The Use of Electronic Evidence in the European Area of Freedom, Security, and Justice An Introduction to the New EU Package on E-evidence

• Date: 19 October 2023
• Author: Adam Juszczak,Elisa Sason
• DOI: https://doi.org/10.30709/eucrim-2023-014
• Pages: 76

I. Introduction

While it is common knowledge that digitalisation brings numerous benefits to our societies and economies, criminals are massively (mis-)using digital technologies to plan and commit criminal offences. Ensuring a high level of cybersecurity for digital products and services and having in place adequate tools for law enforcement authorities to investigate and prosecute criminal offences are ultimately two sides of the same coin. Recent developments, such as the COVID-19 pandemic and Russia’s war against Ukraine, reaffirm the need for the EU to protect its citizens against the exploitation of known and new vulnerabilities, in full respect of fundamental rights. Prevention, detection, and enforcement form key components of the EU’s security architecture.¹

In the aftermath of the 2016 terrorist attacks, the Council adopted conclusions on improving criminal justice in cyberspace.² In these conclusions, the Commission was requested inter alia

“to develop a common framework for cooperation with service providers for the purpose of obtaining specific categories of data, in particular subscriber data, when allowed by third countries legislation, or any other comparable solution that allows for a quick and lawful disclosure of such data” and “to find ways, in association with Member States and, where necessary, third countries, as a matter of priority, to secure and obtain e-evidence more quickly and effectively by streamlining the use of mutual legal assistance proceedings and, where applicable, mutual recognition.”

Similarly, in its Resolution of 2017,³ the European Parliament called on the Commission to put forward a European legal framework for e-evidence, noting that “a common European approach to criminal justice in cyberspace is a matter of priority, as it will improve the enforcement of the rule of law in cyberspace and facilitate the obtaining of e-evidence in criminal proceedings.”

To ensure that judicial and law enforcement authorities can obtain electronic evidence across the EU and beyond in a swift and legally sound manner for the purpose of investigations and prosecutions in criminal cases, the Commission proposed on 17 April 2018 a legislative package⁴ composed of a Regulation on European Production and Preservation Orders and a Directive on the appointment of legal representatives. According to the Commission, cross-border access to electronic evidence for criminal investigations is needed in 85% of investigations, with 65% of the total requests going to providers based in another jurisdiction.⁵ The volatile nature of electronic evidence makes access by law enforcement authorities essential, particularly in view of presenting it as admissible evidence before courts. Compared to traditional mutual recognition instruments, the novelty of these proposals is that orders may be directly addressed to a representative of a service provider in another Member State, without the authority of that other Member State being systematically involved in the process.

Having an internal EU framework in place – ideally followed by its proper application in practice – is, however, not the end of the story. Ensuring coherence and consistency between the EU’s e-evidence rules and international agreements already agreed or still under negotiation, such as the Second Additional Protocol to the Budapest Convention of the Council of Europe, the United Nations Cybercrime Convention, and the EU-U.S. e-evidence agreement, is pivotal for the legal certainty of all stakeholders affected by this newly adopted framework.

This article provides a short background on the negotiations concerning the e-evidence proposal package (section II), outlines the key elements of the enacted e-evidence package (section III), and illustrates the implications of the new set of rules for stakeholders (section IV). It also touches upon existing links with international agreements (section V) and ends with a number of concluding remarks (section VI).

II Negotiations and Adoption of the E-evidence Package

Following the adoption of the Commission’s proposal in 2018, it took five years for co-legislators to agree on this package. The proposal was welcomed and garnered support for having in place faster tools for obtaining electronic evidence, but it also faced criticism in the form of warnings not to lower existing standards, particularly as regards the protection of fundamental rights.⁶

It is telling that seven Member States, including Germany and the Netherlands,⁷ could not support the General Approach adopted by the Council in December 2018.⁸ In addition, the high number of amendments proposed by the European Parliament – the Parliament put forward 841 amendments⁹ – demonstrates the difficult path towards finding a compromise. The most contentious points of the negotiations were: the design of the notification mechanism, namely whether the authority of the Member State in which the service provider or legal representative is located should be involved in reviewing the Order; if so, for which type(s) of data; and whether the authority may assert grounds to refuse requests.

After eight trilogues, political agreement was reached in November 2022 and confirmed in Council (Coreper) and the European Parliament (LIBE Committee) in January 2023. The Regulation and Directive were published in the Official Journal on 28 July 2023.¹⁰ While the Regulation will come to application 36 months after its date of entry into force, i.e., on 18 August 2026,¹¹ Member States will have 30 months to transpose the Directive after its entry into force, i.e., on 18 February 2026.¹² This allows Member States to make the necessary adaptations in their national laws and put everything in place before the e-evidence package starts to apply.¹³

III. Key Elements of the Enacted E-evidence Package

With its new e-evidence package, the EU introduces an entirely new system of obtaining electronic evidence in criminal proceedings by directly addressing private providers of communication, data storage, and internet infrastructure services located in another Member State – without, in principle, the need to involve the national authorities of the Member State in which the service provider is located. Such an approach can only function properly on the basis of a high level of mutual trust between the Member States.¹⁴

The new EU package on e-evidence is built on two distinct pieces of legislation:

• Regulation (EU) 2023/1543 lays down the rules and safeguards for national authorities to order service providers located in another Member State to preserve and produce e-evidence for the purpose of carrying out criminal proceedings;

• Directive (EU) 2023/1544 sets out, by contrast, harmonised rules on the designation of designated establishments or legal representatives by the service providers in order to ensure receipt, compliance with, and enforcement of orders issued by the competent authorities in the Member States for the purpose of gathering electronic evidence under the Regulation.¹⁵

Both legal acts shall be described in the following subsections.

1. Regulation on E-evidence

The Regulation, which is based on Art. 82(1) of the Treaty on the Functioning of the European Union (TFEU), introduces two new central instruments applicable across the Union for the purpose of obtaining electronic evidence in criminal proceedings – the European Production Order and the European Preservation Order. The choice of legal basis was subject to strong criticism but was not changed by the legislator.¹⁶

These instruments are defined as decisions issued or validated by the judicial authority of a Member State and addressed to a designated establishment or legal representative of a service provider offering services in the Union and located in another Member State for the purpose of producing electronic evidence or for preserving electronic evidence with a view of a subsequent request for production, respectively.¹⁷ With the European Preservation Order, judicial authorities may prevent foreign service providers from deleting or altering data, while the European Production Order enables the authorities to request preserved information directly from the service providers immediately or at a later stage.

To this end, the Regulation governs the conditions for the issuing of these instruments, its execution by the service providers, notification of and grounds of refusal for the executing Member State, the enforcement and penalties procedure, rights of the persons whose data is sought, a review procedure in case there are conflicting obligations with laws of a third state, provisions on standardised certificates and a decentralised IT system, and lastly rules governing the costs.

The Regulation does not, however, provide for a complete and exhaustive set of rules governing the application of the European Production Order and the European Preservation Order but instead refers on numerous occasions to rules provided under national law.

a) Subject matter and scope of the Regulation (Articles 1 and 2)

The material scope of application of the Regulation is limited to orders in the context of and for the purpose of criminal proceedings and for the execution of custodial sentences or detention orders of at least four months imposed by a decision not rendered in absentia. The orders may also be issued in criminal proceedings directed against a legal person. This means that these instruments cannot be used for preventive purposes or as a means of continuous surveillance. It requires the existence of concrete criminal proceedings, meaning that there is neither room for these instruments before criminal proceedings have commenced, nor once they have been terminated. Moreover, the Regulation also clarifies that it does not apply in mutual legal assistance proceedings, for which other respective instruments are to be used.

The Regulation defines the term “electronic evidence” as subscriber...