Critical Issues in the New EU Regulation on Electronic Evidence in Criminal Proceedings

• Date: 12 October 2023
• DOI: https://doi.org/10.30709/eucrim-2023-015
• Author: Pavlos G. Topalnakos Dr. jur. AUTH
• Pages: 94

I. Introduction

The general objective of effective investigation and prosecution of crimes has always been an essential dimension of judicial cooperation in criminal matters within the EU. In the era of technological advancement, efficient judicial cooperation must include the improvement of cross-border access to electronic evidence. This improvement was initially pursued by Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order (EIO) in criminal matters.¹ However, the collection of electronic evidence through the EIO only focused on the identification of individuals who were associated with a specific telephone number or IP address² and on the interception of telecommunications with the technical assistance of the executing state³. As a result, it became quickly apparent that the EIO fell short of the set targets, because the procedures and timelines prescribed in the EIO proved unsuitable for electronic information,⁴ which is more volatile and subject to swift and easy deletion.

In this context, three new objectives were set: ⁵

• Reducing delays in cross-border access to electronic evidence;

• Ensuring cross-border access to evidence where it is currently missing by means of the EIO;

• Improving legal certainty, protection of fundamental rights, transparency, and accountability.

With this perspective in mind, and after a rather laborious process, final agreement was reached on the European Production Order and the European Preservation Order for electronic evidence in criminal proceedings.⁶ This article will highlight three specific issues that are considered key in the Regulation: First, the new function seemingly attributed to Art. 82 of the Treaty on the Functioning of the European Union (TFEU) that regulates the judicial cooperation of Member States in criminal matters within the EU. Second, the application of fundamental principles that traditionally govern judicial cooperation between states. Third, the legal remedies provided to the individuals who are affected by the issued Orders.

II A New, Previously Unknown Function of Article 82 TFEU

The activation of Art. 82 TFEU in all cases where it was invoked as the legal basis for mutual cooperation between EU Member States led to the establishment of a stable framework involving two judicial authorities: those of the issuing state and those of the executing state. The new Regulation on electronic evidence changes this framework for the sake of a speedy collection of evidentiary material, bypassing the judicial authorities of the enforcing state and allowing direct cooperation between the competent authorities of the state issuing the European Production and Preservation Order and the private sector service providers. In essence, this process allows the authorities of the issuing state to gain direct access to a range of data concerning citizens of other Member States without being subject to scrutiny by the judicial authorities of the enforcing state regarding the conditions for issuing and the overall legitimacy of said Orders. It is worth emphasizing that the granted access may even cover sensitive personal data,⁷ while the power of review lies primarily with the service providers, who, obviously, cannot guarantee the protection of the rights of the individuals affected by these Orders. Moreover, the protection of rights becomes even more precarious when two additional factors are taken into account: First, the execution time for the Orders is relatively short and tight, making it practically impossible to thoroughly verify the adequacy and legitimacy of said Orders.⁸ Second, the threat against service providers of pecuniary sanctions for infringements of the Regulation undoubtedly undermines the "will" to scrutinize the legitimacy of the Orders, as it is rather apparent that the service provider would prefer an "easy" compliance with the Orders over being subjected to the looming threat of pecuniary sanctions.⁹

The Regulation seeks to address these weaknesses by establishing, in its Art. 8, the obligation of the issuing state to inform the competent authority of the enforcing state simultaneously with the transmission of the certificate issued for the Order. However, this notification only concerns the issuance of a European Production Order, not the issuance of a European Preservation Order, and it is furthermore limited to cases where the data submitted are traffic and content data. On the contrary, cases involving data used for the sole purpose of identifying the user and subscriber data do not require notification of the enforcing state.

The characteristics of the new Regulation on European Production and Preservation Orders as described make it clear that the framework...