Resolving legal conflicts between data access investigative measures and data protection law in the EU: The case for quantitative data and balancing

This thesis focuses on legislative frameworks for data access investigative measures in the EU,
and their legal conflicts with data protection law. Data access investigative measures refers to
routine law enforcement access to personal data of individuals held by private sector, under
specific conditions and for specified law enforcement purposes. The thesis identifies four data
access investigative measures developed by EU law: access to passenger name records
(passenger information units), access to financial data (financial intelligence units), access to
electronic communications (data retention) and access to e-evidence (production orders). The
security objectives pursued by data access investigative measures conflict with the fundamental
right to personal data protection guaranteed by Article 8 of the Charter of Fundamental Rights
of the EU and protected in the EU secondary law with a specific instrument regulating data
protection in the law enforcement area - the Directive (EU) 2016/680 (the Law Enforcement
Directive, LED). While there is a lot of case law of the Court of Justice of the EU dedicated to
data access investigative measures, the Court is struggling with finding a correct and workable
solution for the conflict. The legislators and other relevant stakeholders are not doing a better
job either.
Against this background, the objective of the thesis is to find the best available method to strike
the right balance and solve the apparent legal conflict, while positioning the outdated cliché on
‘privacy v. security’ in a proper empirical and theoretical framework. To that end, the thesis
starts by defining the term ‘data access investigative measure’ (Chapter 1). It then identifies
the foundational construction errors for each of the four data access investigative measures,
which amplify the conflict (Chapter 2). The thesis then turns to the other party in the conflict
– the data protection law. It demonstrates the emergence of data protection law specifically
developed for the law enforcement sector. This pioneering work was done by the Council of
Europe (Chapter 3). However, the Council of Europe lost its primacy over time, and the golden
standard in data protection for law enforcement in the EU and beyond is nowadays the LED
(Chapter 4).
The thesis then looks for tangible elements which could improve the legal conflict-solving. As
the first element, the thesis identifies objective evidence about data access investigative
measures. Thus, it carries out empirical research in Belgium, the Netherlands and Luxembourg,
with a view to collect, to the extent available, quantitative data about the use and effectiveness
of data access investigative measures, as well as experiences of law enforcement practitioners
(Chapter 5). As a second element, the thesis searches for a theoretical framework which would
5
put the quantitative data to good use. The thesis therefore proposes to rely on proportionality
stricto sensu, i.e. balancing test, and to factor quantitative data in the Alexy’s Weight Formula,
as the adequate balancing method (Chapter 6). The thesis then shows how incremental
improvements and more rational choices can be achieved at the level of the Court of Justice of
the EU, if balancing through the Weight Formula and empirical reasoning would replace the
heavy reliance of the Court on the strict necessity test in the existing case-law on data access
investigative measures (Chapter 7). What is more, the thesis also shows how the correct
interpretation of the purpose limitation principle in the LED, and the use of the Weight Formula
and quantitative data for allowing (or prohibiting) repurposing of accessed personal data can
further improve conflict-solving in the area of secondary EU law (Chapter 8).