Regulating police use of facial recognition technology in the Netherlands: The complex interplay between criminal procedural law and data protection law

A different underlying mindset: maximum versus minimum use of data

When exploring the interplay between the two areas of law, the first thing to note is the almost complete absence in the Framework of data protection rules. While the Framework repeatedly stresses that biometric data (referring to the biometric templates used for facial recognition) have an ‘especially protected status’, it – mistakenly – refers only to the General Data Protection Regulation, without any mention of the LED or the Police Data Act. The ten questions that need to be considered in the assessment also do not refer to, for example, the source and time of the captured facial images (apart from Question 8 asking ‘Who is the owner of the camera taking the images?’). There is also no mention of a Data Protection Impact Assessment (DPIA), even though one must be conducted in cases where the data processing is likely to result in a high risk to individuals’ fundamental rights and freedoms. ²⁵ Because facial recognition technology leads to systematic automated processing of biometric data, the European Data Protection Board considers that DPIAs should be a mandatory requirement for all types of police use of the technology. ²⁶

In the absence of any concrete rules limiting the further use of facial images, we conclude that the Framework has been built on the idea that all facial images – collected at a certain point in time from various kinds of sources – can be processed for identification purposes via facial recognition technology. The Framework thus seems to be based on the presumption of ‘maximum use of data’, a presumption which ‘naturally’ follows from the perspective of criminal procedure law. After all, for the purpose of combatting crime any information that might bring the case a step further should – as a rule – be used, assuming that the collection took place in a lawful manner. ²⁷ The scarce literature on data processing in criminal procedure describes data processing ‘not only [as] a power, but also a necessity and a duty’. ²⁸

This approach seems to be in opposition to the approach of data protection law, which is founded on the principles of data minimisation and purpose limitation in order to ensure fair and lawful data processing. ²⁹ Nevertheless, it should be noted that the goal of data protection law is not to prevent personal data processing. Instead, the goal is to ensure appropriate legal safeguards so as to prevent harm from unfair and disproportionate data processing. After all, EU data protection law has a dual function: to protect the fundamental rights of individuals, but also to facilitate the free flow of data within the EU (Article 1(2) LED).

From a criminal procedure law perspective it is nevertheless difficult to recognise the meaning as well as the importance of data protection rules in the law enforcement context. This might be particularly true in relation to the so-called ‘record-keeping’ ³⁰ provisions of data protection law, where personal data are protected through a ‘technocratic’ system based on control of access, categorisation and compliance measures, oftentimes demanding rather precise documentation and reporting conditions. ³¹ A good example of such a provision is Article 6 LED (implemented in Article 6b Wpg), which introduces a qualified obligation (‘as far as possible’) to distinguish between different categories of data subjects relevant in the law enforcement context, such as accused persons, suspects, victims, witnesses or persons otherwise involved. The rationale of such categorisation is that data of different data subjects are processed in different ways (for different purposes) and retained for different periods of time, thus ensuring that criteria of necessity and proportionality are fulfilled. ³² Yet, how could this provision ever be translated into concrete and workable rules when, for the purpose of automated facial identification, footage of a municipal camera is analysed? When such processing is likely to affect a wide group of unknown persons, how can the police distinguish the various categories of data subjects up-front? In fact, might not a reasonable interpretation of the obligation be that the use of facial recognition actually contributes to meeting the requirement of differentiating between data subjects? For example, if a white middle-aged man is being sought, CCTV footage in which only women, children, or people of colour are recognised (data subjects that are not of interest) might be discarded or blurred (we further discuss this in relation to automated blurring of faces as a type of Data Protection by Design measure). In this way, the use of facial recognition would contribute to meeting the data protection principles of data minimisation and purpose limitation.

With this discussion we want to show that successful cooperation between criminal procedure and data protection law requires criminal law scholars and practitioners not only to be aware of the value of data protection law, but also to know how to translate this value of the abstract and ‘foreign’ rules like Article 6 LED into more concrete rules within a criminal justice context. This is not a simple balancing act to be performed, given the different mindsets and interests of the two areas of law, split between assumptions of maximum versus minimum use of data.

A different assessment of the required legal basis: proportionality versus strict necessity

The second identified gap resulting from the lack of interaction between the two areas of law relates to the legal basis required for the use of facial recognitions technology for identification. The Framework briefly addresses this issue from a criminal procedural perspective. According to the Framework, the deployment of facial recognition technology must be seen as a ‘more than minor intrusion’ into privacy because sensitive (biometric) data are processed. For such a privacy intrusion, the legality principle in criminal law demands a specific legal basis. Interestingly, the Dutch police acknowledge that such a basis is needed and that it does not exist. They do not, however, draw the conclusion that facial recognition technology therefore cannot be deployed. ³³ Quite the contrary, the conclusion seems to be that as long as its use is proportionate (that is, on the greenish side of the scale), it is allowed.

It is noteworthy that the issue of the legal basis is not considered from the perspective of data protection law in the Framework. Yet, precisely in the case of biometric data, a sensitive type of personal data, EU data protection law is of particular importance, as it requires a legal basis subject to particularly strict requirements.

When employed for the purpose of identification, facial recognition technology functions on the basis of processing biometric data. Because of this, it falls under the scope of the legal framework for the processing of special categories of personal data (Article 10 LED; ³⁴ Article 5 Wpg). ³⁵ Such processing first of all requires a legal basis, which needs to be phrased in sufficiently precise and foreseeable terms so as to offer an adequate indication of the circumstances and conditions under which the police may employ such measures. The law should specify at least ‘the objectives, the personal data to be processed, the purposes of the processing, procedures for preserving the integrity and confidentiality of personal data and procedures for its destruction.’ ³⁶ Precision might also require the law to include preconditions relating to specific types of evidence or a requirement of judicial or internal authorisation. ³⁷ This means that according to data protection law, the legal basis for the use of facial recognition technology needs to be specifically tailored at least to the processing of biometric data. ³⁸ In fact, before national lawmakers create a new legal basis for any form of processing of biometric data (which poses a high risk for fundamental rights), they are required to consult the national data protection authority. ³⁹

Furthermore, according to data protection law the processing of biometric data is only allowed when strictly necessary. This means that it needs to be used only as a last resort, that is, when it is indispensable, and when no other, less intrusive means are available. ⁴⁰ This should not be an abstract and general assessment, but one which establishes objective criteria for the definition of the circumstances and conditions under which the processing can take place. ⁴¹ The requirement of strict necessity should therefore not be equated with the general principle of proportionality as found in the Framework. Rather than being one criterium among others, strict necessity places greater emphasis on the requirement that no other, less intrusive means are available (Question 6 of the Framework). According to the ‘Guidelines on the use of facial recognition technology in the area of law enforcement’ of the European Data Protection Board (EDPB), the margin of appreciation permitted to law enforcement relating to this strict necessity test is restricted ‘to an absolute minimum.’ ⁴²

Data protection law therefore sets a (much) higher set of standards for the legal basis concerning police use of facial recognition technology for identification than Dutch criminal procedure law. This strictness is also reflected in the draft AI Act. The Act is primarily aimed at standardising the market for AI systems by imposing requirements on the quality of those systems. As such, it also sets restrictions on the use of AI systems, in turn affecting the possibilities for the police to deploy AI (further discussed in the section on creating an adequate legal basis).

According to the strict requirements of data protection law for the processing of biometric data, police use of facial recognition is therefore not allowed until a specific legal basis is created. While a specific legal basis is also required by the legality principle in criminal procedure law, the police simply set this problem aside and conclude that its use is acceptable as long as it is proportional. This might stem from the underlying assumption of maximum use of already collected data, as we have argued in the previous section. However, re-use of this sensitive type of data for a new investigative purpose creates new intrusions into fundamental rights, requiring a new assessment. Police use of facial recognition technology should therefore be carried out ‘in strict compliance’ with data protection law and its requirement of strict necessity, as the EDPB concluded. ⁴³

An ineffective web of supervision: criminal courts versus the data protection authority

It is clear from the design of the Framework that the supervision of police use of facial recognition technology (FRT) is seen as a task for the police themselves. An application for the deployment of this technology is reviewed by an internal ‘police review committee’ and the final permission is granted by the chief of police. The evaluation of the deployment of the technology and subsequent decisions take place within – what the police call – ‘the FRT-Community’ of the police. ⁴⁴ As a result, the police review committee or the chief of police are able to decide prior to any deployment that facial recognition technology may not be used in a particular case. On the basis of an ex post evaluation, the police ‘FRT-Community’ may also decide that a particular deployment may not be repeated (at least not in the same manner).

Despite the internal nature of this supervision, the Framework does acknowledge the importance of accountability:

‘Given the sensitivity of the data and the potentially high intrusion associated with the deployment of FRT, the police keep accurate records of where, how and why FRT has been deployed. In doing so, the police are obliged to be able to provide access to (the accuracy of) the system, information about the actual deployment and the data gathered. How a match was made must be traceable, explainable and verifiable. All of this also applies to the use of FRT that does not lead to evidence in criminal cases’. ⁴⁵

Such a system of supervision begs an important question: does a self-imposed task to be accountable mean that the police can and indeed will be held accountable in practice? There are several reasons why the answer to this question will be ‘barely’.

The first reason relates to the limited supervisory role of Dutch criminal courts in this context. This is due to the fact that criminal courts are only able to judge the deployment of facial recognition technology within the context of a criminal case against a concrete defendant. Yet, relatively few cases of facial recognition technology result in the prosecution of a suspect. If facial recognition technology is used for preventive purposes or to stop a crime, there will be no prosecution. Even when used for a criminal investigation, the case oftentimes does not result in a criminal trial, for instance, because of lack of evidence, lack of priority, or an extrajudicial settlement. Furthermore, information concerning an operation involving facial recognition technology does not always end up in a case file, particularly when it is not used for an arrest but just as a lead in the earlier stages of an investigation. ⁴⁶ Especially in cases of organised crime, the police might not want to reveal too much information about investigative tactics. Finally, Dutch criminal procedure law requires courts to consider only such unlawful processing of personal data that has ‘had a decisive influence on the course of the investigation into and/or the (further) prosecution of the suspect’. ⁴⁷ In practice, a decisive influence will be difficult, if not impossible, to substantiate. As Hoving writes:

‘The provisions in the Wpg, the Wjsg [Judicial and Investigative Data Act] and the [Law Enforcement] Directive are almost all broadly worded and largely have the character of principles. Investigating officers and prosecutors have wide discretion to assess on a case-by-case basis what processing of criminal personal data is proportionate and necessary. Only if it is evident that criminal records have been improperly handled could a procedural violation be established. An example would be leaving a case file on the train.’ ⁴⁸

In fact, Dutch courts have been systematically rejecting the need to assess whether a violation of data protection law has taken place, considering data protection law an ‘unimportant regulation of criminal procedure’. ⁴⁹ In other words, judges in criminal trials do not consider the enforcement of data-protection legislation as a part of their task. In view of the very limited role of criminal courts, the main supervisory task concerning the processing of personal data in the context of law enforcement therefore falls on the Dutch Data Protection Authority (Autoriteit Persoonsgegevens; DPA), the other supervisory body for the processing of personal data in the criminal law context. However, looking at the Framework, several factors seem to stand in the way of the DPA effectively performing this task.

One major obstacle is the secrecy that is inherent to criminal investigations. In the Framework, the police write: ‘[D]ue to investigative interests and the necessary protection of investigative methods, the police cannot be completely transparent to everyone about the exact details of FRT deployment’. ⁵⁰ The question that arises here is: may the Data Protection Authority (in some situations) be considered as ‘everyone’? While the LED offers no possibilities to limit the information demanded by the national DPA, the situation in the Dutch implementation of the law is less clear, at least to us. According to Article 33(5) of the Police Data Act, further rules concerning the audits performed by the DPA are determined in administrative law. However, it remains unclear to what extent these rules of administrative law – which in any case seem to require an audit at a fairly abstract level – allow for certain information or details on the use of facial recognition to be withheld from the DPA. ⁵¹ It does not seem unlikely that the DPA will either be unaware of the use of the technology or will receive insufficient information concerning its deployment. And because data subjects generally remain unaware that their facial images have been processed for law enforcement purposes, they will also not be able to file a complaint to the DPA.

A further problem lies in the nature of the review the authority has to perform. The DPA will have to test the question of lawful use of facial recognition technology not only on the basis of relatively concrete record-keeping rules, but also on the basis of open standards such as ‘strict necessity’. Such a test requires a balancing of interests, which in turn requires knowledge of the criminal investigative context. ⁵² By this we mean not only the details of a concrete case, but also the knowledge of all the interests at stake. This means that, besides data protection rights, the balancing act needs to at least include the interest of the criminal investigation in the specific case, the availability of (alternative) investigation methods, and insight into all persons whose right to privacy is being intruded upon and to what extent. In order to properly weigh these interests, knowledge of the relevant criminal procedural rules and their use is therefore required. At the very least, this implies that the Data Protection Authority will need to employ people who have both knowledge of and experience with data protection law and criminal procedure. The question is whether the Dutch DPA is making an effort to hire such people. This is not clear from its latest ‘vision document’ or annual report. ⁵³ It is generally known however, that despite their continued growth in recent years, the DPA is encountering significant staff shortage, making it impossible to look into all potential data protection violations. ⁵⁴

Creating an adequate legal basis: taking inspiration from the regulation of ANPR and DNA data

In the absence of regulation for the use of facial recognition technology, the Dutch police have created a brand-new and experimental Deployment Framework. While such a Framework is a good way to open up the discussion on regulating this technology, the Framework itself cannot be a sufficient basis for an intrusive technique like facial recognition technology. Not only does EU data protection law require that national lawmakers take the lead, but also, a broad and open discussion is needed in order to determine what we as a society consider acceptable in the landscape of digital possibilities. ⁵⁵ However, the difficulty for legislatures is that technology and its possibilities – and thus the answer to the question what we think is acceptable – are quickly evolving. This means that regulation of facial recognition technology has to navigate not only between the two (sub)fields of law – criminal procedural and data protection law – but also between the requirements of legality and the need for flexibility. In that respect, a legal basis should ideally be a combination of ‘outline level’ provisions in the Code of Criminal Procedure and a more specific elaboration in flexible lower regulations. ⁵⁶

While national lawmakers do not face an easy task, they do not have to start from scratch, as it sometimes seems. Examples of rules combining criminal procedure law and data protection law already exist. To begin with, the recent regulation of Automated Number Plate Recognition (ANPR) in the Dutch Code of Criminal Procedure (CCP) and lower regulations is interesting and relevant because it involves the automatic processing of personal data by use of cameras in public space. This regulation was introduced after years of experimenting with ANPR and after several courts and the DPA made clear that a sufficient legal basis was missing. ⁵⁷ Article 126jj CCP was introduced to specify for what purposes and under which conditions the police can use the captured data of passing-by vehicles. The provision stipulates that ANPR data are retained for four weeks and can only be accessed with an order by the public prosecutor in case of 1) suspicion of a crime for which pre-trial detention is allowed (generally, crimes punishable by a maximum of four-year or longer prison sentence), or 2) to arrest a fugitive suspect or convict. It is clear that this restriction of purposes is considerably more stringent than the processing of facial images for identification purposes under the Framework, which has no restrictions with regard to the situations in which the collected facial images may be used.

This is a remarkable difference, given that the automated processing of facial images potentially holds a significantly greater breach of the right to protection of personal data than the use of ANPR data. After all, the processing of facial images for the purpose of identification falls under the increased protection of Article 10 LED, which requires a ‘strict necessity’ test and thus a sharp delineation of purposes of further processing. The balancing of interests under this criterion means that the subsidiarity test in particular carries a great weight. ⁵⁸ In other words: is it possible to achieve a goal in another, less intrusive way, that is, one which does not require the processing of faces of all individuals in a particular public place? We believe that, following the recent ANPR legislation in the Netherlands, rules on the use of facial recognition technology should strictly – in fact, more strictly than with ANPR – define the situations in which its use is allowed.

Furthermore, if the European Parliament’s version of the AI Act were to come into force, a legal basis for facial recognition technology would have to be considerably more limiting than the Framework. This draft text prohibits both real-time use of AI systems operating in publicly accessible places and ‘AI systems used for the analysis of recorded footage of publicly accessible spaces through “post” remote biometric identification systems, unless there is pre-judicial authorisation for use in the context of law enforcement, when strictly necessary for the targeted search connected to a specific serious criminal offense that already took place, and only subject to a pre-judicial authorisation’. ⁵⁹

Lessons can also be learned from the lower regulations of Dutch ANPR legislation. These are rules issued by the Minister of Justice and Security concerning the further conditions for processing data. For example, in the ANPR Decree there are provisions on drawing up a camera plan, ⁶⁰ provisions on access to and security of the data, ⁶¹ and a provision about an annual privacy audit. ⁶² These are essentially data protection rules, which have been integrated into the criminal procedural legal framework. We argue that similar rules can and should be drawn up for the use of facial recognition technology.

The regulation of facial recognition technology could also learn from the Dutch legal framework concerning DNA testing. This is particularly important in regard to the reliability of data generated through sophisticated algorithmic techniques. It is well known by now that facial recognition technology struggles with bias ⁶³ and that, despite its appearance of objectivity, its output remains of a probablistic nature. Whether the technology will indicate a match between two faces depends on the threshold value (determining the value above which biometric profiles are considered to match), which can be set not only by the manufacturers of the technology but end users as well (e.g., police officers). ⁶⁴ Fixing this threshold too high or too low risks high false negative or false positive rates, respectively. Concerning the issue of bias, the upcoming AI Act will include provisions on the quality and representativeness of the data used to build the models, which should help improve the realiability of the model. Nevertheless, in the procedural context there is still a need to test the means by which identification took place, if the right to a fair trial in Article 6 ECHR is to be upheld. The manner in which this could take place could follow the framework as found in the Dutch ‘Decree on DNA investigation in criminal cases’. ⁶⁵ This framework makes clear that DNA testing is considered expert evidence, thus giving the defence the right to counter-expertise, and that a designated institute in the Netherlands is responsible for the quality of that testing. Obviously, facial recognition technology is a different type of analysis (data-based) than DNA analysis, which is chemical-based. Nevertheless, there is still a need for all parties in the criminal trial to have the opportunity to effectively test the reliability of evidence resulting from AI analysis (including information on disregarded ‘matches’ and error rates, as well as uncertainties of the system itself), a condition that is particularly difficult to achieve when it comes to police expertise, which usually remains undisclosed. Considering that algorithmic research already partly resides at the Netherlands Forensic Institute, ⁶⁶ this would be a relatively straight-forward solution.

DNA regulation is of interest to the standardisation of facial recognition technology for additional reasons. Like facial images, DNA data are sensitive personal data within the meaning of Article 10 LED, thus falling under the strict regime we described before. According to the Dutch CCP, obtaining DNA material – on the basis of which DNA profiles are made and processed – can take place only by order of the public prosecutor ⁶⁷ for the purpose of an ongoing investigation, if someone is suspected of a crime of a certain gravity, and furthermore, for the purpose of future investigations, after the conviction for such a crime. The retention periods of DNA profiles are then regulated in Articles 13 to 18c of the DNA investigation Decree and vary between ‘immediate destruction’, 12 years and 80 years. These periodes depend on the type and severity of the offence, the final verdict in a given case (acquittal, conviction, level of sentence), and whether the suspect is a minor. DNA regulation is therefore very precise and nuanced. And while we are not suggesting that facial recognition regulation needs to be just as precise, we do think that in the context of the ‘strict necessity’ test and the qualified requirement to establish different categories of data subjects, rules relating to DNA data processing can serve as an example.

Encoding the less ‘muddy’ norms of data protection law: taking inspiration from the Data Protection by Design-measures in ANPR regulation

Our second proposal relates to one of the common criticisms of data protection law: that it is principle-based regulation and, therefore, abstract, unclear and difficult to put into practice. ⁶⁸ However, alongside open-ended (‘muddy’) norms, data protection law also includes a range of relatively concrete procedural and technical rules, which require a limited level of interpretation and balancing. This includes not only requirements relating to automatic logging ⁶⁹ and the keeping of records, but also the implementation of additional technical measures integrating safeguards into the processing itself (e.g, labelling of the collected personal data) and other security measures for the protection of data from attacks, leaks and destruction. These requirements are of particular importance for the processing of special categories of personal data, such as biometric data. While some of these requirements, such as the requirement of secure data processing in Article 29 LED, still include open-ended notions such as ‘state of the art’ and ‘context’, the recent development of guidelines, handbooks and technical standards on the security of personal data processing by various national and international bodies, nevertheless offers a range of concrete measures for implementation. ⁷⁰ These procedural and technical rules are thus well-suited to being encoded (that is, embedded) into the technology itself. ⁷¹ Although some scholars have argued that only the less ‘interesting’ rules of data protection law render themselves to encoding, ⁷² embedding the less ‘muddy’ rules of data protection law into the technology can still enhance the ex ante application of these legal norms, and therefore the principle of accountability.

With the introduction of the concept of data protection by design and by default into data protection law (Art. 20 LED; Article 4b Wpg), the police are already obligated to ensure that the processing of personal data meets the Directive’s requirements through the implementation of adequate solutions into the (design of the) technology itself, along with organisational measures. ⁷³ While this obligation is not unlimited, the LED makes clear that the implementation of data protection by design and by default ‘should not depend solely on economic considerations’. ⁷⁴ The measures that need to be implemented, will be largely determined by the data protection impact assessment (DPIA) ⁷⁵ that needs to take place before facial recognition technology is used. This underscores the importance of conducting a DPIA. In relation to facial recognition technology, particular attention should be paid to measures that need to be implemented in the various IT systems of the police, where the captured facial images are stored. After all, there is no automated identification based on facial recognition technology without databases of ‘known faces’. Technical and procedural measures in relation to these databases are therefore needed to counteract the underlying idea that all facial images collected at a certain point in time and from various kinds of sources can be processed for facial recognition purposes.

Dutch ANPR regulation can again serve as inspiration, as it includes rules on the blurring of persons’ faces that are captured in ANPR images (Article 126jj CCP). While this was initially done manually, it has recently become possible to blur the faces in an automated manner, ⁷⁶ a prime example of data protection by design. This technical measure helps to implement the principles of data minimisation and purpose limitation (and, ultimately, fair processing), according to which data not needed for the concrete task at hand should not be collected in the first place or should be deleted or rendered unusable immediately after collection. This blurring of faces might be a particularly useful measure in the case of facial recognition technology deployed in public space, where a wide group of unknown and innocent persons are likely to be caught on the camera footage. As soon as the automated processing would identify the relevant subject (or determine that they do not appear on the captured images), the faces of the remaining persons on the images should be blurred. The technical measure of blurring should be further assisted by organisational measures, the other key aspect of data protection by design. Accordingly, ANPR regulation includes relevant procedural rules on task separation: before the tactical staff of the police can access the images captured by ANPR cameras, the technical staff needs to take a first look in order to ensure compliance with the legal requirements. ⁷⁷ Such task separation further ensures the achievement of legal safeguards, such as preventing that tactical staff of the police gain knowledge of data that should not be used (e.g., because they should have already been deleted).

While encoding certain less muddy data protection rules into technology itself can only serve as a limited and imperfect solution, it can nevertheless aid the achievement of data protection law in practice, as well as the accountability and supervision of compliance with the law, matters which have proven to be particularly problematic in the context of law enforcement.

Designing effective supervision for processing personal data in the law enforcement context

Our final proposal relates to the issue of effective supervision for processing personal data in the law enforcement context. It is paramount that independent supervision is able to function properly, given the peculiarities of the use of facial recognition technology for identification within the law enforcement context. In the section on supervision, we concluded that the main task of the independent supervision of the deployment of facial recognition technology by the police falls on the shoulders of the national Data Protection Authority. We also questioned the effectiveness of supervision by the DPA, given the ‘inscrutability’ regarding its information position and knowledge of the criminal context.

These findings raise the question of how such supervision can be effectively organised. Because of secrecy around police tactics, operations and strategy, supervision needs to go beyond reactive, complaints-based approaches that assume sufficient awareness among members of the public. ⁷⁸ Ideally, this supervision should be vested in an authority that can both systematically monitor and stop unlawful data processing in individual cases. This authority should also contribute to the refinement of data protection standards in the law enforcement area, and ensure the legal protection of individuals. ⁷⁹ As such, this authority needs to have the appropriate expertise and be informed as fully as possible on the processing activities taking place by the police. For this, it needs to have powers for ‘systematic supervision’, that is, the knowledge of and power to remedy the unlawful processing (also) beyond individual cases.

The obvious question that emerges is whether such systematic supervision can be organised within the existing Dutch DPA or whether a new supervisory authority should be created. Creating a new authority will likely lead to even higher costs, take even longer to put into place and further complicate the supervision process (yet another player in the game), than trying to organise such supervision within the Data Protection Authority. ⁸⁰ With sufficient funding and (therefore) experts, the required expertise could in principle be organized within the existing DPA. We do not, however, have sufficient understanding of the extent to which the Dutch DPA has the actual powers that are needed for systematic monitoring of data processing. For this we would need better knowledge of yet another field of law: administrative law. It is, for example, unclear to us, if the obligation to ‘repair the situation under an administrative order’ (Article 35c sub d Wpg) includes the power to stop unlawful processing. Under the LED, such a power is not required.

What we also do not grasp fully, how the decisions and actions of the DPA relate to the need for secrecy of the police. The information position of the DPA could namely be seriously hindered by this need for secrecy. We acknowledge that this is not an easy issue to solve. For this reason, we also understand Federova and others’ suggestion to create a new supervisory authority based on the design of the supervision of Dutch intelligence agencies. ⁸¹ After all, in the context of intelligence, secrecy is the starting point. Furthermore, in the Netherlands there is experience with a combination of ex durante and ex post supervision of intelligence agencies that could serve as an example. Nevertheless, before creating something new, we should first conduct a study on the possibilities of what is already there. This will entail answering questions, such as: how effective can supervision of the Dutch DPA become, given the potential obstacles for supervision within the law enforcement context, and given the need to combine several (sub)fields of law (not only data protection and criminal procedural law, but also administrative law and, in due time, the new regime of the AI Act)?