Crime leaves digital traces that can serve as evidence in court proceedings; often it will be the only lead law enforcement authorities and prosecutors can collect. Therefore, effective mechanisms to obtain digital evidence are of the essence. However, present-day solutions too often prove unsatisfactory, bringing investigations to a halt.
To make it easier and faster for law enforcement and judicial authorities to obtain the electronic evidence they need to investigate and eventually prosecute criminals and terrorists, the Commission proposed on 17 April 2018 new rules in the form of a Regulation and a Directive, which will:
- create a European Production Order: this will allow a judicial authority in one Member State to obtain electronic evidence (such as emails, text or messages in apps, as well as information to identify a perpetrator as a first step) directly from a service provider or its legal representative in another Member State, which will be obliged to respond within 10 days, and within 6 hours in cases of emergency (compared to up to 120 days for the existing European Investigation Order or an average of 10 months for a Mutual Legal Assistance procedure);
- create a European Preservation Order: this will allow a judicial authority in one Member State to request that a service provider or its legal representative in another Member State preserves specific data in view of a subsequent request to produce this data via mutual legal assistance, a European Investigation Order or a European Production Order;
- include strong safeguards: the new rules guarantee strong protection of fundamental rights, including safeguards for the right to protection of personal data. The service providers and persons whose data is being sought will benefit from various safeguards and be entitled to legal remedies;
- oblige service providers to designate a legal representative in the Union: to ensure that all providers that offer services in the Union are subject to the same obligations, even if their headquarters are in a third country, they are required to designate a legal representative in the Union for the receipt of, compliance with and enforcement of decisions and orders.
- provide legal certainty for businesses and service providers: whereas today law enforcement authorities often depend on the good will of service providers to hand them the evidence they need, in the future, applying the same rules for access to all service providers will improve legal certainty and clarity.
The new rules are the outcome of a two-year process resulting from strong calls for action by Member States and industry. It included a thorough impact assessment (see here for its executive summary) analysing the problem, the options and the impacts of the various options, supported by extensive stakeholder consultations. The key milestones of the process were:
- In its April 2015 Communication on a European Agenda on Security, the Commission committed to addressing these challenges for investigations into cyber-enabled crimes. This was confirmed in the 20 April 2016 Communication on delivering on the European Agenda on Security to fight against terrorism and pave the way towards an effective and genuine Security Union. In the Communication, the Commission undertook to propose solutions by summer 2017, including legislation if required, to address the problems of obtaining digital evidence in relation to criminal investigations.
- In its Conclusions on improving criminal justice in cyberspace, adopted on 9 June 2016, the Council supported the Commission´s commitment and called on the Commission to take concrete actions based on a common EU approach to improve cooperation with service providers, make mutual legal assistance more efficient and to propose solutions to the problems of determining and enforcing jurisdiction in cyberspace.
- The Council requested the Commission to report on intermediate results by December 2016 and to present deliverables by June 2017.
- The Commission launched an expert consultation process in July 2017 to explore possible solutions and work towards a common European Union position, through the involvement of relevant stakeholders, including private sector, practitioners from the Member States and civil society organisations. This process started with bilateral meetings and small groups and expanded progressively as options were being developed and tested. A first progress report was provided at the 8 December JHA Council.
- A non-paper on the results of the expert consultation process was presented at the 8 June 2017 JHA Council meeting. This document was prepared by the Commission services and cannot be considered as stating an official position of the Commission.
- In addition a more detailed technical document was prepared. This document was not adopted or endorsed by the European Commission. Any views expressed were the preliminary views of the Commission services and may not in any circumstances be regarded as stating an official position of the Commission.
- At the Justice and Home Affairs Council on 8 June 2017, Ministers asked the Commission to proceed with the implementation of the set of practical measures and to come forward with concrete legislative proposals.
- Commissioner Jourová announced her intention to put forward legislative measures for adoption by the Commission in early 2018. On that basis the Commission published an Inception Impact Assessment on 4 August 2017. A public consultation was launched on the same day to collect views of relevant stakeholders. A questionnaire was available for 12 weeks, until 27 October 2017. The results of the public consultation were incorporated in the impact assessment, which was used as the basis to develop the legislative proposals.
In addition to the legislative proposals, the Commission continues to work on the implementation of the practical measures, such as supporting cooperation with service providers and US authorities, in particular through capacity building, as well as the establishment of a secure platform for the swift exchange of requests within the EU.
The EU has also funded a number of projects on these and related issues, including the recently concluded EVIDENCE project. This project was dedicated to the application of new technologies in the collection, use and transmission of electronic evidence.