provisions on the restrictions to the right of access are important because they trigger the Article 17 (3) LED procedure that is supposed to be applicable only after a partial or a whole restriction on the right of access is imposed by the controller.
We will demonstrate that although the wording of Article 15 LED might be confusing in the sense of creating the illusion that restrictions may be imposed in a more general manner, a careful reading of the LED contradicts such an understanding.
Having restrictions on different individual rights in the law enforcement sector is in principle understandable. As seen above, it is a rather sensitive sector and disclosing information in specific cases, especially as concerns ongoing investigations, might defeat their purpose and success. 52 For this reason, the right of access to one’s data is not absolute. To ensure that the restrictions to the data protection right of access to data concerning oneself are not arbitrary, however, the LED lists exhaustively the conditions under which Member States may provide that controllers may wholly or partially restrict the right of access.
According to Article 15 (1) LED, the restrictive measures should firstly have a basis in national law and in addition fulfil all of the following four conditions: (1) be a necessary and proportionate measure in a democratic society; (2) respect ‘the fundamental rights and legitimate interests of the natural person concerned’; (3) ensure that the restrictions are limited in time and scope (‘to the extent that, and for as long as’) 53 and (4) fulfil one of the five grounds for restrictions. 54
The third condition especially speaks for the exceptional character of the restrictions and a fortiori – of the applicability of Article 17 (3) LED. This is supported by Recital 44 LED, according to which the restrictions may result only from ‘a concrete and individual examination of each case’ by the controller. 55 In addition, the restrictions on the right of access to one’s own data in Article 15 LED could be seen as an interference with one element of the fundamental right to data protection 56 and should therefore also satisfy the conditions on restrictions to the fundamental rights in Article 52 (1) CFREU, amongst which the requirement on necessity and proportionality of each restrictive measure. 57 The requirement for complying with human and fundamental rights when restricting the rights of data subjects is moreover explicitly mentioned in Recital 46 LED, according to which ‘Any restriction of the rights of the data subject must comply with the Charter and with the ECHR, as interpreted in the case-law of the Court of Justice and by the European Court of Human Rights respectively, and in particular respect the essence of those rights and freedoms.’ 58
At the same time, Article 15 (2) LED also allows Member States to legislate that pre-determined ‘categories of processing’ could fall under the partial or whole restrictions as discussed above. 59 This provision could be seen as being contrary to the requirements on individual restrictions as anchored in the LED and as confusing. Some might interpret it as opening the door for Member States to decide that access to certain databases or information systems should be permanently restricted, which means that it can be exercised by default only via the Article 17(3) LED procedure.
The Article 29 Working Party has already clarified that Article 15(2) LED ‘do[es] not allow for blanket restrictions to data subject rights to […] access’. 60 Their clarification resonates with the above-mentioned provisions in the LED, which taken holistically, require restrictions on the data subject rights to be imposed on a case-by-case basis. In addition, as the CJEU ruled, secondary law has to be interpreted in light of the CFREU, including national transpositions, 61 e.g. when implementing the restrictions on the right of access under the LED into Member State law. The CJEU has ruled against general and permanent restrictions on notifying individuals that they have been subject to surveillance because such restrictions are not compatible with the fundamental rights to privacy and data protection in the CFREU. 62 Notably, such a ‘notification’ right is not anchored in the CFREU, whereas the right of access to one’s data is an integral part of the fundamental right to data protection in Article 8(2) CFREU. Therefore, we argue that an interpretation of Article 15 LED, pursuant to which access may be restricted only on an individual basis, is likely to be more in line with the CJEU case law than an interpretation according to which access to one’s data may be generally and indiscriminately restricted.
The foregoing restrictive interpretation, unfortunately, has not prevented the imposition of blanked restrictions in the different Member States. A prime example is Belgium. Its 2018 data protection law provides that access to any personal data stored in police and customs databases, or data processed by Financial Intelligence Units, should always be exercised indirectly via the DPA. 63 It remains unclear which provisions of the LED the contested Belgian article implements. One might believe that this general restriction implements Article 15(2) LED and that the Belgian government might have been confused by its wording and interpreted it as a carte blanche for a general restriction. However, according to a 2020 Commission Report on the LED, the Belgian government did not make use of its margin of appreciation under Article 15(2) LED, but only under Article 15 (1) LED, 64 which allows only for individual restrictions. Hence, it is questionable that the Belgian government acted out of confusion.
To summarize the preceding discussion, restrictions to the right of access under the LED are subject to strict regulation under the LED, as anchored in Article 15 LED and the respective recitals. These provisions seek to ensure that ongoing law enforcement work is not prejudiced, without disproportionately restricting transparency. However, Article 15 (2) LED creates a certain confusion and it could be interpreted as a loophole, leaving the door open for permanent and general restrictions on the right to direct access. This is contrary to the established case law and interpretation of the CFREU, and contrary to the clarifications in Article 15 (1) LED and the applicable recitals that restrictions on the right of access should be imposed only following an individual examination of each restriction. Certain Member State’s implementing laws have de facto made Article 17(3) LED a default procedure and it is not clear whether this implementation is the result of the confusion created by Article 15 (2) LED. Whether that procedure could eventually ensure a proper review and transparency, largely depends on the obligations and powers of the DPAs when fulfilling their obligations under Article 17(3) LED.
Problems with the Article 17(3) LED procedure (proper legality review and publicity of the review)
While the Article 29 Working Party (now the European Data Protection Board or ‘EDPB’) previously argued that the Article 17(3) LED procedure is supposed to represent an ‘additional guarantee’ for data subjects, 65 in its contribution to the evaluation of the LED, the EDPB reported that one DPA ‘suggested evaluating whether the data subjects’ exercise of their rights through the supervisory authority, as provided by Article 17 LED, is effective in enhancing data protection in the area of law enforcement.’ 66 The following paragraphs do not strive to conduct a comprehensive assessment of this question, which is reserved for our future research.
In the present section, we will nevertheless demonstrate that the Article 17(3) LED procedure is problematic for two main reasons: (1) it might not always ensure a proper legality review by the DPAs and (2) it might not always guarantee that DPAs may communicate to the concerned data subjects the result of the legality review and potentially disclose to them the data as they are being processed where the restriction on access was imposed illegally by the controller. As a consequence, if Article 15 LED is not read restrictively, as we argue it should be, then the right of access to one’s data in the LED and the CFREU is likely to remain illusory and it would be misleading to call the Article 17(3) LED procedure ‘indirect access’.
Powers of the DPA to control data and problematic legality review
We recall that pursuant to Article 17 (3) LED, ‘the supervisory authority shall inform the data subject at least that all necessary verifications or a review by the supervisory authority have taken place.’ 67 In other words, under the LED, the supervisory authority is explicitly obliged to inform the data subject that the ‘necessary verifications’ have been carried out and that they have the right to a judicial remedy. This clearly implies some level of legality control over the data processing, which is in itself a welcomed safeguard against illegal processing.
However, the question arises whether DPAs are in a position to effectively carry out a legality review (problem 1 above). The latter can firstly be impeded by the fact that the law enforcement authorities do not always provide DPAs with access to the data they process and thus the DPAs cannot assess the legality of the processing (see the discussion on the German national law in the next section). This is despite the fact that according to the LED, DPAs should have unrestricted access to information and to the data processed by the LEAs in order to perform their investigatory tasks. 68 We understand this unrestricted access in the framework of the Article 17 (3) LED procedure to mean that DPAs should have access at least to the information which is listed in Article 14 (a)-(d) and (g) LED in order to be able to check the legality of the processing of the data. In other words, the restrictions in Article 15 LED should not apply to the DPA access to data and information. Second, the effective review may be impeded where the DPAs might not be able to ascertain the accuracy of the data without the collaboration of the concerned data subject. Third, the DPAs might be prejudiced in their legality review if they work closely with the police and are not obliged to be accountable to the concerned individuals about the depth of their review. This problem can be termed as ‘limited review’.
Powers to disclose to the data subject and poor communicating of the results
With regard to the second problem that we see (powers for the DPA to render account to the data subject), Article 17 (3) LED is a very minimalistic provision (‘the supervisory authority shall inform the data subject at least that all necessary verifications or a review by the supervisory authority have taken place’). It does not require that DPAs should provide or should have the freedom to independently decide to provide on a case-by-case basis any information about its findings on the legality of the processing (where they were given the opportunity to perform such a check) or to confirm whether personal data are indeed being processed in relation to the requesting data subject where they have concluded that the imposed partial or whole restriction is not justified and is hence illegal. The fact that such a check on the legality of the restriction on the right of access needs to be performed is confirmed by the Commission. 69 A fortiori, we understand this to mean that the DPA should always have the opportunity to decide whether to provide individuals access to their data. However, due to the minimalistic provisions of Article 17(3) LED, the DPA’s verdict remains a secret and lacks publicity, which in turn leads to reduced accountability of the DPA towards the concerned individuals, but also towards society at large, because the work of the DPAs under Article 17(3) LED and the way they have analysed the legality of the data processing remains a secret.
Whereas such secrecy could be deemed as justified in the cases of ongoing investigations when the communication of the DPA’s verdict would constitute at the same time a confirmation of the data processing and thus prejudice the investigation, it is more difficult to understand such secrecy in a situation where a victim seeks access to their data or an individual seeks access to the data concerning their administrative fine, e.g. for parking their car outside the designated parking areas.
The minimalistic provisions in Article 17(3) LED should be read with caution. Reading the further provisions of the LED reveals that the LED contains several requirements on the independence and powers of the DPAs when performing their tasks, which could be interpreted to strengthen DPAs’ powers to independently decide what information to disclose to the data subjects and to carry out their legality review tasks. 70 We argue that these provisions should be taken into account when interpreting the role of DPAs under Article 17 (3) LED. For example, pursuant to Article 46 (1) (g) LED, DPAs have the task to ‘check the lawfulness of processing pursuant to Article 17, and inform the data subject within a reasonable period of the outcome of the check pursuant to paragraph 3 of that Article or of the reasons why the check has not been carried out’. 71 We note that this provision is broadly phrased because in the context of Article 17 (3) LED the ‘outcome’ could mean that where a DPA informs a data subject of the outcome of the legality check, e.g. that an infringement has been established, the DPA might effectively confirm that personal data relating to the data subject have been processed and even disclose the personal data to the concerned data subject. Therefore, we argue that when Article 17 (3) LED is interpreted in light of Article 46(1)(g) LED on the tasks of DPAs, then DPAs should actually be given the freedom to decide what information to disclose to the individuals seeking access to their personal data. In other words, Article 17 (3) LED should not be interpreted as a restriction on the tasks and powers of the DPAs under Article 46 LED.
Whereas under the LED DPAs are not obliged to disclose any substantive information about the outcome of the legality review or the personal data to the concerned data subject, as the case might be, the wording of Article 46(1)(g) LED suggests that DPAs should have a certain margin of appreciation to decide what information to disclose and this margin of appreciation does not seem to be restricted by the LED provisions. However, we will demonstrate in the next section that certain Member States have effectively restricted this margin of appreciation. Therefore, we can say that there is a problem, and we can call it ‘limited transparency and publicity’.
As a result of the problems with the powers of the DPAs discussed above, we argue that Article 17(3) LED is not in a position to always result either in proper access or to guarantee that where proper or direct access is restricted, such a restriction is always legitimate, and an effective legality review has taken place. Therefore, the Article 17(3) LED procedure tends to tip the balance in favour of the interests of the police authorities at the expense of proper legality review and accountability to the concerned data subjects. However, we remind that a holistic reading of the LED, including the provisions on the powers of the DPAs in Articles 41-47 LED, should guide the interpretation of Article 17(3) LED in terms of the freedom of the DPAs to carry out proper legality checks and communicate the results of these checks to the concerned data subjects. In the next section, we will demonstrate that the two problems are exacerbated in the implementing laws of Belgium, France and Germany, which seem to take Article 17(3) LED as a self-standing provision which could justify restrictions on DPA’s powers and freedoms.
National implementing laws further restrict the powers of the DPAs
First, pursuant to the LED implementation provisions in Belgium, the Belgian DPA may communicate to the data subject only (‘uniquement’) that the necessary checks have been carried out, not even what their result were. 72 The law theoretically allows the DPA to provide additional contextual information, 73 but what this additional information may be, should be determined by a royal decree, 74 which we have not identified so far. In effect, the Belgian law restricts the provision of further information by the DPA. In this way, it also modifies the LED wording, according to which the confirmation that the necessary checks have been carried out is only the ‘at least’ or minimum information. Instead, under Belgian law, this information is the only information to be provided by the DPA, with no room for manoeuvre or decision-making power left to the DPA. In practice, in Belgium, individuals receive only a ‘neither confirm, nor deny’ reply. Furthermore, if the data originated from the national security authorities, then the responsible DPA (the ‘COC’) may not check the lawfulness of their processing. 75
The German and French implementing laws at first sight seem to provide more freedom to the DPAs to grant additional information to the data subject, but in effect this freedom is illusory. For example, the German Federal Data Protection Law grants the supervisory authority a small margin of appreciation to decide whether it may provide further information, namely whether the authority has established any infringements under data protection law. 76 In exercising this margin of appreciation, the DPA is, however, not completely free, because the DPA may not disclose to the concerned data subject the processed personal data unless the competent (law enforcement) authority approves the said disclosure. 77 The law clarifies that the competent authority may refuse the disclosure only for the duration and the purposes of the imposed restriction on access. 78 However, it does not clarify that this refusal may be overridden by the DPA where it considers that the restriction has been illegally imposed.
The German law contains a further restriction in cases where the personal data of the concerned data subject were transmitted to one of the national security authorities. In that case, the controller may inform the data subject of the said communication only if the said national security authority has approved the communication. 79 The German DPAs have voiced concerns that the law contains no criteria or rules on the basis of which the said national security authorities may disclose the data to the concerned data subject and that this could lead to arbitrary refusals and to the impossibility of the DPAs to examine the legality of the refusal. 80 This is especially problematic because national security falls outside the scope of the LED 81 and practically the DPAs may not supervise them unless national law provides otherwise. This could be a problem for the right to indirect access because we argue that the DPA should be able to check the legality of the refusal, so that it can overturn it, as the case might be, but in the above-described constellation it might lack the powers to do so. Furthermore, lacking objective criteria for the restriction, the DPA might be influenced by the desire of these authorities not to inform the data subject that they have received the data from the controller and hence simply rubber-stamp the restriction, instead of declaring it illegal and possibly disclosing the information to the concerned data subject.
A further restriction is that the DPA may be given access to the personal data of the requesting data subject only if the highest national security authority does not object to the disclosure. This authority can object if the national security of one of the Länder or the federation is threatened. 82 We note that the phrasing of the German law is quite broad and hides the potential to be misused to restrict the right of access to one’s data. If the competent authority refuses the disclosure to the DPA, then the DPA practically cannot even examine the legality of the processing of the concerned personal data, e.g. the legality of the data disclosure from the police authority to the national security authority. In other words, it may not fulfil its tasks under the LED. The German DPAs have rightfully criticized this provision, pointing out that DPAs normally have security clearance and there should be no restriction on their access to data. 83 Unfortunately, in practice, they have reported that they did not always have access to the data, the legality of whose processing they are supposed to control. 84
As to the French law, in principle, it mirrors the provisions in the LED on indirect access. 85 This means that it formally abolishes the previous rule that by default access to law enforcement databases should be indirect (see Section III). 86 We do not know whether this makes a real difference in practice because we do not know how often law enforcement authorities have tended to restrict the right to access and in this way open the possibility for indirect access. It is however indicative that in France the right to indirect access seems to be much more frequently exercised than in other Member States, 87 which suggests a high number of restrictions on direct access. In addition, the CNIL has reported that overall, the French legal system is confusing for the concerned data subjects, because the French legislator has not updated the legal acts on all the law enforcement files and it is not always clear that direct access is now the rule. Another confusion comes from the fact that some files could simultaneously fall under the LED (where direct access is the rule), and under national security provisions, where indirect access is still the rule, creating more administrative burden on the data subjects. 88
We further note that the transparency provisions and the powers of the CNIL have not changed significantly. In its response to an access request, the CNIL has to inform the concerned individual that the necessary verifications have been carried out, after which the case is considered closed. 89 In addition, the CNIL may decide to disclose the processed data, subject to the approval of the controller, if the disclosure is not likely to prejudice the interests of national or public security, defence and the legitimate purpose for which the right of access was restricted. 90
It seems the CNIL could order that further data may be disclosed where the CNIL has decided that the imposed restriction on access is illegal and the controller has not objected to this conclusion. 91 It looks like the CNIL may disclose the processed data to the concerned data subject where the controller does not process any personal data of the concerned individual or where it has been established that the data has been illegally processed, as long as the disclosure will not prejudice the interests of public and national security or the defence. 92
What is evident is that although the French law seems to grant more flexibility to the DPA than the Belgian law, this flexibility is in many situations restricted by the necessity for disclosure approval by the concerned law enforcement authority, similar to the situation in Germany. So far, the French courts seem to have been relatively uncritical of the procedure on access via the CNIL. For example, recently, the Conseil d’Etat has ruled that the ‘indirect access’ procedure does not violate the right to private life and effective remedies of the concerned individuals. 93
Did member states misunderstand the article 17 (3) LED procedure?
Looking at the above Member State implementing laws, it appears that the LED wording seems to be misunderstood as giving Member States a large margin of appreciation in restricting the information and accountability obligations of the national DPAs. We argue that Article 17 (3) LED should not be interpreted as an invitation to prohibit DPAs from providing further information or as an invitation to make further communication dependent on the approval of the law enforcement authorities but to indicate the clear obligation that the DPAs should respond to a request for indirect access. This clear obligation was presumably inserted on the background of the experience under the predecessor of the GDPR (Directive 95/46/EC) that the DPAs did not always respond to the complaints of the data subjects or even examine them. A different reading risks contradicting the requirement on ‘complete’ DPA independence in the LED 94 and the established CJEU case law, a topic which we will examine in another paper.
The European Data Protection Board (EDPB) has reported that since the entry into force of the LED across the different Member States, in most of the reported cases of requests under Article 17 LED, the concerned data subjects were informed solely that a review has taken place. Only in some Member States did the DPAs provide the complete or certain of the personal data to the data subject or ordered the controller to disclose all or certain of the data. 95 While this low disclosure rate could be due to the fact that the DPA concluded that the imposed restriction by the controller was legal, it is not known whether this is indeed the case in the majority of cases.
Finally, the Article 29 Working Party (now the EDPB) has remained largely uncritical towards the minimalistic transparency requirements of indirect access in Article 17 (3) LED, simply repeating the article text that DPAs should communicate to the data subject ‘at least’ that the necessary checks have been carried out in its Opinion on Key Aspects of the LED. 96 This is a problem because of the transparency differences between the procedures under Articles 14 and 17 LED, which make direct access much more favourable to the concerned data subjects, as seen in the previous sections, and because of the restrictions on the powers of the DPAs.
The exception to direct access has become the rule (conclusions)
This paper highlights how the right of access to one’s personal data is supposed to be exercised under the LED. This directive foresees two procedures: a direct one spelt out in Article 14 LED, where a data subject can approach the law enforcement authority directly with an access request, and the alternative procedure, organised in a very cryptic manner in Article 17 (3) LED. In particular, we discussed the complexities of this second procedure for access via the supervisory authorities as anchored in Article 17 (3) LED. Briefly put, Article 17(3) LED should ideally apply only when the law enforcement controller has exceptionally restricted the (full) access to one’s personal data in an individual situation 97 and the concerned data subject has turned to the DPA with the request to the DPA to exercise their right of access through the DPA. In other words, we argue that a holistic reading of the provisions on the right of access in Articles 14 and 15 LED reveals that the Article 14 LED procedure takes priority over the Article 17 LED procedure.
The latter procedure is, unfortunately, difficult to decrypt. For many data subjects, referring to the Article 17 (3) LED procedure as ‘indirect access’ creates the expectation that the procedure actually results in partial or whole disclosure of the data processed by the controller (a law enforcement authority) and thus caters for some level of transparency through the involvement of the DPA, where transparency will not prejudice the ongoing law enforcement work. It also creates the expectation that the DPAs will always be enabled by the law enforcement authorities to have access to all data in order to check the legality of its processing and that DPAs will be at liberty to communicate to the concerned data subject their findings on the legality of the processing, where this will not prejudice law enforcement work. In that sense, there is the expectation of a proper review and accountability by the DPAs.
However, in our paper, we demonstrated that this is not always the case. This is due to three problems. First, Member States like Belgium have implemented the Article 17(3) LED procedure as a default procedure in relation to police databases and it is not clear whether this is a misreading of the option under the LED for Member States to determine that access to certain categories of processing may be restricted in Article 15 (2) LED. We argued that such general and indiscriminate restrictions are at odds with the rest of the provisions on restrictions to the right of access in the LED and primary EU law. Second, DPAs might be impeded from performing effective legality checks as per national law (what we call ‘limited review’). Third, the Article 17 (3) LED procedure does not provide that the DPAs must or should be able to disclose more information than a confirmation that the necessary checks have been carried out. However, if we interpret Article 17 (3) LED in light of the applicable provisions on the independence and powers of the DPAs in the LED, we can safely argue that DPAs should be at liberty to carry out a proper legality review of the data processing and decide what information to disclose to the data subjects.
The impact of the minimalistic interpretation of Article 17(3) LED is visible in national implementing laws. Certain national DPAs, e.g. those of France, Belgium and Germany, are not completely free to independently disclose information to the data subject where they conclude that the restriction was imposed illegally and the data disclosure will not prejudice an ongoing investigation. The respective national implementation laws anchor different levels of flexibility for the DPA decision-making power, with the Belgian DPA not being allowed to disclose any information and the French and German ones being allowed to disclose some information to the data subject, but very often only if the concerned data processing authority approves the disclosure (what we called ‘limited transparency and publicity’).
We find these restrictions on the right of access and the review, publicity and accountability powers of the DPAs problematic because we argue that they are based on a wrong reading of the LED, and because they do not seem to ensure a proper balance between the interests of the law enforcement authorities on the one hand, and the interests of the data subjects in having their personal data processed legally and in a transparent manner where possible, on the other hand.
The arguments in our paper are based on a holistic analysis of the applicable LED provisions. For space reasons, we did not yet perform a detailed and extensive analysis of the applicable provisions of the CFREU or those of the ECHR, and the respective case law. Instead, we have taken up the identified problems and critically analysed them from the point of view of human and fundamental rights in two upcoming papers on these respective topics. More precisely, in these papers, we focus on whether the LED and the discussed Member State laws ensure independent oversight over personal data processing by the law enforcement authorities, 98 which is an integral element of the fundamental right to data protection in Article 8 (3) CFREU 99 and the provision on data protection in Article 16 (2) TFEU. 100 In another paper, we analyse the Article 17(3) LED procedure on the background of the ECtHR case law on interferences with the human rights to private life, fair trial and effective remedies, especially when it comes to transparency towards the concerned individuals requesting access and independent oversight over the law enforcement authorities.
Last but not least, we expect more clarity on whether Member States may impose general and permanent restrictions on Article 14 LED, leading automatically to triggering the Article 17 (3) LED procedure, and what the powers of DPAs under the Article 17 (3) LED procedure should be, from an upcoming ruling of the CJEU. 101 Looking at the Opinion of AG Medina in this case, we note that she has recommended to the CJEU a reading of Article 17 (1) and (3) LED which confirms on many points our conclusion that the procedure under Article 17 (1) LED is supposed to be the exception (‘That directive guarantees the direct exercise of the rights by data subjects ‘as a matter of principle’’) 102 and that under Article 17 (3) LED DPAs should be allowed to communicate further information to the concerned data subject to the information that the necessary checks have been performed (‘…there can be circumstances in which the supervisory authority can or must go beyond such minimum information.’). 103 Finally, similar to our conclusion, AG Medina also opined that ‘Article 42 of the LPD [Belgian implementing law] establishes a regime of indirect exercise of rights which is incompatible with the manner in which the rights of data subjects are exercised as set out in Directive 2016/680.’ 104
Footnotes
Acknowledgements
The paper was inspired by Diana Dimitrova’s PhD dissertation at the Vrije Universiteit Brussel (Diana Dimitrova, ‘Data Subject Rights: The Rights to Access and Rectification in the Area of Freedom, Security and Justice’, VUB PhD Dissertation, 2021).
Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
