Open Source Data and Criminal Investigations: Anything You Publish Can and Will Be Used Against You

Abstract

Various misconceptions exist regarding open source data, what is meant by this term and how these data can legally be used. This contribution focuses on developing a comprehensive definition of the term and highlights the differences with similar – often confusing – concepts. The fact that open source data are publicly available does not mean that they can be used and processed in any way or for any purpose. As far as open sources contain personal data, the general data protection legislation (national as well as EU and Council of Europe legislation) is applicable. Several difficulties however arise, especially when different types of data are mixed.

This can happen in the context of a criminal investigation. The use of personal data for the purpose of prevention, investigation or prosecution of criminal offences is protected by more specific legal provisions to protect the secrecy of the investigation as well as the fundamental rights of the suspect and the victim(s). The fair trial rights of article 6 ECHR should be respected once a criminal charge has been made.

Open source data are vulnerable for abuse by any individual. Additionally, they are widely available and distributable when the internet is used. In several instances open source data have been used for the purpose of vigilantism (individuals taking law enforcement into their own hands). It is important to draw the line between a legal use of open source data, including the use of open source data for the purpose of a criminal investigation and the illegal use of open source data.

This contribution combines the elements of open source data, personal data and criminal investigations. Answers to the following research questions are sought:

– What are open source data?

– How to protect personal data included in open source data?

– How to use open source data in criminal investigations while respecting data protection legislation?

Keywords: Data Protection; Information Exchange; Open Source Data; Right to be Forgotten

JEL Classification: K33, K39