COMMISSION STAFF WORKING DOCUMENT ANNEX
Date: 2012-01-25
Institutions: European Commission
Subjects: EU police cooperation, data protection, disclosure of information, judicial cooperation in criminal matters in the EU, national implementing measure, personal data, protection of privacy

EUROPEAN COMMISSION 

Brussels, 25.1.2012 
SEC(2012) 75 final 

COMMISSION STAFF WORKING DOCUMENT 

ANNEX 

Accompanying the document 

Report from the Commission to the European Parliament, the Council, the European 
and Economic and Social Committee and the Committee of the Regions based on Article 
29 (2) of the Council Framework Decision of 27 November 2008 on the protection of 
personal data processed in the framework of police and judicial cooperation in criminal 
matters 

{COM(2012) 12 final} 

 
 
 
 
  
 
 
ANNEX 

The  information  in  the  following  tables  was  submitted  to  the  Commission  by  the  Member 
States in response to the questionnaire of 9.12.2010 (including transposition tables). 
By letter of 9 December 2010 the Commission reminded Member States of their obligation to 
implement and asked them for feedback on the following issues: scope of national provisions 
implementing the Framework Decision (and in particular if these provisions also apply to the 
processing of personal data at national level), a data subject's right to information and access 
(Art. 16, 17), the supervisory authority (Art. 25) and issues at national level which affect the 
proper implementation of the Framework Decision. 
By 1 January 2011, only 3 Member States (Latvia, Denmark and Greece) as well as Norway 
and Switzerland had provided the Commission with information. 
At  the  occasion  of  the  stakeholder  workshop  meeting  on  the  implementation  of  the 
Framework  Decision  which  took  place  on  2  February  2011,  the  Commission  set  15 
February  2011  as  the  cut-off  date  for  receipt  of  further  notifications  from  the  Member 
States.  By  the  cut-off  date  the  Commission  had  received  information  from  9  additional 
Member  States  (Slovenia,  Bulgaria,  United  Kingdom,  Portugal,  Slovakia,  Poland,  Austria, 
Ireland, France and Lithuania). In total 50% of all the Member States had complied with their 
obligation under the Framework Decision. 
In  the  end,  the  Commission  decided  to  take  into  account  also  information  supplied  after  15 
February 2011. 

Table 1 
Table 1 –Overview of Member States' replies according to their own assessment in terms 
of the status of implementation of the Framework Decision  
Status of implementation as reported by Member States 

Belgium 

Bulgaria 

Czech 
Republic 

Denmark 

Germany 

Implemented 
Referring to Data Protection Law of 8.12.1992, Code 
d’instruction criminelle, L’Arrêté royal du 13 février 2001. 
Partially implemented 
Referring in particular to the Personal Data Protection Act 
(ZZLD) and the amending draft act ZIDZZLD 
Implemented 
Referring to Act 101/2000 Coll. on data protection as 
amended; Act on Police 273/2008 Coll., Act on Customs 
Administration 185/2004 Coll., Act on Military Police 
124/1992 Coll. and Act on Criminal procedure 141/1961 
Coll. 
Implemented 
Referring in particular to Act No. 188 and Act on the 
Processing of Personal Data, Order No. 1287 on the 
protection of personal data processed in the framework of 
police and judicial cooperation in criminal matters. 
Implemented 
Referring to the Federal Data Protection Law, data protection 
laws of the Länder and other specific instruments in the area 
of police and judicial matters in conjunction with an 
administrative regulation 
Implemented 

Texts of 
implementing 
measures 1 

Information 
on Data 
Protection 
Supervisory 
Authorities 
yes 

yes 

yes 

yes 

yes  

no 

yes 

yes 

Yes 

yes 

no 

yes 

Estonia 

1 

EN 

Some Member States submitted all implementing measures, some submitted a draft implementing measure, others 
submitted neither. 

1 

   EN 

 
 
 
                                                 
Ireland 

Greece 

Spain 

France 

Italy 

Cyprus 

Latvia 

Lithuania 

Luxembourg 

Hungary 

Referring to the Personal Data Protection Act and to the 
Code of Criminal Procedure. 
Implemented 
Referring in particular to the Data Protection Acts 1988 and 
2003 and to the code of Practice on Data Protection ("An 
Garda Síochána"). 
Not implemented 
EL informed that the implementation process has "not yet 
been completed" . 
Partially implemented 
Referring to Organic Law 15/1999 on the protection of 
personal data, the Code of Criminal Procedure and 
amendments. A additional draft bill is prepared to amend the 
legislation on the protection of personal data. 
Partially implemented 
Referring in particular to Loi 2003-239 du 18 mars 2003 pour 
la sécurité intérieure, to different Dècrets and to Loi n°78-17 
"l'informatique, aux fichiers et aux libertés". 
Not implemented2 
Referring to Personal Data Protection Code, Criminal 
Procedure Code and to the Legislative Decree of 30/06/2003 
(Code on personal data). 
Not implemented 
CY informed that a mixed committee has been set up to 
come up with a conclusion on the most efficient method for 
implementation. 
Implemented 
Referring in particular to the Law on the protection of natural 
persons' data; to Regulations no 40 and no 765. The latter 
relates to general security requirements for State information 
systems. 
Implemented 
Referring in particular to the Law on the Legal Protection of 
Personal Data processed in the Framework of Police and 
Judicial Cooperation in Criminal Matters of 2011. 
Implemented 
Referring in particular to the Data Protection Law of 2002, 
Criminal Code, Law of 2010 on the Council Act of 2000 
establishing mutual legal assistance between Member States 
of the EU in criminal matters, Law of 2008 on access of 
magistrates and criminal police officers. 
Implemented (by 1.1.2012) 
Act on the Right of Informational Self-determination and 
Freedom of Information (Act CXII of 2011) = the new 
Hungarian Data Protection legislation - enters into force on 
1.1.2012; Act on the National Tax and Customs office (Acts 
CXXII of 2010) – in force since 19.11.2010; 
Amendments to Act on Police (Act XXXIV of 1994); Act on 
the Hungarian Prison Service Organisation (Act CVII of 
1995); Act on the international cooperation of law 
enforcement bodies (Act LIV of 2002); Act on the 
Prosecution Service Relations and the Data Processing of the 
Prosecution (Act LXXX of 1994); Act on the activities of 
Forensic experts (Act XLVII of 2005). 
Partially implemented 
Referring in particular to the Processing of Personal Data 
(Police and Judicial Cooperation in Criminal Matters) 

yes 

yes 

no 

no 

no 

yes 

yes 

yes 

no 

no 

no 

no 

yes 

Yes  

yes  

yes 

yes 

yes3 

no 

no 

yes  

yes 

Malta 

2 
3 

EN 

See, however, the additional explanations provided on p. 8 of this Report on Italy. 
Luxembourg did not provide specific information – further details in the Annex.  

2 

   EN 

 
                                                 
Netherlands 

Austria 

Poland 

Portugal 

Romania 
Slovenia 

Slovakia 

Finland 

Sweden 

United 
Kingdom 

Switzerland 

Norway 

Iceland  
Lichtenstein 

no 

yes 

Regulations, 2011.  
Partially implemented 
Referring in particular to DPFD Implementation Bill 
amending the Police Data Act and the Judicial and Criminal 
Procedure Data Act 
Implemented 
Referring to the DatenschutzG 2000, the 
Sicherheitspolizeigesetz and the Strafprozessordnung. 
Partially implemented 
Referring in particular to the "Personal Data Protection Act" 
of 29 August 1997. 
Partially implemented 
Referring to Law No 67/98 of 26 October 1998 ("Personal 
Data Protection Law").  
No reaction to either the Commission request of 9.12.2011 or to the reminder 
Partially implemented 
Referring to State Prosecutors' Act 2011, Act on Police Tasks 
and Authorisations and to amendments of the Personal Data 
Protection Act. 
Implemented 

yes 

no 

no 

no 

no 

yes 

yes 

yes 

yes 

yes 

Referring in particular to Act 192/2011, Act No 124/1992 on 
the Military Police, Slovak National Council Act No 
171/1993 on the Police Force, Act No 4/2001 on the Prison 
and Court Guard Service, Act No 153/2001 on the public 
prosecutor, Act No 652/2004 on State administrative 
authorities in the field of customs and Act No 428/2002 on 
the protection of personal data. 
Partially implemented 
Referring in particular to the DRAFT Government Bill for an 
Act amending the Act on the Processing of Personal Data by 
the Police, Personal Data Act (523/1999), Act on the 
Processing of Personal Data by the Police (761/2003 and 
Government Bill HE 98/2010 and Criminal Investigations 
Act (449/1987). 
Implemented 
Referring in particular to the Personal Data Act (1998,204). 
Implemented 
Referring to the Data Protection Act 1998. 

EEA countries and Switzerland 

Implemented 
Referring to Loi fédérale sur la protection des données 
personnelles du 19.6.1992 (LPD); Ordonnance relative à la 
loi fédérale sur la protection des données du 14.6.1993; Code 
pénal suisse du 21.12.1937; Loi du 20.3.1981 sur l'entraide 
pénale internationale; Ordonnance du 24.2.1982 sur l'entraide 
pénale internationale (EIMP); Code de procédure pénale 
5.10.2007; Loi du 12.6.2009 sur l'échange s'informations 
entre les autorités de poursuite pénale de la Confédération et 
celles des autres Etats Schengen (LEIS). 
Implemented 
Referring to Act relating to the processing of personal data 
by the police and the prosecuting authority (the Police 
Register Act). 
No reaction to Commission request  
Implemented 
Referring to Draft amendments to Strafprozessordnung, 
DatenschutzG, AmtshaftungsG, PolizeiG idF LGBl 2010 Nr 
394; DatenschutzG, DatenschutzVO; Staatspersonalgesetz; 

yes 

yes 

yes 

yes 

yes 

yes 

yes 

yes 

yes 

yes  

no 

yes 

EN 

3 

   EN 

 
 
Richterdienstgesetz; Rechtshilfegesetz. 

Table 2  
Table 2 –Scope of measures implementing Framework Decision 2008/977/JHA 

Belgium 

Bulgaria 

Czech 
Republic 

Denmark 

Germany 

Estonia 

Ireland 

Implementing measures 
a) Loi du 8 décembre 1992 relative à la protection de la vie 
privée à l’égard des traitements de données à caractère 
personnel; 
b) Code d’instruction criminelle (code de procédure pénale 
belge; 
c) Arrêté Royal du 13 février 2001 
a) Personal Data Protection Act 

b) Draft law amending the Personal Data Protection Act 

a) Act 101/2000 Coll. on data protection as amended;  
b) Act on Police 273/2008 Coll., 
c) Act on Customs Administration 185/2004 Coll., 
d) the Act on Military Police 124/1992 Coll., 
e) Act on Criminal procedure 141/1961 Coll. 
a) Act No. 188 of 18.3.2009 amending the Act on the 
Processing of Personal Data; 
b) Order No. 1287 of 25.11.2010 on the protection of 
personal data processed in the framework of police and 
judicial cooperation in criminal matters within the European 
Union and the Schengen area; 
c) Lov 2000-05-31, n° 429 om behandling af 
personoplysininger (general data protection act), including 
amendment of 19.3.2009; 
d) Bekendtgorelse om sikkerhedsforanstaltninger til 
beskyttelse af personoplysninger, som behandles for den 
offentlige forvaltning, 15.6.2000 (BEK nr 528); 
e) Bekendtgorelse om sikkerhedsforanstaltninger til 
beskyttelse af personoplysninger, som behandles for 
domstolene (BEK nr 535 af 15.6.2000); 
f) Administrative guidelines on application of the 
transposition of the Framework Decision by competent 
authorities envisaged. 
a) Police Acts of the Federal State and the Länder; 
b) Federal Data Protection Act and Data Protection Acts of 
the Länder; 
c) Code of Criminal Procedure 
d) Administrative circular for Bundeskriminalamt.  
a) Personal Data Protection Act 
b) Code of Criminal Procedure 

a) Data Protection Act 1988 as amended by Data Protection 
Act 2003 
b) Code of Practice of An Garda Siochána 
c) future code of practice between the Data Protection 
Commissioner and Revenue (taxation and customs authority) 

Greece 
Spain 

not implemented 
a) Organic Law 15/1999 on the protection of personal data 

b) further specific provisions still need to be adopted 

Scope of application 
a)pplies to processing at 
national level and to cross-
border transmission; 
b) not specified; 
c) not specified. 

a) applies to processing at 
national level and to cross-
border transmission; 
b) applies only to cross-border 
transmission. 
different data protection rules 
for processing at national level 
and for crossborder 
transmission (not specified). 

a) and b) apply only to cross-
border transmission; 

c) – e) apply to data processing 
at national level and to cross-
border transmission; 

f) applies to cross-border 
transmission. 

a) – c) apply to data processing 
at national level and to cross-
border transmission; 
d) applies only to cross-border 
transmission. 
a) – b) apply to data processing 
at national level and to cross-
border transmission. 
a) – b) applies to data 
processing at national level and 
to cross-border transmission; 
c) not clear if it applies to 
processing at national level and 
cross-border transmission or 
not. 

a) applies to data processing at 
national level and to cross-
border transmission; 
b) no information provided 

EN 

4 

   EN 

 
 
 
 
 
 
 
 
 
 
France 

Italy 

Cyprus 
Latvia 

Lithuania 

a) Loi 2003-239 du 18 mars 2003 pour la sécurité intérieure; 
b) Décret n°2001-583 du 5 juillet 2001 modifié en 2006 
portant création du STIC (système de traitement des 
infractions constatées; 
c) Décret n° 2006-1411 du 20 novembre 2006 portant 
création du système judiciaire de documentation et 
d'exploitation dénommé « JUDEX; 
d) Décret n°87-249 du 8 avril 1987 relatif au fichier 
automatisé des empreintes digitales (FAED); 
e) Décret 2000-413 du 18 mai 2000 relatif au fichier national 
automatisé des empreintes génétiques (FNAEG); 
f) Loi n°78-17 du 6 janvier 1978 relative à l'informatique, 
aux fichiers et aux libertés. 
not implemented; 
in the absence of implementing measures, in line with the 
privacy code, the criminal procedure code applies 

not implemented 
Law on the protection of Natural Persons' Data (including 
Regulation n° 40-Cabinet Regulation of 30.1.2001 laying 
down mandatory technical and organisational requirements 
for the protection of personal data; Regulation n° 765-
Cabinet Regulation of 11.10.2005 on general security 
requirements for State information systems). 
a) Constitution of the Republic of Lithuania adopted by 
citizens in the referendum of 25 October 1992 (Žin., 1992, 
No 33-1014); 
b) Code of Civil Procedure of the Republic of Lithuania No 
IX-743 (Žin., 2002, No 36-1340); 
c) Law of the Republic of Lithuania on Administrative 
Proceedings No VIII-1927 (Žin., 2000, No 85-2566); 
d) Law of the Republic of Lithuania on Legal Protection of 
Personal Data No X-1444 (Žin., 2008, No 137-5383); 
e) Law No X-1685 Amending and Supplementing Articles 
33, 34, 36, 38, 39, 42, 43, 47, 51, 551, 57, 61, 63, 64, 691 and 
81, the Title of Chapter IX, Articles 83, 84, 85, 86, 90, 98, 
101 and 103, the Title of Section Two of Chapter XII, 
Articles 106, 107, 108, 119, 120, 122, 124, 127, 128 and 129 
of the Law on Courts of the Republic of Lithuania, Repealing 
Articles 89, 109, 110, 111, 112 and 125 of the Law and 
Supplementing the Law with Articles 531 and 532 and 
Section Three of Chapter IX (Žin., 2008, No 81-3186); 

a) – f) apply to data processing 
at national level and to cross-
border transmissions 

seemingly applies to data 
processing at national level and 
to cross-border transmissions 

applies to data processing at 
national level and to cross-
border transmission 

a) – e) apply to processing at 
national level and to cross-
border transmission; 

f) applies only to cross-border 
transmission. 

Luxembourg 

f) Law of 21.4.2011 implementing the FD. 
a) Loi modifiée du 2 août 2002 relative à la protection des 
personnes à l’égard du traitement des données à caractère 
personnel et modifications apportées par la loi du 28 juillet 
2011. 
b.) Loi modifiée du 30 mai 2005 
- relative aux dispositions spécifiques de protection de la 
personne à l’égard du traitement des données à caractère 
personnel dans le secteur des communications électroniques 
et 
- portant modification des articles 88-2 et 88-4 du Code 
d’instruction criminelle. 
c.) Code d’instruction criminelle (art. 67-1, 88-1 à 88-4) 
http://www.legilux.public.lu/leg/textescoordonnes/codes/code 
instruction crimi nelle/CodeInstrCrim PageAccueil.pdf. 
d.) Code pénal (v. en particulier les art. 148, 149, 150, 509-1 
à 509-7. 

a) apply to processing at 
national level and to cross-
border transmission; 
for b) – t) LUX did not provide 
specific information; it did 
submit the general remark that 
all the legal instruments apply 
to processing of data at national 
level and to cross-border 
transmission, except for the 
legal instruments which apply 
explicitly only to cross-border 
transmission (i.e. mutual legal 
assistance, the Law on the 
implementation of the 
international conventions). 

EN 

5 

   EN 

 
 
 
 
 
 
 
 
 
 
 
e.) Loi du 8 août 2000 sur l’entraide judiciaire internationale 
en matière pénale, avec ses modifications. 
f.) Loi du 27 octobre 2010 portant 
- approbation de la Convention du 29 mai 2000 relative à 
l’entraide judiciaire en matière pénale entre les États 
membres de l’Union européenne; 
- approbation du Protocole du 16 octobre 2001 à la 
Convention relative à l’entraide judiciaire en matière pénale 
entre les États membres de l’Union européenne; 
- modification de certaines dispositions du Code d’instruction
criminelle et de la loi du 8 août 2000 sur l’entraide judiciaire 
internationale en matière pénale; 
g.) Loi du 21 mars 2006 sur les équipes communes d’enquête 
h.) Loi du 25 août 2006 relative aux procédures 
d’identifications par empreintes génétiques en matière pénale 
i.) Loi du 22 juillet 2008 relative à l’accès des magistrats et 
officiers de police judiciaire à certains traitements de données 
à caractère personnel mis en œuvre par des personnes morales 
de droit public et portant modification: 
- du Code d’instruction criminelle, 
- de la loi modifiée du 31 mai 1999 sur la Police et 
l’Inspection générale de la Police, et 
- de la loi modifiée du 27 juillet 1997 portant réorganisation 
de l’administration pénitentiaire. 
j.) Règlement grand-ducal du 22 juillet 2008 portant 
exécution de l’article 48-24 du Code d’instruction criminelle 
et de l’article 34-1 de la loi modifiée du 31 mai 1999 sur la 
Police et l’Inspection générale de la Police 
k.) Loi du 21 décembre 2004 portant approbation du Traité 
entre le Royaume de Belgique, le Royaume des Pays-Bas et 
le Grand-Duché de Luxembourg en matière d’intervention 
policière frontalière, signé à Luxembourg, le 8 juin 2004 
l.) Loi du 22 décembre 2006 portant Traité entre le Royaume 
de Belgique, la République fédérale d’Allemagne, le 
Royaume d’Espagne, la République française, le Grand-
Duché de Luxembourg, le Royaume des Pays-Bas et la 
République d’Autriche relatif à l’approfondissement de la 
coopération transfrontalière, notamment en vue de lutter 
contre le terrorisme, la criminalité transfrontalière et la 
migration illégale, ainsi que de la Déclaration commune, 
signés à Prüm le 27 mai 2005 
m.) Règlement 08/134/ILR du 1er décembre 2008 relatif aux 
spécifications techniques pour l’interception des 
communications électroniques au Luxembourg 
n.) Règlement grand-ducal du 21 décembre 2004 déterminant 
les services de communications électroniques et les services 
postaux ainsi que la nature, le format et les modalités de mise 
à disposition des données dans le cadre de l’article 41 de la 
loi du 2 août 2002 relative à la protection des personnes à 
l’égard du traitement des données à caractère personnel 
o.) Règlement grand-ducal du 7 avril 2011 portant 
organisation des contrôles du transport physique de l’argent 
liquide entrant au, transitant par le ou sortant du Grand-
Duché de Luxembourg 
p.) Règlement grand-ducal du 1er août 2007 autorisant la 
création et l’exploitation par la Police d’un système de 
vidéosurveillance des zones de sécurité 
q.) Règlement grand-ducal du 21 décembre 2006 relatif à 
l’obligation pour les transporteurs de communiquer les 
données relatives aux passagers en provenance d’un pays non 

EN 

6 

   EN 

 
membre de l’Union européenne et au traitement de ces 
données 
r.) Règlement grand-ducal du 21 décembre 2004 
(avertissements taxés) 
s.) Règlement grand-ducal du 2 octobre 1992 relatif à la 
création et à l’exploitation d’une banque de données 
nominatives de police générale, avec ses modifications 
t.) Règlement grand-ducal du 9 août 1993 autorisant la 
création et l’exploitation d’une banque de données 
nominatives constituant la partie nationale du système 
d’information Schengen (N.SIS). 
a) Act on the Right of Informational Self-determination and 
Freedom of Information (Act CXII of 2011) = the new 
Hungarian Data Protection legislation - enters into force on 
1.1.2012;  
b) Act on the National Tax and Customs office (Acts CXXII 
of 2010) – in force since 19.11.2010;  
Amendments to: 
c) Act on Police (Act XXXIV of 1994); 
d) Act on the Hungarian Prison Service Organisation (Act 
CVII of 1995); Act on the international cooperation of law 
enforcement bodies (Act LIV of 2002). 
d) Act on the Prosecution Service Relations and the Data 
Processing of the Prosecution (Act LXXX of 1994);  
f) Act on the activities of Forensic experts (Act XLVII of 
2005). 
a) Data Protection Act 2003 (Chapter 440) 

b) Regulation AL 198/11 – Processing of personal Data – 
Police and Judicial Cooperation in Criminal Matters 
c) Regulation AL 142/04 on processing and storage of data; 
still needs to be amended to ensure compatibility 

Hungary 

Malta 

Netherlands 

a) Police Data Act 
b) Judicial and Criminal Procedure Data Act 
c) Bill amending the Police Data Act and the Judicial and 
Criminal Procedure Data Act 

Austria 

Data Protection Act 2000 

Poland 

a) Personal Data Protection Act 

b) Draft Bill on the Exchange of Information with the 
Prosecution Authorities of the EU Member States 

Portugal 

a) Law 67/98 on Personal Data Protection 

b) Draft law implementing remaining aspects of the FD 

Not specified 

a) applies to processing at 
national level and to cross-
border transmission; 
b) applies solely to cross-border 
transmission; 
c) applies solely to processing 
at national level at the moment. 
a) – b) applies to processing at 
national level and to cross-
border transmission; 

c) applies solely to cross-border 
transmission. 
applies to processing at national 
level and to cross-border 
transmission 
a) applies to processing at 
national level and to cross-
border transmission; 
b) applies solely to cross-border 
transmission. 
a) seems to apply to data 
processing at national level and 
to cross-border transmission; 
b) applies solely to cross-border 
transmission. 

Romania 
Slovenia 

No reaction to either the Commission request of 9.12.2011 or to the reminder 
a) Personal Data Protection Act of 2004 (amendments in 
preparation) 
b) State Prosecuters' Office Act 2011 

a) unclear 
b) applies to data processing at 
national level and to cross-
border transmission; 
c) will apply to data processing 
at national level and to cross-
border transmission; 

c) Draft Act on police Tasks and Authorisations (30 June 
2011 adopted by the Government and sent to the National 
Assembly)  

EN 

7 

   EN 

 
 
 
 
 
 
d) unclear 
e) unclear 

a) – h) applies to processing at 
national level and to cross-
border transmission 

a) – d) applies to processing at 
national level and to cross-
border transmission; 

e) no information available 

a) – d1) apply to data 
processing at national level and 
to cross-border transmission. 

Slovakia 

Finland 

Sweden 

d) sectoral legislation 
e) draft sectoral legislation and legislation implementing the 
remaining aspects of FD 
a) Act 192/2001 of 1.6.2011, in force since 1.8.2011. 
b) Act No 757/2004 on courts and amending certain acts 
c) Act No 124/1992 on the Military Police 
d) Slovak National Council Act No 171/1993 on the Police 
Force 
e) Act No 4/2001 on the Prison and Court Guard Service 
f) Act No 153/2001 on the public prosecutor 
g) Act No 652/2004 on State administrative authorities in the 
field of customs and amending certain acts 
h) Act No 428/2002 on the protection of personal data 
a) Personal Data Act (523/1999) 
b) Act on the Processing of Personal Data by the Police 
(761/2003) 
c) Act on the Openness of Government Activities (621/1999) 
and Criminal Investigations Act (449/1987) 
d) Criminal Investigations Act (449/1987) 
e) further specific provisions amending the Act on the 
Processing of Personal Data by the Police still need to be 
adopted4. 
a) The Swedish Instrument of Government (Regeringsformen 
- RF); 
b) The Code of Judicial Procedure (Rättegångsbalk - RB); 
c) The Penal Code (Brottsbalk - BrB); 
d) The Administrative Procedure Act (1986:223) 
(Förvaltningslag - FL); 
e) The Official Secrets Act (2009:400) (Offentlighets- och 
sekretesslag - OSL); 
f) Act (2010:367) amending the Supervision of Certain Law 
Enforcement Activities Act (2007:980) (Lagen (2010:367) 
om ändring i lagen (2007:980) om tillsyn över viss 
brottsbekämpande verksamhet - Ltbr); 
g) The Personal Data Act (1998:204) (Personuppgiftslagen – 
Pul) ; 
h) The Personal Data Ordinance (1998:1191) 
(Personuppgiftsförordning – Puf); 
i) The Police Data Act (2010:361) (Polisdatalagen – Pdl); 
j) The Police Data Ordinance (2010:1155) 
(Polisdataforordning – Pdf); 
k) Act (2005:787) on the processing of data in connection 
with the law enforcement activities of the Customs Service 
(Lag (2005:787) om behandling av uppgifter i Tullverkets 
brottsbekämpande verksamhet - Tbdl); 
l) Ordinance (2003:188) on the processing of personal data 
within the Swedish Coast Guard (Förordning (2003:188) om 
behandling av personuppgifter inom Kustbevakningen - 
Kbvdl); 
m) Act (1999:90) on the processing of personal data in the 
context of the Tax Agency's participation in criminal 
investigations (Lag (1999:90) om behandling av 
personuppgifter vid Skatteverkets medverkan i 
brottsutredningar - Skvdl); 
n) Ordinance (2006:937) on the processing of personal data 
within the Prosecution Service (Förordning (2006:937) om 

4 

Finland informed the Commission on 3.6.2011 that a Bill amending the Act on the Processing of Personal Data by 
the  Police  had  not  been  passed  before  the  elections  and  had  therefore  lapsed.  The  legislative  process  has  to  be 
renewed. 

EN 

8 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
behandling av personuppgifter inom åklagarväsendet - 
Åmdf); 
o) Ordinance (2001:639) on record keeping, etc., in the civil 
courts by automated means (Förordning (2001:639) om 
registerföring m.m. vid allmänna domstolar med hjälp av 
automatiserad behandling – Dvdf1); 
p) Ordinance (2001:640) on record keeping, etc., under 
administrative law by automated means (Förordning 
(2001:640) om registerforing m.m. vid förvaltningsrätt med 
hjälp av automatiserad behandling - Dvdf2); 
q) Ordinance (2001:641) on record keeping, etc., in the 
Supreme Administrative Court and the administrative courts 
of appeal by automated means (Förordning (2001:641) om 
registerforing m.m. vid Högsta förvaltningsdomstolen och 
kammarrätterna med hjälp av automatiserad behandling - 
Dvdf3); 
r) Act (2001:617) on the processing of personal data within 
the penitentiary system (Lag (2001:617) om behandling av 
personuppgifter inom kriminalvården - Kvdl); 
s) Act (2001:184) on the processing of data in the context of 
the activities of the Enforcement Administration (Lag 
(2001:184) om behandling av uppgifter i 
Kronofogdemyndighetens verksamhet - Kfmdl); 
t) The Criminal Records Act (1998:620) (Lag (1998:620) om 
belastningsregister - Brl); 
u) The Suspicion Registers Act (1998:621) (Lag ( 1998:621 ) 
om misstankeregister - Mrl); 
v) The Schengen Information System Act (2000:344) (Lag 
(2000:344) om Schengens informationssystem - Sisl); 
w) Act (2010:362) on the Police's general enforcement 
database (Lag (2010:362) om polisens allmänna 
spaningsregister - Aspl); 
x) Ordinance (1997:902) on court order registers (Förordning 
(1997:902) om register över strafförelägganden - Sff); 
y) Ordinance (1997:903) on registers for orders of summary 
punishment (Förordning (1997:903) om register över 
förelägganden av ordningsbot - Off); 
z) Act (2000:562) on international legal assistance in criminal 
matters (Lag (2000:562) om internationellt rättslig hjälp i 
brottmål - Lirb); 
a1) Act (2000:343) on international police cooperation (Lag 
(2000:343) om internationellt polisiärt samarbete - Lips); 
b1) Act (2000:1219) on international customs cooperation 
(Lag (2000:343) om internationellt tullsamarbete - Lits); 
c1) Act (2003:1174) on certain forms of international 
cooperation in criminal investigations (Lag (2003:1174) om 
vissa former av internationellt samarbete i brottsutredningar 
- Jit); 
d1) Ordinance (2008:1396) on the simplified exchange of 
information between law enforcement authorities in the 
European Union (Förordning (2008:1396) om förenklat 
uppgiftsutbyte mellan brottsbekämpande myndigheter i 
Europeiska union - Sinit). 
a) Data Protection Act 1998 
b) Min. of Justice Circular 2011/01 

United 
Kingdom 

a) applies to data processing at 
national level and to cross-
border transmission; 
b) applies solely to cross-border 
transmission. 

EN 

9 

   EN 

 
 
Information 
of data 
subject 
Yes5 

Belgium 

Bulgaria 
Czech Republic 
Denmark 

Yes6 
not specified. 
No7 

Germany 

Estonia 

Yes8  

Yes9 

Ireland 

Yes10 

Greece 
Spain 

not implemented 
Yes11 

Table 3  
Table 3 – Information of data subjects  

Exemptions in national legislation from providing information 

if personal data are processed  
- by public authority for the exercise of their competence as police 
judiciary;  
- by the police for the exercise of its competence as administrative police; 
- by public authorities other than the police in exercise of their competence 
as administrative police; 
- for the purpose of prevention of money laundering;  
- by the permanent committee for the control of police forces and by the 
investigating department for the exercise of their legal competence. 
no information provided on restrictions at national level; 

for data processing performed on behalf of courts, the police and 
prosecution in the area of criminal law. 
if data subject's interest in obtaining this information is overridden by 
essential considerations of public interests, including in particular national 
security; defence; public security; the prevention, investigation, detection 
and prosecution of criminal offences; important economic or financial 
interests of a Member state or of the EU (including monetary, budgetary 
and taxation matters); and monitoring, inspection or regulatory functions, 
including temporary tasks, connected with the exercise of official authority 
in cases of public security and criminal offences;  
however, controller must keep a record of certain information (categories 
of data subjects and data relating to them; recipients, controller, categories 
of processing) and the record must be made available to the public. 
sector specific laws and regulations set out when police and judicial 
authorities can process data and under which conditions;  
if data subject is aware of processing, the categories, sources, recipients 
and its rights to termination of processing, rectification, blocking, erasure 
and if data subject has right to access; 
if personal data are processed for performance of an obligation prescribed 
by law or international agreements; 
if prejudice to rights and freedoms of other persons; protection of the 
confidentiality of parenthood of a child; prevention of a criminal offence or 
apprehension of a criminal offender; ascertainment of the truth in a 
criminal proceeding. 
if application of data protection rights would prejudice prevention, 
detection or investigation of offences, apprehension or prosecution of 
offenders or assessment or collection of any tax, duty or other moneys 
owed or payable to the State. 

for data processing for the purpose of national security, public safety or the 
prosecution of criminal offences. 

5 

6 
7 

8 

9 
10 

11 

Art. 3, 9 of the Loi du 8 décembre 1992 relative à la protection de la vie privée à l’égard des traitements de données 
à caractère personnel. 
Art. 26 and 28 of Data Protection Act.  
Chapter 8, 1 and 2(4) of Data Protection Act n° 429/2000-generally see also Sections 28-30; Section 2 (5), 6 of the 
Order on Data Protection (1287/2010). 
In the Federal Police Act (Polizeigesetz) and the Police Acts of the Länder, Federal Data Protection Act and Data 
Protection  Act  of  the  Länder,  Act  on  Criminal  Procedure;  Administrative  circular  on  the  application  of 
Bundeskriminalamtgesetz. 
Sections 15 and 30 of Personal Data Protection Act. 
Section 2, 2a and 13 of Data Protection Act 1988; section 3 and 4 of Data Protection Act 2003; part 4.1f Code of 
Practice of An Garda Siochána (police force). 
Article 5(1) and 24(1) of Organic Law 15/1999 on data protection. 

EN 

10 

   EN 

 
 
                                                 
France 

Italy 

Cyprus 
Latvia 

No12 

Yes13 

not implemented 
Yes14 

Lithuania 

Yes15 

Luxembourg 

Yes16 

Hungary 
Malta 

not specified 
Yes17 

Netherlands 

Yes18 

Austria 

Yes19 

Poland 

Yes20 

Portugal 

Yes21 

for data processing for the purpose of prevention, investigation, detection 
or prosecution of criminal offences. 
in line with the personal data protection code, for criminal matters under 
the criminal procedure code the confidentiality of investigations is 
safeguarded until actions are taken. 

no derogations reported; however if interpreted broadly it can be concluded 
that the exemptions listed for access to data apply mutatis mutandis. 
for purpose of state security or defence; public order and prevention, 
investigation and detection or prosecution of criminal offences; important 
economic or financial interests of the state; prevention, investigation and 
detection of breaches of official or professional ethics; protection of the 
rights and freedoms of the data subject or any other persons. 
for reasons of a) state security, b) defence, c) public security, d) 
prevention, investigation and detection or prosecution of criminal offences 
including the fight against money laundering, or other judicial procedures, 
e) important economic or financial interests of the state or the EU, 
including monetary, budgetary and fiscal matters, f) protection of the rights 
and freedoms of the data subject or any other persons and g) a mission of 
control, inspection and regulation, even occasionally, of the exercise of 
public authority, in the cases referred to under c), d), and e). 

for purpose of national security; defence; public security; the prevention, 
investigation, detection and prosecution of criminal offences, or of 
breaches of ethics for regulated professions; an important economic or 
financial interest including monetary, budgetary and taxation matters; a 
monitoring, inspection or regulatory function connected, even occasionally, 
with the exercise of official authority; or such information being prejudicial 
to the protection of the data subject or of the rights and freedoms of others. 
no general obligation to inform; sector specific laws and regulations set out 
when police and judicial authorities can process data and under which 
conditions; 
generally, in cases where data subject can not be reached or 
disproportionate effort would be required; 
in cases of prevention, prohibition and prosecution of criminal offences, as 
far as necessary for the purpose of the processing of the data. 
not too many details provided 
if data obtained from data subject and if another act allows data processing 
without revealing the purpose for which data were collected, or if data 
subject has already been provided with relevant information; 
if data obtained from sources other than data subject; 
on the grounds of state security and the prevention or investigation of 
crime; if it is impossible to inform the data subject or it would take 
disproportionate effort to inform him or where the law explicitly regulates 
the registration or dissemination of the data. 

12 
13 
14 
15 
16 

17 

18

19 
20 
21 

Art. 32 de la Loi du 6 Janvier 1978 relatif à l'informatique, aux fichiers et aux libertés. 
Personal Data Protection Code, Legislative Decree N° 196 of 30.6.2003. 
Art. 8, 28 of Law on the Protection of Natural Persons' Data. 
Art. 12 and 13 new Law of 21.4.2011; Art. 23 and 24 of Law on Legal Protection of Personal Data. 
Art.  26  ff  Loi  du  2.8.2002  relative  à  la  protection  des  personnes  à  l'égard  du  traitement  des  données  à  caractère 
personnel modifiée and others. 
Art.  16  of  Regulations  LN  198/11  on  processing  of  personal  data  (police  and  judicial  cooperation  in  criminal 
matters); Art. 23 of Data Protection Act 2003. 
Art. 126bb Code of Criminal Procedure; Police Act (Wet politiegegevens); Judicial and Criminal Procedure Data 
Act (Wet justitiële en strafvorderlijke gegevens). 
§§ 24, § 17 (2) and (3) Datenschutzgesetz 2000. 
Art. 24 and 25 of Personal Data Protection Act. 
Section 10 of Personal Data Protection Law 67/98. 

EN 

11 

   EN 

 
                                                 
 
Romania 
Slovenia 

Slovakia 

Yes23 

Finland 

Yes24 

Sweden 

Yes25 

United 
Kingdom 

Yes26  

No reaction to either the Commission request of 9.12.2011 or to the reminder 
Yes22 

unclear; 
no details provided, only general reference to sectoral legislation 
no specific purpose for refusing info mentioned;  
for data processed by military police, police forces, general prosecutor, 
customs administration (in cases set out in Section 55(4) of Act 652/2004) 
Ministry and courts. 
if the data subject already has the relevant information; 
if this is necessary for the protection of national security, defence or public 
order or security, for the prevention or investigation of crime or for 
carrying out the monitoring function pertaining to taxation or the public 
finances; or 
where the data are collected other than from the data subject, if the 
provision of the information to the data subject is impossible or 
unreasonably difficult, or if it significantly damages or inconveniences the 
data subject or the purpose of the processing of the data and the data are 
not used when making decisions relating to the data subject, or if there are 
specific provisions in an Act on the collection, recording or disclosure of 
the data. 
if the police are collecting, recording or supplying personal data necessary 
for the performance of duties as referred to in section 1(1) of the Police 
Act. 
if access would not impede the clearing up of the case in criminal 
investigations. 
to the extent that special rules on data entry in sectoral statutes or in other 
legislation relating to police or judicial cooperation are in force; 
if granting information would be impossible or would necessitate a 
disproportionately large effort, or where information processed is 
confidential for the purpose of protecting law enforcement, public security 
and national security and confidentiality in the context of law enforcement 
activities to protect other individuals. 
For the purposes of Crime and Taxation but only to the extent to which 
informing the data subject of the collection or processing of their personal 
data would be likely to prejudice any of the crime and taxation purposes: 
a. the prevention or detection of crime, 
b. the apprehension or prosecution of offenders, or 
c. the assessment or collection of any tax or duty or of any imposition of a 
similar nature. 

22 
23 

24

25 

26 

Data Protection Act. 
Act n° 124/1992; Slovak National Council Act n° 171/1993; Act n° 652/2004; Act n° 428/2002; Act n° 153/2001; 
Act n° 4/2001; Act n° 757/2004. 
Section  24  Personal  Data  Act;  Section  43  Act  on  the  Processing  of  Personal  Data  by  the  Police;  Section  11  of 
Criminal Investigation Act; Section 11 of Act on the Openness of Government Activities. 
23-25,  och  27  §§  Personal  Data  Act  (Personuppgiftslagen  1998:204);  2  kap.2  § 1  st.  5  och  3  st.  (Polisdatalagen, 
2010:361); 6 § 1 st. 4 (Lag (2005:787) om behandling av uppgifter i Tullverkets brottsbekämpande verksamhet); 3 
kap.  1  och  2  §§  (Lag  (2001:184)  om  behandling  av  uppgifter  i  Kronofogdemyndighetens  verksamhet);  9§  (  Lag 
(1998:620)  om  belastningsregister);  8  a  §  (Lag  (  1998:621  )  om  misstankeregister);  5  kap.  1,2  och  4  §§  (Lag 
(2000:562)  om  internationellt rättslig  hjälp  i  brottmål);  3 och  3  a  §§  (Lag  (2000:343)  om  internationellt  polisiärt 
samarbete);  2  kap.  7  §,  4  kap.  2  §  (Lag  (2000:343)  om  internationellt  tullsamarbete);  5,6,13  och  16  §§  (Lag 
(2003:1174) om vissa former av internationellt samarbete i brottsutredningar); 10§ (Lag (2000:344) om Schengens 
informationssystem). 
Paragraph  2  of  Part  II  of  Schedule  1  and  Paragraph  1  of  Part  I  of  Schedule  1  to  the  Data  Protection  Act  1998; 
Paragraph 1 of Part I of Schedule 1 and Section 29 of the DPA 1998. 

EN 

12 

   EN 

 
 
                                                 
 
Access given 
to data 
subject 
Yes27 
Yes28 

Belgium 
Bulgaria 

Czech Republic 
Denmark 

not specified. 
Yes29 

Germany 

Yes30 

Estonia 

Yes31 

Ireland 
Greece 
Spain 

Yes32 
Not implemented 
Yes33 

France 

Yes34 

Table 4  
Table 4 – Right of access 
Exemptions in national legislation from giving access 

not specified  
if, 
1) this would hinder the prevention or detection of criminal offences, the 
conduct of criminal proceedings or the execution of criminal penalties; 
2) it is necessary to protect: (a) national security and public order; (b) 
the data subject; (c) the rights and freedoms of others. 

if data processed on behalf of the courts where they form part of a text 
which is not available to the public;  
if data subject's interest in obtaining this information is overridden by 
essential considerations of public interests, including in particular 
national security; defence; public security; the prevention, investigation, 
detection and prosecution of criminal offences; important economic or 
financial interests of a Member state or of the EU (including monetary, 
budgetary and taxation matters); and monitoring, inspection or 
regulatory functions, including temporary tasks, connected with the 
exercise of official authority in cases of public security and criminal 
offences; 
if sector specific exemptions have been adopted by Ministry of Justice in 
the area of criminal law. 
generally, if threat to due exercise of tasks within the competence (i.e. 
ongoing investigations), public security/order, or to the disadvantage of 
the federal state or the Länder, or if law provides for confidentiality of 
these data, particularly because of overriding interest of third parties; 

sector specific exemptions (i.e. state attorney does not provide 
information on data registered in the course of a proceeding, if they were 
started not more than 6 months ago; this period may be prolonged up to 
24 months). 
if giving access would 
1) damage rights and freedoms of other persons; 
2) endanger the protection of the confidentiality of filiation of a child; 
3) hinder the prevention of a criminal offence or apprehension of a 
criminal offender; 
4) complicate the ascertainment of the truth in a criminal proceeding. 
if prejudicial to the investigation, detection or prevention of crime 

If risk to national security or public safety, the protection of the rights 
and freedoms of third parties, or the needs of ongoing investigations; or 
if it would hinder action taken by the authorities to ensure compliance 
with tax obligations and, in all cases, where the data subject is under 
investigation. 
if state security, defence of public safety are at risk  

27 

28 
29 

30 
31 
32 

33 

Art. 13 of the Loi du 8 décembre 1992 relative à la protection de la vie privée à l’égard des traitements de données 
à caractère personnel; Art. 36 L’Arrêté royal du 13 février 2001. 
Art. 26-28 Personal Data Protection Act; Draft Act amending the Personal Data Protection Act. 
Chapter  9,  Sections  31-34,  Section  30  of  Data  Protection  Act  n°  429/2000;  Section  2  (3)  of  the  Order  on  Data 
Protection (1287/2010). 
Regulated from a general point of view in the data protection legislation, but also in sector specific instruments. 
Sections 19-20 of Personal Data Protection Act. 
Section 4 of Data Protection Act 1988 as amended by Section 5 of Data Protection Act 2003; Part 4 section 8 of the 
Code of Practice of Data Protection for An Garda Síochána. 
Article 15, 23 of Organic Law 15/1999; Art. 5 RD 95/2009 Registros administrativos de apoyo a la administracion. 

EN 

13 

   EN 

 
 
 
                                                 
Italy 

Yes35 

Cyprus 
Latvia 

Not implemented 
Yes36 

Lithuania 

Yes37 

Luxembourg 

Yes38 

Hungary 
Malta 

not specified 
Yes39 

Netherlands 

Yes40 

Austria 

Yes41 

Poland 

Yes42 

In line with the personal data protection code, for criminal matters under 
the criminal procedure code the confidentiality of investigations is 
safeguarded until actions are taken. 

if prohibited by law in the field of national security, defence and 
criminal law, or for the purposes of safeguarding the country's financial  
interests in taxation matters. 
for reasons of (1) state security or defence; (2) public order and 
prevention, investigation and detection or prosecution of criminal 
offences; (3) important economic or financial interests of the state; (4) 
prevention, investigation and detection of breaches of official or 
professional ethics; (5) protection of the rights and freedoms of the data 
subject or any other persons. 
for reasons of a) state security, b) defence, c) public security, d) 
prevention, investigation and detection or prosecution of criminal 
offences including the fight against money laundering, or other judicial 
procedures, e) important economic or financial interests of the state or 
the EU, including monetary, budgetary and fiscal matters, f) protection 
of the rights and freedoms of the data subject or any other persons and g) 
a mission of control, inspection and regulation, even occasionally, of the 
exercise of public authority, in the cases referred to under c), d), and e). 

For purpose of national security; defence; public security; the 
prevention, investigation, detection and prosecution of criminal 
offences, or of breaches of ethics for regulated professions; an important 
economic or financial interest including monetary, budgetary and 
taxation matters; a monitoring, inspection or regulatory function 
connected, even occasionally, with the exercise of official authority; or 
such information being prejudicial to the protection of the data subject 
or of the rights and freedoms of others. 
for processing under the Police Data Act in the interests of due 
performance of police duties; protection of the rights of the data subject 
or the rights and freedoms of others; national security. 
for processing under the Judicial and Criminal Procedure Data Act in the 
interests of national security; avoiding obstruction of judicial 
procedures; prevention, detection and prosecution of criminal offences; 
protection of the data subject or the rights and freedoms of others; 
national security. 
if overriding justified interests of the data controller or of a third party, 
particularly also for reasons of overriding public interests (protection of 
institutions rooted in the Constitution of the Republic of Austria; the 
operations of the Army; of the interests of the national defence; of 
important foreign policy, economic policy and financial policy interests 
of the Republic of Austria or the EU; prevention, prohibition and 
prosecution of criminal offences). 
if access would lead to a disclosure of confidential information; a threat 
to national defence or national security, to life and health of individuals 
or to public security and public order; a threat to a vital economic or 

34 
35 
36 
37 
38 

39 

40 

41 

Art. 41-42 of Loi 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés;  
Personal Data Protection Code, Legislative Decree N° 196 of 30.6.2003. 
Art. 9, 15, 29 of Law on the Protection of Natural Persons' Data. 
Art. 13 of new Law of 21.4.2011; Art. 23, 25 of Law on Legal Protection of Personal Data 
Art.  28  ff  Loi  du  2.8.2002  relative  à  la  protection  des  personnes  à  l'égard  du  traitement  des  données  à  caractère 
personnel modifiée and others. 
Art.  17  of  Regulations  LN  198/11  on  processing  of  personal  data  (police  and  judicial  cooperation  in  criminal 
matters); Art. 23 of Data Protection Act 2003. 
Art.  25,  27  Police  Act  (Wet  politiegegevens)  after  amendments;  Art.  18,  19,  39  and  21  Judicial  and  Criminal 
Procedure Data Act (Wet justitiële en strafvorderlijke gegevens) after amendments. 
§ 26 Datenschutzgesetz 2000. 

EN 

14 

   EN 

 
                                                                                                                                                         
Portugal 

Yes43 

financial interest of the State; a significant breach of personal rights of 
the data subject or of other person; for purposes of crime prevention, 
prosecution or detection, or imposing punishment. 
where the processing of personal data with a bearing on state security 
and the prevention or investigation of crime is concerned, the right of 
access is exercised through the data protection authority; the latter must 
confine itself to informing the data subject of the measures carried out; 
where the processing does not risk the rights, freedoms and guarantees 
of data subjects, where data are used purely for scientific research or 
statistics. 

No reaction to either the Commission request of 9.12.2011 or to the reminder 
Yes44  

Romania 
Slovenia 

Slovakia 

Yes45 

Unclear 
Yes - no details provided, only general reference to sectoral legislation. 
For processing by Military Police where 
a) this could threaten an ongoing investigation into the circumstances of 
a criminal act, offence or other administrative misdemeanour;  
b) this is important to prevent or detect criminal activity, to identify the 
perpetrators of criminal acts, to investigate criminal acts or to carry out 
decisions; 
c) this is essential to maintain public order and national security; or 
d) this is necessary to protect a data subject or to protect the rights and 
freedoms of others. 
For processing by the Police where 
a) this could affect or thwart official proceedings or an investigation;  
b) this could affect or thwart actions to prevent and detect criminal acts, 
to identify the perpetrators of criminal acts, to investigate criminal acts, 
to prosecute criminal acts and to carry out decisions in criminal 
proceedings; 
c) this is essential to maintain public order and national security; 
d) this is necessary to protect a data subject or the rights and freedoms of 
others.  
For processing by the Customs Administration where 
a) this could affect or thwart official proceedings or an investigation;  
b) this could affect or thwart actions to prevent and detect criminal acts, 
to identify the perpetrators of criminal acts, to investigate criminal acts 
or the execution of criminal punishments; 
c) this is essential to maintain public order and national security; or 
d) this is necessary to protect a data subject or the rights and freedoms of 
others. 
if  
1) providing access to the data could compromise national security, 
defence or public order or security, or hinder the prevention or 
investigation of crime; 
2) providing access to the data would cause serious danger to the health 
or treatment of the data subject or to the rights of someone else; 
3) the data in the file are used solely for historical or scientific research 
or statistical purposes; or 
4) the personal data in the file are used in the carrying out of monitoring 
or inspection functions and not providing access to the information is 
indispensable in order to safeguard an important economic interest or 
financing position of Finland or the European Union. 
and if 
1) data in the information system on suspects; 

Finland 

Yes46 

42 
43 
44 
45 
46

Art. 32-34 of the Data Protection Act (amended by Act of 29.10.2010); Art. 20(2a) of Police Act of 6.4.1990. 
Section 11 of Personal Data Protection Law 67/98. 
Data Protection Act. 
Act n° 124/1992; Slovak National Council Act n° 171/1993; Act n° 652/2004; Act n° 428/2002. 
Section  26-28  of  Personal  Data  Act;  not  adopted  yet:  Bill  regarding  the  restriction  of  access  is  currently  being 
debated by the Finnish Parliament, Art. 45. 

EN 

15 

   EN 

 
                                                                                                                                                         
 
2) data in the functional information system of the security police; 
3) data on covert monitoring and special checks in the Schengen 
information system; 
4) other data on classification, monitoring or the source of data 
regarding another person or an action recorded in the police’s personal 
data files or data used to link together crimes and for the technical 
investigation of crimes; 
5) access by a person suspected of a crime regarding information on the 
methods of obtaining data referred to in sections 30, 31—31 f and 
sections 36 and 36 a of the Police Act, Chapter 5 a of the Coercive 
Measures Act and section 36 of the Act on the Protection of Privacy in 
Electronic Communications; 
6) observation data referred to in section 2(3)(15) and data on technical 
monitoring referred to in section 2(3)(16). 
If laws or statutes provide that data may not be transmitted to the data 
subject; 
for protection of law enforcement, public security and national security 
and confidentiality in the context of law enforcement activities to protect 
other individuals. 
for purposes of national security, crime and taxation and regulatory 
activities. 

Sweden 

Yes47 

United 
Kingdom 

Yes48 

47 

48 

EN 

26 och 27 §§ and 52 The Personal Data Act (1998:204) (Personuppgiftslagen; 2 kap. 2 § 1 st. 5 and st. 
13  The  Police  Data  Act  (2010:361)  (Polisdatalagen);  6  §1  st.4  and  §  30  Act  (2005:787)  on  the 
processing  of  data  in  connection  with  the  law  enforcement  activities  of  the  Customs  Service  (Lag 
(2005:787) om behandling av uppgifter i Tullverkets brottsbekämpande verksamhet; 3 kap. 1 och 2§§ 
Act  (2001:184)  on  the  processing  of  data  in  the  context  of  the  activities  of  the  Enforcement 
Administration (Lag (2001:184) om behandling av uppgifter i Kronofogdemyndighetens verksamhet); 9 
§ The Criminal Records Act (1998:620) (Lag (1998:620) om belastningsregister; 8 a § The Suspicion 
Registers  Act  (1998:621)  (Lag  (  1998:621  )  om  misstankeregister;  2  kap.  8  §  Act  (2000:1219)  on 
international  customs  cooperation  (Lag  (2000:343)  om  internationellt  tullsamarbete;  20  §  The 
Administrative  Procedure  Act  (1986:223)  (Förvaltningslag);  25  §  Ordinance  (2003:188)  on  the 
processing of personal data within the Swedish Coast Guard (Förordning (2003:188) om behandling av 
personuppgifter inom Kustbevakningen; 10 § Ordinance (2001:639) on record keeping, etc., in the civil 
courts  by  automated  means  (Förordning  (2001:639)  om  registerföring  m.m.  vid  allmänna  domstolar 
med  hjälp  av  automatiserad  behandling;  §  10  Ordinance  (2001:640)  on  record  keeping,  etc.,  under 
administrative  law  by  automated  means  (Förordning  (2001:640)  om  registerforing  m.m.  vid 
förvaltningsrätt med hjälp av automatiserad behandling; 11 § Ordinance (2001:641) on record keeping, 
etc., in the Supreme Administrative Court and the administrative courts of appeal by automated means 
(Förordning (2001:641) om registerforing m.m. vid Högsta förvaltningsdomstolen och kammarrätterna 
med hjälp av automatiserad behandling; 12 § Act (2001:617) on the processing of personal data within 
the  penitentiary  system  (Lag  (2001:617)  om  behandling  av  personuppgifter  inom  kriminalvården;  3 
kap.  4  § Act  (2001:184) on  the  processing of data  in  the context  of  the activities  of  the  Enforcement 
Administration (Lag (2001:184) om behandling av uppgifter i Kronofogdemyndighetens verksamhet. 
Section 7, 28-31, 35, 42 of the Data Protection Act 1998. 

16 

   EN 

 
 
                                                 
Table 5  
Table 5 – Competent supervisory authority  

Belgium 
Bulgaria 
Czech Republic  The Office for the Protection of Personal Data 51 
Denmark 

Commission pour le Protection de la Vie Privée49  
Commission for Personal Data Protection50 

- Data processing performed by the public administration is supervised by The Danish Data 
Protection Agency,  
- Data processing performed by the courts by The Court Administration.52 
Bundesbeauftragter für den Datenschutz und die Information; Data Protection Supervisory 
Authorities in the Länder. 
Data Protection Inspectorate53 
Data Protection Commissioner54 
not implemented 
Agencia de Protección de Datos [Data Protection Agency]55 

Commission Nationale de l'informatique et des libertés (CNIL)56 
Data Protection Authority (Autorità Garante per la protezione dei dati personali)57 
not implemented 
State Data Inspectorate58 
State Data Protection Inspectorate59 
- general data processing is supervised by the Data Protection Commission 
- data processing in the framework of a provision of national law in application of an 
international convention is supervised by a Supervisory Authority composed of Procureur 
Général d'Etat, or his delegate, and two members of the Data Protection Commission who are 
nominated by the Minister upon proposal of the Data Protection Commission60. 
no information provided 
The Office of the Information and Data Protection Commissioner61 
Data Protection Authority62 
Datenschutzkommission63  
Inspector General for the Protection of Personal Data (GIODO) 
Comissáo Nacional de Protecçao de Dados (CNPD)64 
no reaction to Commission request of 9.12.2011 and reminder 
Information Commissioner 
Office for the Protection of Personal Data65 

Germany 

Estonia 
Ireland 
Greece 
Spain 

France 
Italy 
Cyprus 
Latvia 
Lithuania 
Luxembourg 

Hungary 
Malta 
Netherlands 
Austria 
Poland 
Portugal 
Romania 
Slovenia 
Slovakia 

49 

50 
51 
52 
53 
54 

55 
56 
57 
58 
59 
60 

61 

62 

63

64 

Art. 23 ff of Loi du 8 décembre 1992 relative à la protection de la vie privée à l’égard des traitements de données à 
caractère personnel. 
Art. 6, 10 (1), 22, 38(6), 13 of Personal Data Protection Act. 
not specified 
Chapters 16 and 17 of Data Protection Act n° 429/2000. 
Section 33 of the Personal Data Protection Act 
Sections  9-15  and  Second  Schedule  of  the  Data  Protection  Act  1988  as  amended  by  Sections  10-15  of  the  Data 
Protection Act 2003. Code of practice on data protection An Garda Síochána. 
Organic Law 15/1999 of 13 December 1999 on the protection of personal data. 
Chapter III of Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. 
not specified 
Article 29(3) of the Law on the Protection of Natural Persons' Data. 
Art. 14 of new Law of 21.4.2011; Section 9, Art. 36-52 of Law on Legal Protection of Personal Data. 
Luxembourg  did  not  provide  specific  information;  on  the  basis  of  the  Data  Protection  Legislation  it  can  be 
concluded that a national supervisory authority (Art. 32) has been set up and that a specific supervisory authority is 
competent for supervision of data processing in the framework of the application of international conventions (Art. 
17(2)). 
Art.  25  of  Regulations  LN  198/11  on  processing  of  personal  data  (police  and  judicial  cooperation  in  criminal 
matters). 
Art. 35, 27 Police Act (Wet politiegegevens); Art. 27 Judicial and Criminal Procedure Data Act (Wet justitiële en 
strafvorderlijke gegevens) after amendments. 
§ 30, 31 (2), 19-21 Datenschutzgesetz 2000; § 90, 91d (3) Sicherheitspolizeigesetz; § 142 (3) Strafprozessordnung. 
Austria noted that the data protection supervisory authority is not competent to decide on complaints for violation 
of data protection rules by judiciary (Austria). 
Sections 22 and 23 of Personal Data Protection Act. 

EN 

17 

   EN 

 
                                                 
 
Finland 
Sweden 
United 
Kingdom 

Data Protection Ombudsman and Data Protection Board66 
Swedish Data Inspection Board67 
Information Commissioner's Office68 

65 
66 
67 

68 

Art. 33 ff of Data Protection Act 428/2002/ 
Personal Data Act (523/1999); Act on the Personal Data Board and the Personal Data Ombudsman (389/1994) 
Intention  is  to  designate  the  Swedish  Data  Protection  Board.  43-47  §§  The  Personal  Data  Act  (1998:204) 
(Personuppgiftslagen);  2  §  The  Personal  Data  Ordinance  (1998:1191)  (Personuppgiftsförordning);  2  kap.2  §  1 
st.11 and 2 kap. 6 § The Police Data Act (2010:361) (Polisdatalagen); 6 § 1 st. 9 Act (2005:787) on the processing 
of data in connection with the law enforcement activities of the Customs Service (Lag (2005:787) om behandling 
av uppgifter i Tullverkets brottsbekämpande verksamhet; 1 kap. 3 § 1 st. 8 Act (2001:184) on the processing of data 
in the context of the activities of the Enforcement Administration (Lag (2001:184) om behandling av uppgifter i 
Kronofogdemyndighetens verksamhet; 1 § Act (2010:367) amending the Supervision of Certain Law Enforcement 
Activities Act (2007:980) (Lagen (2010:367) om ändring i lagen (2007:980) om tillsyn över viss brottsbekämpande 
verksamhet;  7  kap.  1  §,  8  kap.  1  §  och  11  kap.  1  §  The  Official  Secrets  Act  (2009:400)  (Offentlighets-  och 
sekretesslag. 
Section 51, 54 and 59 of the Data Protection Act 1998. 

EN 

18 

   EN 

 
 
                                                                                                                                                         
Table 6  
Table 6 – ISSUES AT NATIONAL LEVEL AFFECTING IMPLEMENTATION  

Belgium 
Bulgaria 
Czech Republic 

Denmark 
Germany 

Estonia 
Ireland 

Greece 
Spain 
France 

Italy 

Cyprus 
Latvia 
Lithuania 
Luxembourg 
Hungary 
Malta 
Netherlands 

issue is still being studied 
no problems at national level affecting the application of the Framework Decision 
no specific problems in legislative implementation;  
however, concern that Framework Decision will hamper international cooperation, contains 
unrealistic rules for data transfers to third countries; multiplicity of EU rules and national 
rules and the different treatment of different areas is not justified; insufficient formal quality; 
confusing wording on relationship with international treaties (Art. 26 (2) of Framework 
Decision).  
no information provided 
this question can only be answered once the assessment on the necessity to adopt further 
implementing legislation has been finalised 
no information provided 
not currently; code of practice on data protection for an garda siochana is in place since 
November 2007 
no information provided 
no issues affecting the implementation of the provisions of the Framework Decision 
the only question which affects the implementation of the Framework Decision is the one in 
relation to the duration of the storage of data coming from a foreign country in case the latter 
applies restrictions on the duration of the storage in comparison to the storage period in 
France (and vice versa). 
No major difficulties currently hamper implementation 
However, 
- it is difficult to distinguish in practice between cross-border processing of data under the FD 
2008/977 and processing at national level; 
- impact on judicial and police activities when harmonising and coordinating national 
legislation with EU legislation; 
- impact of FD 2008/977 on VIS for investigative or crime prevention purposes. 
- necessity to provide for an adequate and uniform level of data protection for data transfer to 
third countries. 
no information provided 
no obstacles hamper implementation. 
no issues affect the proper implementation of the FD 
no information provided 
no information provided 
No issues affect the proper implementation of the FD 
no serious shortcomings at national level which hamper correct implementation; 
however, the Framework Decision contains ambiguities in some areas which may hamper 
due implementation by the law enforcement authorities;  
1. Law enforcement authorities then have to cope with two different processing regimes for 
the same personal data. This gives rise to confusion as to the rules applicable to data 
processing and transmission, i.e. the rules for the transmission of police data to other Member 
States – and to Europol and Eurojust – and the rules for the transmission of personal data to 
third States. 
In relation to the transmission of personal data to other Member States, the provisions of the 
Data Protection Framework Decision are of a supplementary nature. Other provisions remain 
in full force, such as those of the Convention implementing the Schengen Agreement, 
Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the 
exchange of information and intelligence between law enforcement authorities of the Member 
States of the European Union and Council Framework Decision 2009/315/JHA of 
26 February 2009 on the organisation and content of the exchange of information extracted 
from the criminal record between Member States.. 
2. The Framework Decision links the transfer of personal data to third States to the criterion 
of an appropriate level of protection. However, no further details are given regarding this 
criterion. In this respect, there is a need for more alignment between the Member States, on 
the one hand, and between the Member States and the Commission, on the other, to offer 
sufficient to go by for practical implementation to ensure correct application of the rules. 

EN 

19 

   EN 

 
 
Finally, the Dutch language version of FD 2008/977/JHA contains a few ambiguities which 
hamper correct implementation. They need to be adjusted (Firstly, this concerns the marking 
and referencing of data. The definitions in Article 2, points c and j, are not very consistent 
with the text of Article 18(2) of the Framework Decision; it is not clear to what extent Article 
18(2) contains an obligation to reference data; Secondly, this concerns the text of Article 
17(1)(a), the Dutch version of which is materially different from the English.).  
no information provided 
Framework Decision 2008/977/JHA contained numerous deficiencies, which should be 
clarified and adjusted; for this reason it is worth considering whether the scope of application 
of general rules on personal data protection should not be extended to the area of police and 
judicial cooperation in criminal matters, taking into account the specificity of the sector and 
the resulting restrictions and exemptions. 
no major difficulties;  
but area is complex and highly sensitive and becomes even more so against the background 
of the new legal framework for the protection of personal data 
no reaction to Commission request of 9.12.2011 and reminder 
no issues reported which hamper implementation of Framework Decision. 
However, the preparation of implementing legislation indicates one problematic area: the 
clear and precise definition of the conditions for processing the personal data at national level 
and as part of judicial (police) cooperation; there is a tendency here for legislation to overlap. 
In addition, the nature of police activities (the investigation of criminal acts) and the nature of 
court proceedings are two different categories of public authority activity, and the extent and 
nature of the public is also a factor that determines the scope and manner of personal data 
protection; in this sense we believe that the Framework Decision does not distinguish 
sufficiently between these two sets of specificities." 
No issues reported which hamper implementation; 
Express reference to a draft Bill for an Act amending the Act on the Processing of Personal 
Data by the Police which is currently being debated by the Finnish parliament.  
No issues reported which hamper implementation;  
It is considered important for the modernisation of the EU's regulatory framework on data 
protection to continue to provide scope for special regulations at national level for various 
authorities and sectors; express reference made that for police and judicial cooperation it is 
important that future regulation takes the specific requirements in this area into account. 
No specific issues with the provisions of the FD 2008/977. 

Austria 
Poland 

Portugal 

Romania 
Slovenia 
Slovakia 

Finland 

Sweden 

United 
Kingdom 

EN 

20 

   EN