The law enforcement directive 2016/680 in practice: Transparency, lawfulness and strict necessity. Lessons from Bulgaria
Year: 2026
Type: article
Abstract: The Law Enforcement Directive (LED, Directive (EU) 2016/680) has attracted little public and scholarly attention, despite being the first EU lex specialis governing the processing of personal data for law enforcement purposes by competent national authorities. This paper examines how Bulgaria’s legislative and institutional choices affect the practical enforceability of three connected safeguards: transparency under Article 13, lawful basis under Article 8, and strict necessity for special categories of data under Article 10. It examines whether the Bulgarian framework meaningfully constrains law enforcement processing or instead leaves authorities an excessively broad margin of discretion. Bulgaria is used as a case study because it brings together a particularly revealing combination of features that test the operation of the LED: the fusion of the GDPR and the LED into a single statute, reliance on sectoral bylaws, a split supervisory architecture, and recent CJEU (C-205/21, C-80/23, C-118/22 and C-5/25) and national case law on police registration, retention, and sensitive data. Methodologically, the paper combines doctrinal and normative legal analysis with Bulgarian and EU case law, as well as evidence obtained through fourteen access to public information requests addressed to relevant Bulgarian authorities. The paper argues that the Bulgarian framework weakens these safeguards in three cumulative ways: by leaving information rights underdeveloped and overly restrictable; by relying on generic statutory language and broad sectoral provisions that insufficiently specify purposes and data categories; and by failing to operationalise Article 10’s strict-necessity standard so as to prevent routine and generalised collection of biometric and genetic data, especially in police registration. The paper concludes that Bulgaria illustrates a broader EU-level implementation risk in the formal transposition of the LED, which, by itself, does not ensure enforceable safeguards unless national law translates transparency, lawfulness, and strict necessity into precise duties, reviewable criteria, and effective supervisory routes.
Source: Computer law & security review
Author: Liubomir Nikiforov
Language: English
Field: Social Sciences
Domain: Social Sciences
Open Access status: hybrid
OpenAlex ID: W7166735076
FWCI:
Cites:
Cited by:
Related to: