The E-evidence Package The Happy Ending of a Long Negotiation Saga

• Date: 19 October 2023
• Author: Gianluca Forlani
• DOI: https://doi.org/10.30709/eucrim-2023-013
• Pages: 68

I. Introduction

Legislative initiatives on e-evidence were presented more than five years ago. After conducting an in-depth assessment and following bilateral discussions with the delegations of the EU Member States, the European Commission published two proposals on 17 April 2018:

• A proposal for a Regulation on the European orders for the production and preservation of electronic evidence in criminal matters;¹

• A proposal for a Directive establishing harmonised rules on the appointment of legal representatives for the purpose of obtaining evidence in criminal proceedings².³

These instruments and the ensuing negotiations faced several complex challenges. One of the main challenges was striking a fair balance between the fundamental rights related to the protection of privacy and the rights of suspects and accused persons on the one hand, and enabling/facilitating investigations and prosecutions of crime on the other.

While even with traditional judicial cooperation instruments, this balance is always difficult to strike, the specific case of e-evidence encountered a further obstacle: the need for a direct relationship between the judicial authority of a prosecuting state (issuing state) and a (private) entity outside its jurisdiction, i.e. a service provider who holds data that may include traces of communications and activities of perpetrators who operate through IT means. Thus, this “e-evidence scenario” deviates from the traditional trilateral relationship on the basis of mechanisms of letters rogatory that require the involvement of the judicial authority of the state where the service provider is located. This resulted in the fundamental question to which extent the judicial authority in the service provider state was to actively be involved . Should the latter simply be obliged to execute the order of the issuing judicial authority? Should it verify the correctness of the activity carried out by the issuing authority? In short, the e-evidence package was a real litmus test for the principles of mutual trust and mutual recognition that kept being invoked and flaunted throughout the negotiations. This raised the more general question of whether “mutual trust” means “blind faith” or “reasoned trust”.

The following section (II.) outlines the background of the internal EU legislative rules on e-evidence and critical issues that emerged during the negotiations; this culminated in the provisional agreement of 25 January 2023 and – after linguistic and technical revision – the final texts that were signed on 12 July 2023 and published in the Official Journal of the European Union on 28 July 2023.⁴ However, the EU’s e-evidence package must also be seen in the context of the overall legal framework on e-evidence at the international level (comprised of the Council of Europe Second Additional Protocol to the Cybercrime Convention, the bilateral negotiations on an EU-US e-evidence agreement, and the starting negotiations on a United Nations legal instrument on cybercrime), to which Section III. is dedicated. Section IV. of this article provides a brief outlook to the next steps of the EU dossier before additional and concluding remarks (Section V.).

II Background and Negotiations of the EU Legal E-evidence Package 1. Challenges/issues of electronic evidence acquisition in the current legal framework

Prior to the new e-evidence package, multiple international cooperation instruments had been used under the EU legal framework for cross-border electronic evidence gathering. These instruments include:

• Directive 2014/41/EU on the European Investigation Order in criminal matters (EIO)⁵;

• The European Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union;⁶

• Regulation (EU) 2018/1727 of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust);⁷

• Regulation (EU) 2016/794 on Europol;⁸

• Council Framework Decision 2002/465/JHA on joint investigation teams;⁹

• Bilateral agreements between the Union and third states, such as the mutual legal assistance agreements in force with the US;¹⁰

• The Council of Europe Convention on Cybercrime (Budapest Convention).¹¹

Yet in practice, these comprehensive and wide-ranging legal cooperation instruments have still failed to adequately address some of the difficulties encountered in the process of obtaining electronic data. One of the most significant obstacles in this context has been the refusal by Internet service providers to make data available in cases where the authority in question lacks jurisdiction over the place of the establishment of its headquarters, or because of the nationality of the affected person for whom data has been requested. More complex problems arise when a case is connected with the legal system of states outside the EU (third states), which is a recurring scenario given that the largest providers of telematic services are based in the United States.¹² In addition to the aforementioned jurisdictional problems, obtaining electronic evidence through judicial cooperation procedures – whether conventional or based on the principle of mutual recognition – has always necessitated the involvement of the (judicial and/or governmental) authority of the executing/requested state. This inevitably causes delays, which is clearly incompatible with the “volatility” of electronic data.

2. The Commission’s two regulatory proposals

With the two proposals listed earlier,¹³ the Commission intended to overcome these shortcomings. Notwithstanding this ambition, they are designed to complement, and not replace, existing judicial cooperation instruments, in particular the EIO. The Regulation aims to simplify and accelerate the process of securing and obtaining electronic evidence stored and/or held by service providers established in another jurisdiction. This objective is to be achieved by directly transmitting the order to preserve/produce data to the representative designated by the service provider, with the latter being obliged to comply by directly handing over the data to the requesting authority. This obligation applies unless there are specific and compelling reasons not to do so, and without being able to oppose reasons related to the place where the data are stored. In turn, the corresponding Directive aims to establish an obligation for service providers offering their services in the EU to designate a legal representative in at least one Member State.

It follows that the relevant procedural mechanisms need to be structured according to general models to make them useful from an operational point of view and ultimately ensure their practical applicability. In other words, the negotiations made it clear that unless speed and efficiency are to be improved with a new European production order, the prosecuting authorities would continue to use the cooperation tools already available.

3. Critical pre-trilogue issues emerged in the Council

Negotiations on the two proposals started in the COPEN Technical Working Group on 27 April 2018 under the Bulgarian Council presidency, and continued under the subsequent Council presidencies. From the outset, the process placed great emphasis on working around the principle of territoriality in the traditional sense, which was achieved by declaring the location of the data to be irrelevant. However, some technical issues immediately emerged as harbingers of several other critical points. These included:

• Potential conflicts with obligations under the law of third countries (and, in this context, the relationship between the proposed new instrument and the US CLOUD Act);

• A possible extension of the subject matter of the Regulation to include direct access to data by authorities and real-time interceptions, which are considered to be extremely relevant investigative tools;

• The question of whether orders should also be served to the relevant authority of the executing state or of another state that has a connection with the case at issue.

The Austrian Council presidency presented a compromise text (which reflected the negotiating efforts of the Member States to reach an agreement) to the Justice and Home Affairs (JHA) Council in December 2018.¹⁴ At this meeting, the Council’s general approach on the draft Regulation was adopted while that on the draft Directive was reached in the JHA Council in March 2019. While the Member States supported the compromise text of the Austrian presidency, some called for subtle changes. For example, two states suggested introducing a more incisive procedure of notifying authorities in the affected persons’ states; others would have preferred a more streamlined procedure that would have seen no other authorities or states notified at all.

4. Pre-trilogue contributions by other institutions

The European Economic and Social Committee adopted its opinion as early as on 12 July 2018. Conversely, the European Parliament (EP) as co-legislator appointed its rapporteur on 24 May 2018. Subsequently, several meetings and hearings were held in the LIBE Committee on the e-evidence proposal, including a public hearing on 27 November 2018.

The LIBE Committee developed amendments to numerous key provisions of the regulation, being in strong contrast with the Council’s general approach. The Committee, inter alia, proposed replacing the Directive and integrating some of its provisions into the Regulation (a solution that casted serious doubts on the appropriateness of the latter’s legal basis). The large number of proposed amendments tabled by the parliamentary political groups, together with the onset of the pandemic, further slowed down work on a final EP position, which was finally adopted as late as in mid-December 2020.¹⁵ The EP’s text was still far from the one that the Council had drafted in its general approach. The EP followed a much more restrictive approach on central issues, such as:

• The prerequisites for issuing...