Data protection frameworks in law enforcement research: A new analysis

Law enforcement agencies adopting research practices face an intricate legal question: which data protection framework should govern their use of personal data - the General Data Protection Regulation (GDPR) or the Law Enforcement Directive (LED)?

This question carries substantial implications for privacy rights, scientific innovation, and public trust. A new study in the European Journal of Law and Technology by Trilateral Research's team explores this challenge, offering fresh insights on balancing data protection with research needs, taking into account the distinct context of law enforcement and practical challenges, such as identifying the legal basis for processing, and setting the data controllership arrangements.

Defining the Research-Operations Boundary

Law enforcement agencies (LEAs) continue expanding their research activities, using personal data to develop and refine tools ranging from AI analytics to predictive policing systems. This creates a distinctive legal challenge - the boundary between research activities and operational work often blurs, making appropriate framework selection difficult.

Our analysis identified several areas where this ambiguity manifests:

• Early-stage research tools might not meet LED criteria for crime prevention technologies
• Data collected under LED might serve research purposes beyond original operational goals
• Research outcomes could feed back into operational practices, creating circular dependencies

Through our work on EU security research projects, including ROXANNE, INSPECTr, and PREVISION, we've seen these challenges play out across various law enforcement contexts.

Research Findings: Three Core Insights

Drawing on extensive project experience and legal analysis, our study revealed three fundamental principles for LEAs conducting research:

1. GDPR Should Be the Default Framework for Research

Its emphasis on transparency strengthens research validity, while clear consent mechanisms protect participant rights. While LED maintains relevance for specific crime prevention activities, GDPR's research provisions create stronger protections that align naturally with research ethics and methodological requirements.

2. LEAs must take precise approaches to data control and responsibility.

Single-point controllership proves more effective than joint arrangements, supported by detailed processing agreements and clear operational boundaries. This clarity in control helps organisations maintain consistent standards across research projects while simplifying compliance documentation.

3. Standardised guidelines are required to prevent noncompliance.

Different jurisdictions currently interpret research requirements differently under data protection laws, creating unnecessary barriers to collaboration. A unified approach would streamline cross-border research while maintaining high protection standards. The European Data Protection Board could play a key role in developing these shared interpretations.

Implementing Data Protection in Research Practice

Translating these findings into practice requires a systematic approach. LEAs should follow these three key steps to ensure responsible and compliant research:

1. Assess Current Research Activities

LEAs should start by conducting thorough assessments of their current research activities. This means examining what research is already underway, what types of data these projects use, and how this data flows between different teams and partners. Many organisations discover research activities they hadn't formally classified as such, making this initial stocktaking invaluable.

2. Select and Apply the Appropriate Framework

Next comes the careful work of selecting and applying the appropriate framework. LEAs need to evaluate each research project against LED criteria while considering GDPR research provisions. This isn't a one-time decision - research goals often evolve, requiring regular reassessment of the legal basis for data processing. Documentation proves particularly important here, creating a clear trail of decision-making that demonstrates compliance.

3. Build in Protection Measures from the Start

Protection measures form the backbone of responsible research practices. Organisations should build comprehensive safeguards into their research processes from the start. This includes running impact assessments, limiting data collection to what's strictly necessary, and ensuring research staff receive thorough training. Regular reviews help catch any gaps in these protections before they become problems.

Successful implementation also depends on engaging all affected groups to build trust and spot potential issues early. By carefully selecting and implementing the appropriate legal framework, LEAs can pursue innovative research while maintaining robust data protection standards.

Integration with Existing Systems

Research practices must integrate smoothly with existing law enforcement operations. Our experience across multiple EU projects demonstrates successful approaches:

• Building research governance into existing data protection frameworks
• Creating clear protocols for data sharing between research and operations
• Establishing dedicated research oversight committees
• Setting up regular assessment cycles
• Maintaining comprehensive documentation

Moving Research Forward

Law enforcement research plays an essential role in advancing public safety technologies and methods. Through proper framework selection and implementation, LEAs can pursue innovative research while maintaining strong data protection standards.

Our study draws on Trilateral's extensive experience in both data protection and law enforcement research, offering practical guidance for organizations navigating these requirements. The research demonstrates how careful consideration of legal frameworks enables both innovation and privacy protection.

Read our complete analysis in the European Journal of Law and Technology or contact our team to discuss implementing these recommendations in your organisation.

About the Publication’s authors: This research represents collaborative work between Trilateral's expert team - Joshua Hughes, Leanne Cochrane, Krzysztof Garstka and Agata Gurzawska - and academic partners Stergios Aidinlis and David Barnard-Wills, drawing on extensive experience across multiple EU security research projects.