Nowadays, our lives have become increasingly intermediated by digital technologies. We communicate via smartphones, social media platforms and conduct business through online marketplaces. While these services provide excellent opportunities for generating economic and social wealth, they are also frequently misused for criminal activities putting law enforcement agencies before unprecedented challenges. As many aspects of our lives become digitalised, so does crime and the evidence needed to prosecute it. However, due to the internet's borderless nature, data relevant to a criminal investigation in one country is not permanently stored in the same region. Neither does the service provider necessarily have legal representation in that country. Law enforcement agencies thus frequently require access to data outside of their national jurisdictions.
Traditionally this challenge has been addressed through cooperation agreements between national law enforcement agencies, which ensured that they could rely on each other to obtain and share the relevant data for criminal investigations. However, these mechanisms have been criticised as slow and fragmented and were not designed with today's technologies in mind. There is thus a widening divide between existing legal mechanisms for obtaining e-evidence from abroad and the reality that e-evidence is nowadays used in 85% of proceedings and needs to be requested from other jurisdictions in two-thirds of the cases.
The EU Commission has recognised this problem. In April 2018, it presented a proposal for the Regulation on European Production and Preservation Orders for electronic evidence in criminal matters, known as the E-Evidence Regulation. It aims to harmonise and ease the gathering of e-evidence across jurisdictions within the Union and - if successful - will be supplemented by the Directive on the appointment of legal representatives to gather evidence in criminal proceedings.
The proposal has two novel mechanisms at its core: European Preservation Orders and European Production Orders. A preservation order compels the service provider to preserve e-evidence and prevent its deletion, while the production order demands the delivery of the relevant data to the requesting authority. Both can be directed at any information service providers "offering services in the Union and established or represented in another Member State." (Art. 2(1 & 2)) In most cases, the orders can be issued by a court, judge or prosecutor. However, for production orders, the proposal differentiates based on the type of data that is requested. Where "transactional and content data" are sought, the order can only be issued by a court or judge (Art. 4(2)). In cases that only require basic information about a service user or their access to the service, the order can also come from a prosecutor (Art. 4(1)).
The nature of the data is also relevant depending on the nature of the offence being investigated. According to Art. 5(4), transactional and content data can only be requested to investigate criminal crimes punishable by at least three years maximum imprisonment or unique offences laid out in the regulation (e.g. relating to terrorism). For less serious violations, the production order can only request subscribers and access data considered less intrusive. Additionally, all orders require an assessment of necessity and proportionality according to the meaning under EU law. A service provider must comply with an order within either ten days or even six hours in emergencies, thus significantly speeding up the gathering of e-evidence, which by traditional mechanism requires an average of ten months.
As a safeguard against misuse, service providers have a review procedure available in case of conflicting obligations deriving from the law of a third country and the option to refuse an order which they consider manifestly abusive or in contradiction with EU fundamental rights.
However, the proposal has met significant resistance amongst civil society groups that fear that the safeguards it contains are insufficient to address the grave risks for fundamental rights. Especially the right to privacy, freedom of press and speech, and the right to a fair trial are thought to suffer under the current proposal. Furthermore, it has been criticised that individuals subjected to a production order are categorically not informed that such an order has been issued against them, which impairs their ability to defend themselves under the rule of law. It is also feared that production orders could lead to the accidental and unjustified disclosure of personal data. The European Data Protection Supervisor thus issued an opinion stressing the importance of adhering to EU data protection principles and other fundamental rights. Lastly, some have voiced concerns that production orders could be misused to suppress political dissidents, and there have thus been calls for a requirement to inform or even consult the affected state of issuing a production order.
Whether more stringent safeguards will make it into the final version of the E-Evidence Regulation remains to be seen. Interinstitutional trilogies are currently taking place between the Commission, the Council, and the Parliament. Moreover, civil societies continue to take a strong interest in developing the legislation advocating for strict respect for fundamental rights. While the objective of the regulation is without a doubt an important one, it could well be that the legislation ends up sacrificing core principles of the European Community in the name of security in the digital age.
Comments