The article examines the “data protection gap” in EU law concerning the transfer of personal data from private companies to law enforcement authorities for criminal investigations. While commercial data processing falls under the proposed regulation and police/judicial processing under the proposed directive, transfers between the …