In addition to the General Data Protection Regulation (AVG), there is a separate directive for data protection by police and judicial authorities (Directive EU 2016/680).(1) This directive provides rules for the processing of personal data by competent authorities for the prevention, investigation, detection and prosecution of criminal offenses and the execution of sentences. In the Netherlands, as of January 1, 2019, the Directive has been implemented in the Police Data Act (Wpg) and the Judicial and Criminal Procedural Data Act (Wjsg) including the decrees under it.(2)

Wpg

The Wpg regulates the processing of personal data for the performance of police duties by, among others, the police and the special investigation services (BOD), which also includes special investigating officers (boa's). The Personal Data Authority (AP) oversees the Wpg.(3)

• 
  Police
  
  : The police use all kinds of data to perform police tasks properly. This is only allowed for a specific purpose and the processing of these personal data must be necessary to achieve that purpose. Only in exceptional cases may the police record special personal data - such as religious belief, race, health and political preference. This is only allowed if it is unavoidable to perform the police task in question.

• 
  Boas
  
  : the Wpg also applies to data processing by Boa's for the performance of their investigative duties. This is regulated in the associated Police Data for Extraordinary Investigating Officers Decree (BpgBoa). This concerns the detection of criminal offenses. For boas, too, police data may only be processed for specific purposes, as described in the Wpg.

The Wpg also includes an obligation for organizations processing police data to appoint a data protection officer (FG). The FG must be registered with the AP.(4)

AVG

The Wpg and the General Data Protection Regulation (AVG) coexist. The police and boas also process personal data that are not necessary for the performance of their police or investigative duties, but to perform supervisory tasks, for example. These processing operations are not subject to the Wpg but to the AVG.(5)

Footnotes

(1) Directive (EU) 2016/680
(2) https://www.autoriteitpersoonsgegevens.nl/nl/over-privacy/wetten
(3) https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/politie-justitie/bijzondere-opsporing
(4) https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/algemene-informatie-avg/functionaris-gegevensbescherming-fg
(5) https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/politie-justitie/politie