Notifying the police, the public prosecutor's office or other competent authorities of possible criminal offences or reporting possible criminal offences usually involves the processing of personal data: Example: The owner of a car repair shop informs the police that there is blood on the bumper of a customer's vehicle (bumper case).

For this, Rec. 50 (9)/(10) GDPR clarifies:

“Indicating possible criminal acts or threats to public security by the controller and transmitting the relevant personal data in individual cases or in several cases relating to the same criminal act or threats to public security to a competent authority should be regarded as being in the legitimate interest pursued by the controller. However, such transmission in the legitimate interest of the controller or further processing of personal data should be prohibited if the processing is not compatible with a legal, professional or other binding obligation of secrecy.”