The gathering of publicly available online information is nowadays part of ‘most police investigations’. Some call this information the ‘new social DNA’ for law enforcement. Indeed people publish massive amounts of information about themselves on the internet on a voluntarily basis. At the same time other people can also publish information about individuals on the web. Law enforcement authorities make use of this information to fulfil their tasks, such as maintaining public order, and as a source of information in criminal investigations. In this blog post I submit that Dutch law enforcement authorities and the Public Prosecution Service should publish their policy on the use of publicly available online information in criminal investigations.

Accessibility and foreseeability

A policy on the use of privacy-interfering investigative methods should be accessible and foreseeable to the individuals involved. Accessibility means that a guideline or regulation is published and made publicly available to individuals to take notice from. Foreseeability means that the scope of investigative methods and the manner they are applied are clear to the individuals involved. An arbitrary interference by governmental authority powers in the private lives of individuals can be avoided with a foreseeable legal framework.

Murky legal basis

At the moment it is likely that the gathering of publicly available online information takes place on the legal basis of law enforcement officials’ statutory task description for the investigation of crimes (art. 3 of the Dutch Police Act). This is implied in legislative history (the explanatory memoranda on the Act on special investigative powers and the Computer Crime Act II). Although these acts go back more than 15 years - at a time when the Internet looked very different and social media services were not as popular - this is the only legislative history available. In addition a court in The Hague decided in 2011 that law enforcement officials can make use of Google Earth on the basis of art. 3 Police Act.

However this legislative history and court decision become murky when they explicitly mention that “information cannot be gathered systematically and stored in police systems” upon the basis of art. 3 of the Police Act. When exactly is information gathered systematically about individuals? Is it when a “more or less complete picture of certain aspects of an individual’s private life” is obtained? And then what? What special investigative powers apply? Shouldn’t the investigative activity be part of the task of law enforcement officials, to gather the necessary data they require for a criminal investigation without the application of special investigative powers?

Online observation

When law enforcement officials observe the online behaviours of individuals the special investigative power of ‘systematic observation’ applies. The Dutch legislature suggested at the time that factors such as the duration, place, intensity, frequency and the use of technical devices should be taken into consideration to determine whether the behaviours of individuals are observed ‘systematically’. Still, these abstract factors were originally written for application in the physical world and provide a lot of leeway for law enforcement officials and public prosecutors to decide when application of the special investigative power of systematic observation is required.

Data protection regulations

It is clear however that data protection regulations on the gathering of personal data restrict the investigative activity. Data protection regulations apply as soon as law enforcement officials look for the information on their computers or use an automated data collection system, to gather the information. These regulations thus apply at an earlier stage than when the results of the search are stored in police systems. Earlier research (see for instance this report and this report (in Dutch)) raises questions about how automated data collection systems meet key principles of data protection regulations. Yet these questions remain unanswered by law enforcement authorities and the legislature.

Conclusion

We – the people – require an explanation of how and under which conditions law enforcement authorities gather publicly available online information. Interestingly, in a 2016 master thesis (.pdf in Dutch) an internal procedure on the ‘gathering of data from social media services’ is mentioned. If such a policy indeed exists, but is not made available to the public, the law is not accessible and foreseeable to the individuals involved. For that reason I urge Dutch law enforcement authorities, the Public Prosecution Service and the Dutch legislature to make such a policy public. If such a policy does not exist, a guideline should be developed and published online as soon as possible.