Providing data to the police
The police may ask you as an organisation to provide data. About your customers, employees or pupils, for example. Or about people in your surroundings. It is important that you handle such a request with due care. The starting point is that you are not obliged to provide data if the police ask for them. This is different if the police demand data based on a statutory regulation. In that case, you are obliged to cooperate.
On this page
Police ask for personal data
You are not allowed to provide personal data to (other) organisations without a good reason. Including to the police. The General Data Protection Regulation (GDPR) applies to personal data.
Do the police ask you for data? Then assess whether you are allowed to provide the data pursuant to the GDPR. Does the provision to the police not meet the requirements of the GDPR? Then you have to refuse the request.
This also applies if the police request data from you as a citizen. For example, images from your doorbell camera.
Liability
People may assume that you do not give their data to the police without a good reason. Do you provide someone's personal data to the police without being allowed to do so? Then that person may hold you liable for this.
Make sure, therefore, that you always ask the police to indicate in writing why you should provide the requested information. Ask for time, if needed, to consider the request of the police. And seek legal advice, if necessary.
Police demand personal data
The police may demand personal data from you. This is different from asking for data. The police are only allowed to demand data in situations listed in the Dutch Code of Criminal Procedure. For example, for solving certain types of crimes.
When the police demand data, you - as an organisation or as a citizen - are obliged to cooperate. In this situation, a number of requirements from the GDPR cease to apply. For example, you do not have to assess whether the provision of data is compatible with the purposes for which you collected these data.
When making a demand, the police must ask explicitly for the data and specify the demand. And they have to be able to explain on the basis of which statutory regulation you have to provide the data. If the police fail to do this, you do not have to cooperate.
Duty to provide information when providing personal data
Do you provide information about certain persons to the police? Then you will often have to inform the persons concerned based on the duty to provide information included in the GDPR. Unless an exception to this duty to provide information applies. Or if you have an obligation of confidentiality after a demand for data.
Exception to the duty to provide information
You do not have to inform the persons concerned if witholding that informatie is necessary, for example, for the prevention, investigation and prosecution of criminal offences. This is one of the exceptions to the duty to provide information to the people concerned set out in Articles 13 and 14 of the GDPR. You have to assess for yourself for each separate situation whether such exception applies.
Obligation of confidentiality
Do you provide data after a demand from the police? In a number of situations, the law stipulates that you have an obligation of confidentiality. This means that you are not allowed to inform the persons concerned that you have passed on their data to the police.
Do you not have an obligation of confidentiality? Then you will have to inform these persons that you have provided their data. Unless an exception to the duty to provide information applies in your situation, in which case you do not have to do this.
Take the right of access into consideration
Persons whose data you process may ask you for access to their data. In that case, you will have to let them know to whom you have provided their data, among other things.
If you provide data to the police, it is advisable to do this in writing. And keep your own records of which data you have passed on to the police.
Note: Does a statutory obligation of confidentiality apply? Then you are not allowed to inform persons who make a request for access that you have provided their data to the police.