Data Privacy & Tech

#62024CJ0312EU Court clarifies GDPR rules for adding criminal-investigation data to a police officer’s personnel file

🇪🇺European Union··Other·Medium Impact·View source ↗

AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.

🇬🇧 English

The ruling clarifies when police or public authorities may place information from a criminal investigation into a police officer’s personnel file. Even if the information was first collected for a criminal investigation, using it later for employment or personnel management can fall under the GDPR, not only the law-enforcement data protection directive. For public employers, the practical point is that this kind of recordkeeping needs a clear legal basis in national law and must be necessary for a defined obligation. Officers and other public employees may also seek deletion if the data is no longer lawful, necessary, or properly supported by that legal basis.

AI-generated summary. May contain errors. Refer to official sources for legal decisions.

Key Changes

  • Confirms that later use of criminal-investigation data for personnel management may fall under the GDPR.
  • Requires a clear national legal basis when a public employer records such data to comply with a legal obligation.
  • Links the right to erasure to whether the personnel-file processing remains lawful, necessary, and properly grounded.

Obligations

What this law requires

medium

A public authority’s later recording of criminal-investigation data in a police officer’s personnel file for employment or personnel-management purposes may fall within the GDPR rather than solely Directive (EU) 2016/680, where the processing is not carried out for law-enforcement purposes.

public authoritiespublic employerspolice authorities
operational
high

Processing criminal-investigation data in a police officer’s personnel file must have a clear legal basis in national law and be necessary for compliance with a defined legal obligation under Article 6(1)(c) and Article 6(3) GDPR.

public authoritiespublic employerspolice authorities
operational
medium

A data subject may seek erasure under Article 17 GDPR where personal data kept in a personnel file is no longer lawful, necessary, or supported by the applicable legal basis.

public authoritiespublic employerspolice authorities
disclosure

Affected Parties

police officers and other public employeespolice authorities and public-sector employers+1 more…

Tags

GDPR,law enforcement data,employee records…