Report D-23 examines the conditions under which law enforcement access to personal data becomes lawful, necessary and capable of effective challenge. It focuses on the European Union and the United Kingdom and incorporates legislative and judicial developments up to 24 September 2026. ARGA_D-23_Law_Enforcement_Data_…

Its central finding is that access to personal data is not a single legal act. Obtaining records from a service provider, extracting information from a phone, searching a police database, matching datasets, retaining information and transferring it to a foreign authority are legally distinct operations. Lawful initial acquisition therefore does not automatically make every subsequent use lawful. ARGA_D-23_Law_Enforcement_Data_…

The report pays particular attention to digital information and biometrics. EU case law demonstrates that the applicable safeguards depend on the nature of the information and the intensity of the interference with private life. Telephone contents, location histories, IP-related information, fingerprints and genetic data cannot simply be subjected to one universal threshold. Sensitive biometric processing requires an individual assessment of strict necessity rather than automatic collection based solely on a person’s status as a suspect.

The study also examines the EU’s new electronic-evidence framework, including European Production Orders and European Preservation Orders, applicable since 18 August 2026. The mechanism accelerates cross-border access to specified data held by service providers, but it does not create unrestricted police access to providers’ infrastructure. Different categories of data remain subject to different procedural and judicial safeguards. ARGA_D-23_Law_Enforcement_Data_…

For the United Kingdom, the report considers the framework following the Data (Use and Access) Act 2025, including changes affecting logging, international transfers and the relationship between law enforcement and national-security processing. The Police Scotland enforcement episode illustrates another central distinction: lawful possession of information does not automatically make its subsequent disclosure or reuse permissible.

The report ultimately argues that technical capability to access information is not equivalent to unlimited legal permission to use it. Effective protection depends on the ability to reconstruct the entire chain — acquisition, searching and matching, retention, transfer and subsequent use — and to verify the legal basis, purpose, proportionality and safeguards applicable at every significant stage.