'Policing Agency Data Trusts' by Barry Friedman in Northwestern University Law Review (Forthcoming 2026) comments
Policing agencies are indiscriminately collecting, retaining, and using vast quantities of personal data from people who are suspected of no unlawful conduct whatsoever. This has caused expressions of concern or caution from many quarters, including—notably—the Director of National Intelligence. In a recently-declassified report, the Office of the DNI stated that massive amounts of data are being collected “on nearly everyone that is of a type and level of sensitivity . . . that could be used to cause harm to an individual’s reputation, emotional well-being, or physical safety.” This practice of universal data collection has been the topic of intense debate, because it presents a conundrum. As many have argued, it poses the risk of serious harms: racial bias, violations of personal privacy and security, erroneous targeting of innocent individuals, and even the threat that the data will fall in the hands of hackers, or authoritarian leaders. At the same time, those who favor such collection maintain that the data, properly used and analyzed, holds out hope of enhancing public safety by locating serious law violators, and preventing dangerous threats. This Essay offers up a novel solution to the conundrum posed by the collection, retention and use of personal data: policing agency data trust. These data trusts would allow capturing the supposed benefits of collection, while minimizing or mitigating entirely the harms. The idea of a data trust first arose in response to private companies monetizing personal data. Even if data is used by private companies or governments for beneficial purposes, there still are sharp debates over the legitimacy of such uses, given that they occur without meaningful consent by individuals to the use of their personal data. There now is a small but growing body of literature—and even some experimentation—suggesting data trusts could be employed to allow data creators to maintain control over their data and how it is used. Data trusts are legal instruments that allow data creators to instruct trustees on how their data may be used; the trustees ensure in turn the data is used in no other ways. This essay turns the idea of data trusts to the problem of policing agency indiscriminate collection, retention, and use of personal data. Data that is collected would be held outside policing agency hands. Those agencies could query the collected data only according to legislative authorization and regulations established by independent data trustees. Requests would be vetted through data stewards, and only those requests consistent with governing law and rules would be permitted. Further, use of the data would not be limited to law enforcement. Rather, the data would be available to others to query—including defense counsel, but also researchers seeking to learn about policing in ways that have been closed to them through a lack of transparency.