Dissertation committee:
Νικόλαος Δημητράτος, Αναπληρωτής Καθηγητής Νομικής Σχολής ΕΚΠΑ (Επιβλέπων)
Χρίστος Χ. Μυλωνόπουλος, Ομότιμος Καθηγητής Νομικής Σχολής ΕΚΠΑ (Μέλος της Τριμελούς
Συμβουλευτικής Επιτροπής)
Μαρία Π. Κρανιδιώτη, Αφυπ. Αναπληρώτρια Καθηγήτρια Νομικής Σχολής ΕΚΠΑ (Μέλος της Τριμελούς
Συμβουλευτικής Επιτροπής)
Γεώργιος Τριανταφύλλου, Αναπληρωτής Καθηγητής Νομικής Σχολής ΕΚΠΑ
Ιωάννης Ανδρουλάκης, Επίκουρος Καθηγητής Νομικής Σχολής ΕΚΠΑ
Γεώργιος Γιαννούλης, Επίκουρος Καθηγητής Νομικής Σχολής ΕΚΠΑ
Βασίλειος Πετρόπουλος, Επίκουρος Καθηγητής Νομικής Σχολής ΕΚΠΑ
Summary:
This doctoral thesis deals with the subject of the processing of personal data during the criminal justice procedure, throughout all of its stages, all along from the collection of evidence for the purposes of revelation and investigation of criminal acts, till the imposition and determination of penal sanctions. Although the Data Protection Law has recently gained the immense interest of the scientific and academic community –more so with regard to the implementation of the General Data Protection Regulation (GDPR)-, the subsection of the processing of personal data for the purposes of administering criminal justice remains its most "neglected" aspect; both in terms of legislation, as it has only recently been thoroughly regulated at the EU level, and in terms of scientific study and research, due to its complexity, its constant changes and its extremely technical, fragmented nature, as De Hert & Sajfert observe in their article "Police, privacy and data protection from a comparative legal perspective". This topic offers numerous and diverse issues for analysis and the relevant literature is rich, notwithstanding scattered, as there is a lack of an aggregate, systematic and complete examination of the processing of personal data for the purposes of criminal law in the domestic literature. Hence, it was deemed necessary to provide an overall and comprehensive presentation and analysis of this issue, based on the thorough study of the legislation and case law and the relevant Greek and foreign bibliography. The purpose of the thesis is to examine the positive aspects, the shortcomings and the contradictions of the recent legislative framework of the protection of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, to highlight the technical, legal and ethical problems stemming from the processing of such data by law enforcement and judicial authorities, and to draw sectional and overall conclusions. It is noted that the topic of penal protection of personal data is not included in the thesis.
The first chapter of the thesis consists of a detailed presentation and a critical overview of the current European and Greek legal framework of the protection of personal data used in the course of administration of criminal justice, as it was formed after the enforcement of the GDPR and the Directive 2016/680 on the processing of personal data by the competent law enforcement authorities. The initial and most extensive section of the first chapter deals with the European and EU legislation, which is presented in detail, coupled with an analytical commentary, and compared to the previous legal regime. Meanwhile, there is a brief analysis of article 8 of the ECHR, which entails the individual right to the protection of personal information, and an overview of the most important decisions of the ECtHR on the subject. Consequently, in the second section of the first chapter, there is a presentation of the current Greek legal framework on the processing of personal data, after the modifications of the Law 4624/2019 and its amendment by the Law 5002/2022, as well as an examination of some specific issues of personal data, mainly of an ethical nature, that arise during the criminal procedure, such as the access to a penal case file, the publication of criminal verdicts and information concerning criminal prosecutions and convictions and the wide publicity of criminal trials that gather the interest of Mass Media.
In the second chapter, the study focuses on the processing and movement of personal data by the European Union and its services for the purposes of battling crime, and the relevant legal framework after the introduction of Regulation 2018/1725 is listed in detail, as well as the ways of collection and exchange of personal data between the prosecuting authorities of the member states. In particular, this chapter elaborates on the majority of operational databases and the automated information exchange systems, which form a highly complex network, ruled by multiple legal regimes that are simultaneously applied; the aim of this analysis is to demonstrate the complicated and fragmented nature of the data circulation and the problems caused by the aforementioned complexity. Furthermore, reference is made to the intention to expand and interconnect these informational systems, leading to a kind of common ownership of data by multiple services which have been set up for different purposes.
The third and final chapter of the study focuses on three specific categories of personal data, which are intensively processed by police authorities in the context of fighting crime: biometric data, travel data and telecommunications data. These three categories of data are closely related to natural persons and are massively produced in the everyday life of all European citizens, thus their collection raises serious legal and ethical issues regarding the surveillance of the individuals in neutral, daily activities, since they might be used for criminal investigation purposes or criminal profiling. These issues are approached through the study of the existing legislation, of the voluminous case law of the CJEU and of examples from third-country jurisdictions. Finally, there is an attempt to draw conclusions and thoughts concerning the future of mass surveillance of citizens in everyday life, aiming not only at the detection and fighting crime, but also its prediction.
In the end, there is a summary of the conclusions drawn from the entire study, and proposals regarding the future of the processing of personal data by law enforcement authorities.
Ultimately, it is noted that in this thesis, I took into account the legal texts and the case law of the ECtHR and CJEU issued up to the date of July 31st 2022, and the Greek legislation in force up to December 31st 2022.
Keywords:
Personal data, processing of personal data by law enforcement authorities, processing of personal data for the purposes of prevention investigation and prosecution of criminal offences, processing of personal data during the criminal justice procedure, databases, profiling, personal data flows, PNR data, telecommunication data, interoperability, familial searching, proactive policing, Intelligence Led Policing, Risk-Need Assessment (RNA) Tools, big data, bulk data, data mining, GDPR, LED Directive, EUROPOL, Eurojust, FIUs, SIS, Frontex, Eurodac, EES, ETIAS
