Frequently Asked Questions: New EU rules to obtain electronic evidence

What are the current procedures to access e-evidence in cross-border situations?

Currently, law enforcement and judicial authorities cooperate to obtain electronic evidence by using mutual legal assistance procedures outside the European Union or the European Investigation Order inside the European Union. However, these judicial cooperation tools are often too slow and cumbersome for obtaining electronic evidence, which can be transferred or deleted at the click of a mouse.

Voluntary cooperation between law enforcement and service providers based in the United States has developed as an alternative way of obtaining electronic evidence. This form of cooperation is generally faster than judicial cooperation, but service providers have different ways of handling requests for disclosing electronic evidence, and the process lacks transparency, accountability and legal certainty.

What safeguards will be put in place to protect fundamental rights and freedoms?

The proposal contains strong safeguards to guarantee privacy, data protection and the right to judicial redress.

Issuing of European Production or Preservation Orders will only be possible in the context of criminal proceedings. All existing criminal law procedural rights will apply, including relevant legislation at EU level such as the right of access to a lawyer and the right of access to the case file. The proposal establishes an obligation for authorities to obtain approval of all orders from a judicial authority, to ensure that their legality, necessity and proportionality have been checked.

Production orders to produce transactional (source and destination of a message, data on the location of the device) or content data (text, voice, videos or images) may only be issued for criminal offences punishable in the issuing State by a maximum sentence of at least three years, or for specific cybercrimes and terrorism-related crimes defined in the proposal.

Personal data covered by this proposal is protected and may only be processed in accordance with the General Data Protection Regulation and the Police Directive, both of which enter into application as of May 2018.

Will it be mandatory for service providers to produce electronic evidence?

Yes, the European Preservation Order and the European Production Order are legally binding.

This will improve legal certainty compared to the existing voluntary cooperation, which creates challenges for service providers seeking to comply with law enforcement requests. It will also give law enforcement and judicial authorities more certainty to obtain the e-evidence they need.

The proposal allows service providers to seek clarifications from issuing authorities where necessary and to oppose the execution of orders in certain situations. In addition, a specific procedure has been put in place for situations where the obligation to produce data conflicts with a competing obligation arising from a third-country law. Service providers can raise an objection based on such conflicting obligations, triggering a judicial review.

Where the law of the third country protects fundamental rights or fundamental interests of the third country, the judge should normally lift the Order after consultation of the third country's authorities. Where the law of the third country protects other interests, the judge will have to balance the interests at stake. In both situations, the data should be preserved by the service provider.

What is the proposal on legal representatives about?

Currently, there are different approaches across Member States regarding obligations imposed on service providers, especially in criminal proceedings and for service providers which do not have an establishment in the Union. This fragmentation creates legal uncertainty for those involved and can place service providers under different — sometimes conflicting — obligations.

The proposal obliges service providers to designate legal representatives in the EU ti facilitate the receipt of , compliance with enforcement orders to gather electronic evidence on behalf of these service providers.

This will remove the need for individualised national approaches and provides legal certainty at EU level. In addition, a uniform approach creates a level playing field for all companies offering the same type of services in the EU, regardless of where they are established. Moreover, it does not affect companies' freedom to store the data where they choose to.

Which service providers will be covered by the proposals?

The legislative proposals include obligations for providers of services that are used for communication purposes (including providers of telecommunications services and other electronic communications services, including interpersonal communications services). In addition, the proposals will also apply to providers of information society services that facilitate interactions between users and that are used for the storage of data (including online marketplaces that facilitate peer-to-peer transactions and providers of cloud computing services) and for providers of internet infrastructure services (including registries that assign domain names and IP addresses important for the functioning of the internet).

The Commission proposal would apply to these providers when they are offering services in the European Union. According to the proposals, a provider is offering services in the European Union when he enables users in one or more Member States to use its services and where he has a substantial connection to the Union, for instance when it has an establishment in a Member State or because he provides services to a large number of users in that Member State.

What will happen if the data is stored in a non-EU country?

There is a difference between where the data is stored and where the service provider is based. The service provider might be based in a third country, but the data might be stored in the EU, even in the country of the investigating State. Still, under the current system the judicial authorities have to address a request via mutual legal assistance to the service provider in the third country. This would change under the proposal.

The Regulation departs from data storage as the determining factor for jurisdiction, and rather requires that the requested data is (1) needed for a criminal proceeding for which the issuing authority is competent and (2) related to services of a provider offering services in the Union. If this is the case, the data must be preserved and produced, irrespective of the place of data storage

In case a service provider is confronted with conflicting obligations deriving from the law of a non-EU country when evidence is requested, the proposal foresees a review procedure to clarify such a situation. Ultimately the decision whether to uphold the request will be up to the competent national court.

A service provider who stores data relating to its European users outside of the EU, e.g. in the US, will thus have to provide data to European authorities if addressed with a European Production Order, unless there is a conflict with a third-country law.

For More Information

Press release

Factsheet

MEMO/18/3345