“The police keeps everything, about everyone, indefinitely. That is against the law,” an article by Follow the Money (FTM) headlined last month. It is one of many examples of the police disobeying the law. And, as FTM's research shows, the police doesn't do this by accident, but knowingly. A clear account of institutional arrogance.

We have laws for a reason. If laws didn't matter, breaking them wouldn't be an issue either. Data protection laws protect not only our data, but also ourselves. When the law requires the police to destroy data, it does so to protect us from abuse. Abuse of our data not only by malicious actors who could obtain it, but also - or especially - by the police themselves. Law enforcement agencies are known for their tendency to use the data they have, even for purposes other than those for which they were collected. And even when that is not allowed. This is also how the police's massive facial recognition database, CATCH, once started.

The risk of abuse of data is not the only thing the law protects us from. According to FTM's article, the police's policy to not destroy data was based on an agreement with the minister. And that is dangerous. Laws should prevail over such agreements. The law reflects the consideration of how far we think the police should be allowed to go, and where we think the infringement on our fundamental right to privacy is too great. When the police overstep their bounds, their actions lose democratic legitimacy. And when a minister single-handedly determines how far the police may go, this leaves democracy vulnerable to authoritarian rule.

The question that comes to mind, is: who protects us from the police? If we can't count on the law, perhaps it's the institutions that oversee the police? The Dutch Data Protection Authority (AP) has known since 2019 that the police store data unlawfully. Now it appears that the police misled the AP about its reasons and deliberately chose to ignore the law. One would think such a discovery warrants a strong reaction. Rather, the AP has asked for clarification. Ask the liar if he is lying...

When the police, as it turns out the Dutch police do, systematically do not abide by the law and not only keep data a little longer, but simply do not destroy it, it is a matter of time before they have data on all of us. And a matter of political whim what they will do with it. The rule of law is supposed to protect us against precisely this type of risk and arbitrariness. But who can we count on to uphold it?