Law enforcement often accesses personal data collected by private companies, but the current data protection laws may not fully protect individuals. The new 'police' Directive, which regulates law enforcement data processing, may not have enough safeguards for people. The Directive does not meet the standards set by the ECJ regarding data retention and access by police. The principle of purpose limitation may not be effective in preventing data misuse by law enforcement. Solutions are needed to improve the safeguards in the Directive.