Commission welcomes political agreement to strengthen cross-border access for criminal investigations
Brussels, 29 November 2022
The European Commission welcomes the provisional political agreement reached today by the European Parliament and the Council on the new rules for sharing of e-evidence across the EU. This agreement will lead to the formal adoption of a Directive and a Regulation to govern these provisions, following the Commission’s proposal. Currently, the Member States’ authorities must rely on lengthy judicial cooperation procedures to obtain electronic evidence, with the related risks of the sought data being moved or deleted, or on procedures of voluntary cooperation with service providers involving a lack of reliability, transparency, accountability and legal certainty. The new rules will provide national authorities with a reliable channel to obtain e-evidence, while establishing strong safeguards to ensure a high level of protection of the rights of the persons affected.
Modern legislation to ensure reliable, transparent, and swift exchange of e-Evidence with a high level of protection
The Regulation on European Production and Preservation Orders provides a solution for the volatile nature of electronic evidence and its international dimension. It seeks to adapt cooperation mechanisms to the digital age, giving the judiciary and law enforcement tools to address the way criminals communicate today, and to counter modern forms of criminality:
- A European Production Order will be created to allow a judicial authority in one Member State to request electronic evidence through a decentralized IT system, directly from a service provider in another Member State, which will be obliged to respond within ten days, or eight hours in cases of emergency.
- A European Preservation Order will prevent data from being deleted, allowing judicial authorities in one Member State to oblige a service provider in another Member State to preserve specific data, and to request it at a later time. Both orders can only be issued in the framework of criminal proceedings and to localise convicts that are evading justice.
- The new rules include strong safeguards and remedies to guarantee the protection of fundamental rights and of personal information, such as imposing additional requirements to obtain certain categories of sensitive data. In cases where a person does not reside in the issuing State or the offense has not been committed there, Member States must notify the national authority where the service provider is located when they are seeking to obtain traffic and content data. The notified authority can invoke several grounds to refuse the order, such as the protection of fundamental rights or of immunities and privileges.
- Increased legal certainty for businesses and service providers. Law enforcement authorities often depend on service providers’ willingness to disclose the evidence they need on a voluntary basis, which creates uncertainty and procedures which could differ significantly among companies. The Regulation provides a clear legal framework setting out rights and obligations of service providers and imposes a sanction of up to 2% of total worldwide turnover for failure to comply with European Preservation and Production Orders.
The Directive on the appointment of legal representatives for the gathering of electronic evidence harmonises rules on appointment of legal representatives or designated establishments by:
- Mandating all services providers offering services in the Union to designate a legal representative or a designated establishment to receive, comply with, and enforce requests to gather electronic evidence;
- Allowing its provisions to be used for several instruments, in particular for European Production Orders, European Investigation Orders, the Convention on Mutual Legal Assistance, and domestic orders.
Next steps
The European Parliament and the Council will need to formally adopt today’s political agreement.Once published in the Official Journal, the Regulation will enter into force 20 days after publication in the Official Journal of the European Union and shall enter into application three years after that. The Directive will enter into force 20 days after publication and Member States will then need to transpose the new elements of the Directive into national law within two and a half years.
Background
In the context of a tragic wave of terrorist attacks in Europe, EU Ministers for Justice and Home Affairs called for concrete action based on a common EU approach to secure and obtain digital evidence more efficiently and effectively. In the 2015 European Agenda on Security, the Commission committed to reviewing obstacles to criminal investigations. The European Parliament similarly highlighted the challenges that the currently fragmented legal framework could create for service providers seeking to comply with law enforcement requests and called for a European legal framework, including safeguards for the rights and freedoms of all concerned.Many Member States had adopted measures at the national level, resulting in widely varied approaches across the Union. Measures ranged from expanded enforcement jurisdiction to the obligation to designate a legal representative for service providers in the territory of the relevant Member State. Member States also applied a number of different connecting factors to assert jurisdiction over a service provider. In addition, there were disparate cooperation mechanisms and informal agreements between the authorities of some Member States and service providers.Non-EU countries have also been developing their own approaches to address the problems faced by authorities in their criminal investigations. New rules have been developed in this area by means of a Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime.In 2018, the Commission presented a proposal to make it easier and faster for law enforcement and judicial authorities to obtain the electronic evidence they need to investigate and eventually prosecute criminals and terrorists.For More InformationE-evidence – cross-border access to electronic evidence | European Commission (europa.eu)Factsheet_E-evidence.pdf.pdfEC AV PORTAL (europa.eu)
Quote(s)
I welcome today’s agreement on the Commission’s proposal on e-Evidence. New rules are urgently needed in today’s judicial landscape. In the second half of 2020 alone, EU Member States made more than 100,000 requests for e-evidence to the biggest online service providers. With the European Production Order, Member States will have a reliable channel to obtain e-evidence swiftly with robust safeguards for the rights and freedoms of all affected.
—
The new rules on e-evidence are urgently needed to allow our judicial and law enforcement authorities to operate effectively in the fight against terrorism, cybercrime and other serious forms of crime. Criminals often remain anonymous in a borderless internet, which results in impunity. Our authorities will now be able to operate more effectively, while a high level of protection of persons involved is ensured. Today’s agreement on e-evidence is a win-win situation for our authorities and for the protection of fundamental rights, including for the victims of crime.
-
Notifications sent to member states where service provider is located
-
Possibility to refuse an order when there are fundamental rights concerns
-
Data protection rules must be respected and data controllers notified
On Tuesday, EP and Council negotiators reached a political agreement on core elements of a package on requesting electronic data for criminal investigations from elsewhere in the EU.
After negotiations on June 28, a political agreement was reached on core elements of the legislative package on collecting and preserving electronic evidence (“e-evidence”) across member state borders in the EU. The new legislation would allow national authorities to request evidence directly from service providers in other member states, or ask that data be preserved for future use. The new rules would also mandate companies to appoint EU legal representatives to deal with electronic evidence requests in a centralised way.
Fundamental rights in focus
In the negotiations, Parliament sought to ensure that criminal investigations become more efficient, while fundamental rights and EU data protection rules are respected. Parliament secured a requirement to notify the authorities in the member state where the service provider is located, for traffic and content data, except for situations where the suspect resides in the issuing member state and the crime is committed there. Orders can be refused on certain grounds, notably when there are concerns about fundamental rights. In addition, the protection of media freedom and journalists was one of the main priorities of the Parliament.
Co-legislators also agreed on the rules on the reimbursement of costs and sanctions that could be imposed to the service providers in case on non-compliance. Finally, it was agreed that orders would be communicated through a specific, secure IT system.
Quote
Rapporteur Birgit Sippel (S&D, DE) said: “As everyday life moves online, criminal activity also takes place more online, meaning that electronic evidence is increasingly important. But, accessing this evidence across borders can be a lengthy and cumbersome process, and data is too often deleted in the process. Today’s provisional agreement on the main elements of the package means that national authorities can make a direct request to service providers in other Member States to hand over or secure electronic evidence. As a long-standing advocate for the protection of personal data, I fought hard to secure safeguards that mean investigating authorities have to inform the target country’s authorities where the most sensitive data, traffic and content data, are concerned and give them an opportunity to refuse an order in specific circumstances, in particular where fundamental rights are at stake, while the service provider has to preserve the data. Parliament also made it clear that service provider will have the right to raise concerns to both the issuing and the enforcing State, for example, where the right to freedom of expression is at stake.”
Next steps
The negotiating teams will still have to agree on outstanding aspects of the package, which consists of a regulation and a directive. Then, the European Parliament and the Council of the EU will have to formally adopt them.