Investigation and the collection of personal data: how is this regulated and what can we expect?

04/05/2023 - Collecting data for the purpose of investigating criminal offences is an important task of the police. During a criminal investigation, the police may also collect personal data from victims, data subjects or suspects. The powers of the police regarding the collection of personal data are subject to two laws: the Dutch Police Data Act and the Code of Criminal Procedure. With the digitalisation of society and the development of new investigative methods, the police have more and more possibilities to collect personal data. The government argues that the repeated availability of new (digital) techniques has resulted in an unsystematic and incomplete regulation of investigative powers. The current Code of Criminal Procedure is outdated and, in respect of digital investigation, therefore in need of replacement.  

In this blog, we discuss the current legal framework for the collection of personal data for investigation purposes and the plans for modernising the Code of Criminal Procedure.  

Background - The current legal framework 

The Police Data Act regulates the processing of police data by the police. Police data are personal data processed in the context of a police task as referred to in Articles 3 and 4 of the Police Act 2012. One of these tasks relates to the effective enforcement of the rule of law, including the detection of criminal offences. The Police Data Act sets rules on how the police must handle personal data, regardless of how the data was obtained. Besides the Police Data Act, the Code of Criminal Procedure lays down specific rules on the processing of data obtained through certain investigative methods. Unlike the Police Data Act, the provisions in the Code of Criminal Procedure are always linked to specific investigative powers. An example is the recording of confidential communications. The Code of Criminal procedure imposes requirements on the retention, destruction and use of data obtained using these investigative powers. It follows from the above that, with regard to personal data obtained in a criminal investigation, the police must take into account both the rules of the Police Data Act and the Code of Criminal Procedure.  

Modernisation of the Code of Criminal Procedure 

As mentioned earlier, the Code of Criminal Procedure has become outdated. According to the government, new investigative powers in the current digital age are not only possible, but also necessary to deal with (cyber) crime. In March 2023, the cabinet submitted the bill for the new Code of Criminal Procedure to the House of Representatives. The proposal contains a number of new powers, including conducting investigations into digital data carriers and automated works, such as smartphones and computers. This will allow the police to take cognisance of messages received on seized equipment. In addition, existing powers have been adapted and the provisions have been further formulated to be as technology-independent as possible to ensure their durability in the light of new technological developments.  

Renewing the code is an extensive and complicated process and the new code is not expected to come into force until 2026. The new code will affect many organisations in and around the criminal justice chain. Should the proposed legislative changes be implemented, it will bring about a lot of change for both police officers and lawyers.