### (8) due to this lack of connection , judicial cooperation requests are often addressed to states which are hosts to a large number of service providers , but which have no other relation to the case at hand. furthermore , the number of requests has multiplied in view of increasingly used networked services that are borderless by nature. as a result , obtaining electronic evidence using judicial cooperation channels often takes a long time — longer than subsequent leads may be available. furthermore , there is no clear framework for cooperation with service providers , while certain third-country providers accept direct requests for non-content data as permitted by their applicable domestic law. as a consequence , all member states rely on the cooperation channel with service providers where available , using different national tools , conditions and procedures. in addition , for content data , some member states have taken unilateral action , while others continue to rely on judicial cooperation. ### (8) judicial cooperation requests are often addressed to states which are hosts to a large number of service providers. obtaining electronic evidence using judicial cooperation channels often takes a long time — longer than subsequent leads may be available. furthermore , there is no harmonised framework for cooperation with service providers , while certain third-country providers accept direct requests for non-content data as permitted by their applicable domestic law. as a consequence , all member states rely on the cooperation of service providers , applying different national tools , conditions and procedures. in addition , for content data , some member states have taken unilateral action , while others continue to rely on judicial cooperation.


### (9) the fragmented legal framework creates challenges for service providers seeking to comply with law enforcement requests. therefore there is a need to put forward a european legal framework for electronic evidence to impose an obligation on service providers covered by the scope of the instrument to respond directly to authorities without the involvement of a judicial authority in the member state of the service provider. ### (9) the fragmented legal framework creates challenges for law enforcement and judicial authorities , and for service providers seeking to comply with requests. therefore there is a need to clarify the rules of the cooperation across member states in matters of electronic evidence , ensuring fundamental rights , the rule of law , and upholding the responsibility of the public authorities rather than private actors to enforce the law.


### (10) orders under this regulation should be addressed to legal representatives of service providers designated for that purpose if a service provider established in the union has not designated a legal representative , the orders can be addressed to any establishment of this service provider in the union. this fall-back option serves to ensure the effectiveness of the system in case the service provider has not (yet) nominated a dedicated representative. ### (10) orders under this regulation should be addressed to legal representatives of service providers designated for that purpose , if a service provider is not established in the union.


### (11) the mechanism of the european production order and the european preservation order for electronic evidence in criminal matters can only work on the basis of a high level of mutual trust between the member states , which is an essential precondition for the proper functioning of this instrument. ### (11) the mechanism of the european production order and the european preservation order for electronic evidence in criminal matters works on the condition of mutual trust between the member states and of the rule of law , which are essential for the protection of fundamental rights in the union.


### (12) this regulation respects fundamental rights and observes the principles recognised in particular by the charter of fundamental rights of the european union. these include the right to liberty and security , the respect for private and family life , the protection of personal data , the freedom to conduct a business , the right to property , the right to an effective remedy and to a fair trial , the presumption of innocence and right of defence , the principles of the legality and proportionality , as well as the right not to be tried or punished twice in criminal proceedings for the same criminal offence. in case the issuing member state has indications that parallel criminal proceedings may be ongoing in another member state , it shall consult the authorities of this member state in accordance with council framework decision 2009/948/jha29 . ### (12) this regulation respects fundamental rights and it should be applied in the light of the principles recognised in particular by the charter of fundamental rights of the european union. these include the right to liberty and security , the respect for private and family life , the protection of personal data , the freedom to conduct a business , the right to property , the right to an effective remedy and to a fair trial , the presumption of innocence and right of defence , the principles of the legality and proportionality , as well as the right not to be tried or punished twice in criminal proceedings for the same criminal offence. in case the issuing member state has indications that parallel criminal proceedings may be ongoing in another member state , it should consult the authorities of this member state in accordance with council framework decision 2009/948/jha29 .


### (16) the service providers most relevant for criminal proceedings are providers of electronic communications services and specific providers of information society services that facilitate interaction between users. thus , both groups should be covered by this regulation. providers of electronic communications services are defined in the proposal for a directive establishing the european electronic communications code. they include inter-personal communications such as voice-over-ip , instant messaging and e-mail services. the categories of information society services included here are those for which the storage of data is a defining component of the service provided to the user , and refer in particular to social networks to the extent they do not qualify as electronic communications services , online marketplaces facilitating transactions between their users (such as consumers or businesses) and other hosting services , including where the service is provided via cloud computing. information society services for which the storage of data is not a defining component of the service provided to the user , and for which it is only of an ancillary nature , such as legal , architectural , engineering and accounting services provided online at a distance , should be excluded from the scope of this regulation , even where they may fall within the definition of information society services as per directive (eu) 2015/1535. ### (16) the service providers most relevant for criminal proceedings are providers of electronic communications services and specific providers of information society services that facilitate interaction between users. thus , both groups should be covered by this regulation. providers of electronic communications services are defined in the directive establishing the european electronic communications code. they include inter-personal communications such as voice-over-ip , instant messaging and e-mail services. the categories of information society services included here are those for which the storage of data is a defining component of the service provided to the user , and refer in particular to social networks to the extent they do not qualify as electronic communications services.


### (17) in many cases , data is no longer stored or processed on a user's device but made available on cloud-based infrastructure for access from anywhere. to run those services , service providers do not need to be established or to have servers in a specific jurisdiction. thus , the application of this regulation should not depend on the actual location of the provider`s establishment or of the data processing or storage facility. ### deleted


### (18) providers of internet infrastructure services related to the assignment of names and numbers , such as domain name registrars and registries and privacy and proxy service providers , or regional internet registries for internet protocol (‘ip’) addresses , are of particular relevance when it comes to the identification of actors behind malicious or compromised web sites. they hold data that is of particular relevance for criminal proceedings as it can allow for the identification of an individual or entity behind a web site used in criminal activity , or the victim of criminal activity in the case of a compromised web site that has been hijacked by criminals. ### (18) providers of internet infrastructure services related to the assignment of names and numbers , such as domain name registrars and registries and privacy and proxy service providers , or regional internet registries for internet protocol (‘ip’) addresses , are of particular relevance when it comes to the identification of actors behind malicious or compromised web sites. they could hold data that is of particular relevance for criminal proceedings as it could allow for the identification of an individual or entity behind a web site used in criminal activity , or the victim of criminal activity in the case of a compromised web site that has been hijacked by criminals.


### (19) this regulation regulates gathering of stored data only , that is , the data held by a service provider at the time of receipt of a european production or preservation order certificate. it does not stipulate a general data retention obligation , nor does it authorise interception of data or obtaining to data stored at a future point in time from the receipt of a production or preservation order certificate. data should be provided regardless of whether it is encrypted or not. ### (19) this regulation governs the gathering of stored data only , that is , the data held by a service provider at the time of receipt of a european production or preservation order certificate. it does not stipulate a general data retention obligation , nor does it authorise interception of data or obtaining to data stored at a future point in time from the receipt of a production or preservation order certificate. data should be provided regardless of whether it is encrypted or not , as long as the provider can limit the data to those described in the epoc.


### (20) the categories of data this regulation covers include subscriber data , access data , transactional data (these three categories being referred to as ‘non-content data’) and content data. this distinction , apart from the access data , exists in the legal laws of many member states and also in the current us legal framework that allows service providers to share non-content data with foreign law enforcement authorities on a voluntary basis. ### (20) the categories of data this regulation covers include subscriber data , traffic data and content data. these categories are in line with union and international law , notably the council of europe budapest convention on cybercrime , and the [regulation concerning the respect for private life and the protection of personal data in electronic communications and repealing directive 2002/58/ec (regulation on privacy and electronic communications)] , and the case law of the court of justice.


### (21) it is appropriate to single out access data as a specific data category used in this regulation. access data is pursued for the same objective as subscriber data , in other words to identify the underlying user , and the level of interference with fundamental rights is similar to that of subscriber data. access data is typically recorded as part of a record of events (in other words a server log) to indicate the commencement and termination of a user access session to a service. it is often an individual ip address (static or dynamic) or other identifier that singles out the network interface used during the access session. if the user is unknown , it often needs to be obtained before subscriber data related to that identifier can be ordered from the service provider. ### (21) it is appropriate to single out subscriber data as a specific data category used in this regulation. subscriber data is pursued to identify the underlying user.


### (22) transactional data , on the other hand , is generally pursued to obtain information about the contacts and whereabouts of the user and may be served to establish a profile of an individual concerned. that said , access data cannot by itself serve to establish a similar purpose , for example it does not reveal any information on interlocutors related to the user. hence this proposal introduces a new category of data , which is to be treated like subscriber data if the aim of obtaining this data is similar. ### deleted


### (23) all data categories contain personal data , and are thus covered by the safeguards under the union data protection acquis , but the intensity of the impact on fundamental rights varies , in particular between subscriber data and access data on the one hand and transactional data and content data on the other hand. while subscriber data and access data are useful to obtain first leads in an investigation about the identity of a suspect , transactional and content data are the most relevant as probative material. it is therefore essential that all these data categories are covered by the instrument. because of the different degree of interference with fundamental rights , different conditions are imposed for obtaining subscriber and access data on the one hand , and transactional and content data on the other. ### (23) all data categories contain personal data , and are thus covered by the safeguards under the union data protection acquis , but the intensity of the impact on fundamental rights varies , in particular between subscriber data on the one hand and traffic data and content data on the other hand. while subscriber data are useful to obtain first leads in an investigation about the identity of a suspect , traffic and content data are the most relevant as probative material. it is therefore essential that all these data categories are covered by the instrument. because of the different degree of interference with fundamental rights , different conditions are imposed for obtaining subscriber data on the one hand , and traffic and content data on the other.


### (30) when a european production or preservation order is issued , there should always be a judicial authority involved either in the process of issuing or validating the order. in view of the more sensitive character of transactional and content data , the issuing or validation of european production orders for production of these categories requires review by a judge. as subscriber and access data are less sensitive , european production orders for their disclosure can in addition be issued or validated by competent prosecutors. ### (30) when a european production or preservation order is issued , there should always be a judicial authority involved either in the process of issuing or validating the order. in view of the more sensitive character of traffic and content data , the issuing or validation of european production orders for production of these categories requires review by a judge. as subscriber data are less sensitive , european production orders for their disclosure can in addition be issued or validated by competent prosecutors.


### (31) for the same reason , a distinction has to be made regarding the material scope of this regulation: orders to produce subscriber data and access data can be issued for any criminal offence , whereas access to transactional and content data should be subject to stricter requirements to reflect the more sensitive nature of such data. a threshold allows for a more proportionate approach , together with a number of other ex ante and ex post conditions and safeguards provided for in the proposal to ensure respect for proportionality and the rights of the persons affected. at the same time , a threshold should not limit the effectiveness of the instrument and its use by practitioners. allowing the issuing of orders for investigations that carry at least a three-year maximum sentence limits the scope of the instrument to more serious crimes , without excessively affecting the possibilities of its use by practitioners. it excludes from the scope a significant number of crimes which are considered less serious by member states , as expressed in a lower maximum penalty. it also has the advantage of being easily applicable in practice. ### (31) for the same reason , a distinction has to be made regarding the material scope of this regulation: orders to produce subscriber data can be issued for criminal offences punishable in the issuing and the executing state , whereas access to traffic and content data should be subject to stricter requirements to reflect the more sensitive nature of such data. a threshold allows for a more proportionate approach , together with a number of other ex ante and ex post conditions and safeguards provided for in this regulation to ensure respect for proportionality and the rights of the persons affected. at the same time , a threshold should not limit the effectiveness of the instrument and its use by practitioners. allowing the issuing of orders for investigations that carry at least a five-year maximum sentence limits the scope of the instrument to more serious crimes , without excessively affecting the possibilities of its use by practitioners. it excludes from the scope a significant number of crimes which are considered less serious by member states , as expressed in a lower maximum penalty. it also has the advantage of being easily applicable in practice.


### (32) there are specific offences where evidence will typically be available exclusively in electronic form , which is particularly fleeting in nature. this is the case for cyber-related crimes , even those which might not be considered serious in and of themselves but which may cause extensive or considerable damage , in particular including cases of low individual impact but high volume and overall damage. for most cases where the offence has been committed by means of an information system , applying the same threshold as for other types of offences would predominantly lead to impunity. this justifies the application of the regulation also for those offences where the penalty frame is less than 3 years of imprisonment. additional terrorism related offences as described in the directive 2017/541/eu do not require the minimum maximum threshold of 3 years. ### (32) there are specific offences where evidence will typically be available exclusively in electronic form , which is particularly fleeting in nature. this is the case for cyber-related crimes , even those which might not be considered serious in and of themselves but which may cause extensive or considerable damage , in particular including cases of low individual impact but high volume and overall damage. for most cases where the offence has been committed by means of an information system , applying the same threshold as for other types of offences would predominantly lead to impunity. this justifies the application of the regulation also for those offences where the penalty frame is less than 3 years of imprisonment.


### (33) additionally , it is necessary to provide that the european production order may only be issued if a similar order would be available for the same criminal offence in a comparable domestic situation in the issuing state. ### (33) additionally , it is necessary to provide that the european production order may only be issued for all criminal offences punishable in the issuing and the executing state , if it could have been ordered for the same criminal offence under the same conditions in a similar domestic case in the issuing state , and where there is reason to believe the criminal offence has been committed , and where it is grave enough to justify the order.


### (34) in cases where the data sought is stored or processed as part of an infrastructure provided by a service provider to a company or another entity other than natural persons , typically in case of hosting services , the european production order should only be used when other investigative measures addressed to the company or the entity are not appropriate , especially if this would create a risk to jeopardise the investigation. this is of relevance in particular when it comes to larger entities , such as corporations or government entities , that avail themselves of the services of service providers to provide their corporate it infrastructure or services or both. the first addressee of a european production order , in such situations , should be the company or other entity. this company or other entity may not be a service provider covered by the scope of this regulation. however , for cases where addressing that entity is not opportune , for example because it is suspected of involvement in the case concerned or there are indications for collusion with the target of the investigation , competent authorities should be able to address the service provider providing the infrastructure in question to provide the requested data. this provision does not affect the right to order the service provider to preserve the data. ### deleted


### (35) immunities and privileges , which may refer to categories of persons (such as diplomats) or specifically protected relationships (such as lawyer-client privilege) , are referred to in other mutual recognition instruments such as the european investigation order. their range and impact differ according to the applicable national law that should be taken into account at the time of issuing the order , as the issuing authority may only issue the order if a similar order would be available in a comparable domestic situation. in addition to this basic principle , immunities and privileges which protect access , transactional or content data in the member state of the service provider should be taken into account as far as possible in the issuing state in the same way as if they were provided for under the national law of the issuing state. this is relevant in particular should the law of the member state where the service provider or its legal representative is addressed provide for a higher protection than the law of the issuing state. the provision also ensures respect for cases where the disclosure of the data may impact fundamental interests of that member state such as national security and defence. as an additional safeguard , these aspects should be taken into account not only when the order is issued , but also later , when assessing the relevance and admissibility of the data concerned at the relevant stage of the criminal proceedings , and if an enforcement procedure takes place , by the enforcing authority. ### (35) immunities and privileges , which may refer to categories of persons (such as diplomats) or specifically protected relationships (such as lawyer-client privilege) , are referred to in other mutual recognition instruments such as the european investigation order. they should be taken into account at any time. in addition to this basic principle , immunities and privileges which protect traffic or content data in the member state of the service provider should be taken into account as far as possible in the issuing state in the same way as if they were provided for under the national law of the issuing state. they should be taken into account in the executing state when taking the decision on the order. this is relevant in particular should the law of the member state where the service provider or its legal representative is addressed provide for a higher protection than the law of the issuing state.these aspects should be taken into account not only when the order is issued , but also later , when assessing the relevance and admissibility of the data concerned at the relevant stage of the criminal proceedings , and if an enforcement procedure takes place , by the enforcing authority.


### (36) the european preservation order may be issued for any offence. its aim is to prevent the removal , deletion or alteration of relevant data in situations where it may take more time to obtain the production of this data , for example because judicial cooperation channels will be used. ### (36) the european preservation order may be issued for any criminal offence punishable in the issuing and the executing state , if it could have been ordered for the same criminal offence under the same conditions in a similar domestic case , and where there is reason to believe the criminal offence has been committed , and where it is grave enough to justify the order. its aim is to prevent the removal , deletion or alteration of relevant data in situations where it may take more time to obtain the production of this data , for example because judicial cooperation channels will be used.


### (37) european production and preservation orders should be addressed to the legal representative designated by the service provider. in the absence of a designated legal representative , orders can be addressed to an establishment of the service provider in the union. this can be the case where there is no legal obligation for the service provider to nominate a legal representative. in case of non-compliance by the legal representative in emergency situations , the european production or preservation order may also be addressed to the service provider alongside or instead of pursuing enforcement of the original order according to article 14. in case of non-compliance by the legal representative in non-emergency situations , but where there are clear risks of loss of data , a european production or preservation order may also be addressed to any establishment of the service provider in the union. because of these various possible scenarios , the general term ‘addressee’ is used in the provisions. where an obligation , such as on confidentiality , applies not only to the addressee , but also to the service provider if it is not the addressee , this is specified in the respective provision. ### (37) european production and preservation orders should be addressed to the main establishment of the service provider in the union among the member states participating , or , where this is not the case , to where the service provider is established in the union among the member states participating , or , where this is not the case , to the legal representative of the service provider. simultaneously , it should be addressed directly to the executing authority.


### (38) the european production and european preservation orders should be transmitted to the service provider through a european production order certificate (epoc) or a european preservation order certificate (epoc-pr) , which should be translated. the certificates should contain the same mandatory information as the orders , except for the grounds for the necessity and proportionality of the measure or further details about the case to avoid jeopardising the investigations. but as they are part of the order itself , they allow the suspect to challenge it later during the criminal proceedings. where necessary , a certificate needs to be translated into (one of) the official language(s) of the member state of the addressee , or into another official language that the service provider has declared it will accept. ### (38) the european production and european preservation orders should be transmitted to the service provider through a european production order certificate (epoc) or a european preservation order certificate (epoc-pr) , which should be translated into (one of) the official language(s) of the member state of the addressee.


### (39) the competent issuing authority should transmit the epoc or the epoc-pr directly to the addressee by any means capable of producing a written record under conditions that allow the service provider to establish authenticity , such as by registered mail , secured email and platforms or other secured channels , including those made available by the service provider , in line with the rules protecting personal data. ### (39) the competent issuing authority should transmit the epoc or the epoc-pr directly to the addressee in a secure and reliable way , allowing the addressee to produce a written record , ensuring secrecy , confidentiality , integrity , and allowing the service provider to establish the authenticity of the order and of the issuing authority , in line with the rules protecting personal data. in particular where electronic means are employed , open and commonly used , state-of-the-art electronic signature and encryption technology should be applied , allowing authorities and service providers to adopt a common , high level of security , while avoiding unnecessary burdens for service providers and benefiting from the sharing and re-use of established , tested products and processes.


### (41) in order to allow service providers to address formal problems , it is necessary to set out a procedure for the communication between the service provider and the issuing judicial authority in cases where the epoc might be incomplete or contains manifest errors or not enough information to execute the order. moreover , should the service provider not provide the information in an exhaustive or timely manner for any other reason , for example because it thinks there is a conflict with an obligation under the law of a third country , or because it thinks the european production order has not been issued in accordance with the conditions set out by this regulation , it should go back to the issuing authorities and provide the opportune justifications. the communication procedure thus should broadly allow for the correction or reconsideration of the epoc by the issuing authority at an early stage. to guarantee the availabilty of the data , the service provider should preserve the data if they can identify the data sought. ### (41) in order to allow service providers to address formal problems , it is necessary to set out a procedure for the communication between the service provider and the issuing judicial authority in cases where the epoc or epoc-pr might be incomplete or contains manifest errors or not enough information to execute the order. in case the service provider cannot comply with the epoc or epoc-pr within a timely manner , because of force majeure or of de facto impossibility , it should inform the authorities as soon as possible and comply with the order as soon as the reasons for the impossibility are no longer present. such reasons could be technical , such as access controls or encryption , or operational , such as unavailability of staff during off-duty hours , or others , which reflect the operational limitations of small and medium enterprises and non-profit and community hosting service providers , also taking into account their size and the previous exposure to epocs and epoc-prs of a service provider. moreover , should the service provider not provide the information in an exhaustive or timely manner for any other reason , for example because it thinks there is a conflict with an obligation under the law of a third country , or because it thinks the european production order has not been issued in accordance with the conditions set out by this regulation , it should go back to the issuing authorities and provide the opportune justifications. the communication procedure thus should broadly allow for the correction or reconsideration of the epoc by the issuing authority at an early stage. to guarantee the availabilty of the data , the service provider should preserve the data if they can identify the data sought.


### (46) notwithstanding their data protection obligations , service providers should not be held liable in member states for prejudice to their users or third parties exclusively resulting from good faith compliance with an epoc or an epoc-pr. ### (46) service providers should not be held liable in member states for prejudice to their users or third parties exclusively resulting from compliance with this regulation. where a service provider acts with due diligence , in particular with regards to data protection obligations , manifest errors in an order , illegal requests , or where an order manifestly violates fundamental rights or is abusive , the service provider shall have the possibility to request clarification , or justification from the issuing authority through the executing authority. where it acted faithfully , a service provider shall not be held liable for the consequences from any delays caused.


### (47) in addition to the individuals whose data is requested , the service providers and third countries may be affected by the investigative measure. to ensure comity with respect to the sovereign interests of third countries , to protect the individual concerned and to address conflicting obligations on service providers , this instrument provides a specific mechanism for judicial review where compliance with a european production order would prevent service providers from complying with legal obligation deriving from a third state’s law. ### (47) in addition to the individuals whose data is requested , the service providers and third countries may be affected by the investigative measure. to ensure comity with respect to the sovereign interests of third countries , to protect the individual concerned and to address conflicting obligations on service providers , this instrument provides a specific mechanism for judicial review where the executing authority , on its own initiative or on request of the service provider , or , where applicable , the affected authority considers that compliance with the european production order would conflict with applicable laws of a third country prohibiting the disclosure of the data concerned.


### (48) to this end , whenever the addressee considers that the european production order in the specific case would entail the violation of a legal obligation stemming from the law of a third country , it should inform the issuing authority by way of a reasoned objection , using the forms provided. the issuing authority should then review the european production order in light of the reasoned objection , taking into account the same criteria that the competent court would have to follow. where the authority decides to uphold the order , the procedure should be referred to the competent court , as notified by the relevant member state , which then reviews the order. ### (48) to this end , whenever the the executing authority , on its own initiative or on request of the service provider , or , where applicable , the affected authority considers that the european production order or the european preservation order in the specific case would entail the violation of a legal obligation stemming from the law of a third country , the executing authority should inform the issuing authority within 10 days of the receipt of the order. such notice should include all relevant details on the law of the third country , its applicability in the case at hand and the nature of the conflicting obligation. the issuing authority should then review the european production order or european preservation order within 10 days of receiving the notice , taking into account criteria including the interests protected by the relevant law , the connection of the criminal case and the third country , the connection between the service provider and the third country , the interests of the investigating state in obtaining the electronic information and the possible consequences for the addressees of complying with the european production order or the european preservationorder. during this procedure , the requested data should be preserved.


### (51) where conflicting obligations exist , the court should determine whether the conflicting provisions of the third country prohibit disclosure of the data concerned on the grounds that this is necessary to either protect the fundamental rights of the individuals concerned or the fundamental interests of the third country related to national security or defence. in carrying out this assessment , the court should take into account whether the third country law , rather than being intended to protect fundamental rights or fundamental interests of the third country related to national security or defence , manifestly seeks to protect other interests or is being aimed to shield illegal activities from law enforcement requests in the context of criminal investigations. where the court concludes that conflicting provisions of the third country prohibit disclosure of the data concerned on the grounds that this is necessary to either protect the fundamental rights of the individuals concerned or the fundamental interests of the third country related to national security or defence , it should consult the third country via its central authorities , which are already in place for mutual legal assistance purposes in most parts of the world. it should set a deadline for the third country to raise objections to the execution of the european production order; in case the third country authorities do not respond within the (extended) deadline despite a reminder informing them of the consequences of not providing a response , the court upholds the order. if the third country authorities object to disclosure , the court should lift the order. ### deleted


### (52) in all other cases of conflicting obligations , unrelated to fundamental rights of the individual or fundamental interests of the third country related to national security or defence , the court should take its decision on whether to uphold the european production order by weighing a number of elements which are designed to ascertain the strength of the connection to either of the two jurisdictions involved , the respective interests in obtaining or instead preventing disclosure of the data , and the possible consequences for the service provider of having to comply with the order. importantly for cyber-related offences , the place where the crime was committed covers both the place(s) where the action was taken and the place(s) where the effects of the offence materialised. ### deleted


### (53) the conditions set out in article 9 are applicable also where conflicting obligations deriving from the law of a third country occur. during this procedure , the data should be preserved. where the order is lifted , a new preservation order may be issued to permit the issuing authority to seek production of the data through other channels , such as mutual legal assistance. ### deleted


### (55) in addition , during the enforcement procedure and subsequent legal remedy , the addressee may oppose the enforcement of a european production or preservation order on a number of limited grounds , including it not being issued or validated by a competent authority or it being apparent that it manifestly violates the charter of fundamental rights of the european union or is manifestly abusive. for example , an order requesting the production of content data pertaining to an undefined class of people in a geographical area or with no link to concrete criminal proceedings would ignore in a manifest way the conditions for issuing a european production order. ### deleted


### (56) the protection of natural persons for the processing of personal data is a fundamental right. in accordance with article 8(1) of the charter of fundamental rights of the european union and article 16(1) of the tfeu , everyone has the right to the protection of personal data concerning them. when implementing this regulation , member states should ensure that personal data are protected and may only be processed in accordance with regulation (eu) 2016/679 and directive (eu) 2016/680. ### deleted


### (57) personal data obtained under this regulation should only be processed when necessary and proportionate to the purposes of prevention , investigation , detection and prosecution of crime or enforcement of criminal sanctions and the exercise of the rights of defence. in particular , member states should ensure that appropriate data protection policies and measures apply to the transmission of personal data from relevant authorities to service providers for the purposes of this regulation , including measures to ensure the security of the data. service providers should ensure the same for the transmission of personal data to relevant authorities. only authorised persons should have access to information containing personal data which may be obtained through authentication processes. the use of mechanisms to ensure authenticity should be considered , such as notified national electronic identification systems or trust services as provided for by regulation (eu) 910/2014 of the european parliament and of the council of 23 july 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing directive 1999/93/ec. ### deleted


### (58) the commission should carry out an evaluation of this regulation that should be based on the five criteria of efficiency , effectiveness , relevance , coherence and eu value added and should provide the basis for impact assessments of possible further measures. information should be collected regularly and in order to inform the evaluation of this regulation. ### deleted


### (59) the use of pretranslated and stardardised forms facilitates cooperation and the exchange of information between judicial authorities and service providers , allowing them to secure and transmit electronic evidence more quickly and effectively , while also fulfilling the necessary security requirements in a user-friendly manner. they reduce translation costs and contribute to a high quality standard. response forms similarly should allow for a standardised exchange of information , in particular where service providers are unable to comply because the account does not exist or because no data is available. the forms should also facilitate the gathering of statistics. ### (59) the use of pretranslated and stardardised forms facilitates cooperation and the exchange of information between judicial authorities and service providers , allowing them to secure and transmit electronic evidence more quickly and effectively , in a user-friendly manner. they could also reduce translation costs and contribute to a high quality standard. response forms similarly should allow for a standardised exchange of information. the forms should also facilitate the gathering of statistics.


### (62) because of technological developments , new forms of communication tools may prevail in a few years , or gaps may emerge in the application of this regulation. it is therefore important to provide for a review on its application. ### deleted


### 1. this regulation lays down the rules under which an authority of a member state may order a service provider offering services in the union , to produce or preserve electronic evidence , regardless of the location of data. this regulation is without prejudice to the powers of national authorities to compel service providers established or represented on their territory to comply with similar national measures. ### 1. this regulation lays down the rules under which an authority of a member state may order a service provider offering services in the union and established or , if not established , represented in another member state , to produce or preserve electronic evidence , regardless of the location of data.


### 2. this regulation shall not have the effect of modifying the obligation to respect the fundamental rights and legal principles as enshrined in article 6 of the teu , including the rights of defence of persons subject to criminal proceedings , and any obligations incumbent on law enforcement or judicial authorities in this respect shall remain unaffected. ### 2. this regulation shall not have the effect of modifying the obligation to respect the fundamental rights and legal principles as enshrined in the charter of fundamental rights , and article 6 of the teu , including the rights of defence of persons subject to criminal proceedings , and any obligations incumbent on law enforcement or judicial authorities in this respect shall remain unaffected.


### (1) ‘european production order’ means a binding decision by an issuing authority of a member state compelling a service provider offering services in the union and established or represented in another member state , to produce electronic evidence; ### (1) ‘european production order’ means a binding decision , issued by a competent authority of a member state for validation by the competent authority of another member state compelling a service provider offering services in the union and established or represented in another member state , to produce electronic evidence;


### (2) ‘european preservation order' means a binding decision by an issuing authority of a member state compelling a service provider offering services in the union and established or represented in another member state , to preserve electronic evidence in view of a subsequent request for production; ### (2) ‘european preservation order' means a binding decision , issued by a competent authority of a member state for validation by the competent authority of another member state compelling a service provider offering services in the union and established or represented in another member state , to preserve electronic evidence in view of a subsequent request for production;


### internet domain name and ip numbering services such as ip address providers , domain name registries , domain name registrars and related privacy and proxy services; ### internet domain name and ip numbering services such as ip address providers , domain name registries , domain name registrars , and related proxy services;


### (5) ‘establishment’ means either the actual pursuit of an economic activity for an indefinite period through a stable infrastructure from where the business of providing services is carried out or a stable infrastructure from where the business is managed; ### (5) ‘main establishment’ means , as regards a service provider with establishments in more than one member state , the place of its central administration in the union , unless the decisions on the purposes and means of the provision of services are taken in another establishment of the service provider in the union and the latter establishment has the power to have such decisions implemented , in which case the establishment having taken such decisions is to be considered to be the main establishment;


### (6) ‘electronic evidence’ means evidence stored in electronic form by or on behalf of a service provider at the time of receipt of a production or preservation order certificate , consisting in stored subscriber data , access data , transactional data and content data; ### (6) ‘electronic evidence’ means subscriber , traffic , or content data , legally stored by a service provider at the time of receipt of a european production or preservation order , that is requested for the purpose of serving as evidence during the investigation , prosecution , and court proceedings , of a criminal offence in a member state in accordance with national law;


### (7) ‘subscriber data’ means any data pertaining to: ### (7) ‘subscriber data’ means any data pertaining to the provided name , date of birth , postal or geographic address , billing and payment data , telephone , or email address identifying the subscriber or customer;


### the identity of a subscriber or customer such as the provided name , date of birth , postal or geographic address , billing and payment data , telephone , or email; ### deleted


### the type of service and its duration including technical data and data identifying related technical measures or interfaces used by or provided to the subscriber or customer , and data related to the validation of the use of service , excluding passwords or other authentication means used in lieu of a password that are provided by a user , or created at the request of a user; ### deleted


### (10) ‘content data’ means any stored data in a digital format such as text , voice , videos , images , and sound other than subscriber , access or transactional data; ### (10) ‘content data’ means any stored data in a digital format such as text , voice , videos , images , and sound other than subscriber or traffic data;


### (13) ‘enforcing state’ means the member state in which the addressee of the european production order or the european preservation order resides or is established and to which the european production order and the european production order certificate or the european preservation order and the european preservation order certificate are transmitted for enforcement; ### (13) ‘executing state’ means the member state:


### 1. emphasises that the european asylum support office (‘easo’ or ‘the office’) contributes to enhanced practical cooperation of member states on asylum in europe , assists member states to fulfil their obligations and acts as a centre of expertise on asylum; ### 1. emphasises that the european asylum support office (‘easo’ or ‘the office’) contributes to enhanced practical cooperation of member states on asylum in europe , assists member states to fulfil their obligations to give protection to people in need and acts as a centre of expertise on asylum;


### 1. grants the executive director of the european asylum support office discharge in respect of the implementation of the office’s budget for the financial year 2018 / postpones its decision on granting the director of the european asylum support office discharge in respect of the implementation of the agency’s budget for the financial year 2018; ### 1. grants the executive director of the european asylum support office discharge in respect of the implementation of the office’s budget for the financial year 2018;


### 1. approves the closure of the accounts of the european asylum support office for the financial year 2018 / postpones the closure of the accounts of the european asylum support office for the financial year 2018; ### 1. approves the closure of the accounts of the european asylum support office for the financial year 2018;


### 1. takes notes of the decision of the office’s management board of 6 june 2018 to release the previous executive director from his duties with immediate effect; notes the designation of an ad interim executive director on 6 june 2018 and the appointment of a new executive director on 16 june 2019; takes notes of the follow-up report by the office on the observations of parliament for the 2017 financial year , in particular the corrective measures taken by the office’s management board , the ad interim executive director and the new executive director in order to improve the governance structure and efficiency of the office , restore transparency and build trust; supports and appreciates the measures outlined by the 2019 easo governance action plan; notes the positive message and intention for future close cooperation expressed by the new executive director in the public hearing of 4 september 2019; however , recalls the european parliament decision of 23 october 2019 refusing to grant the office’s executive director discharge for the financial year 2017; ### 1. takes notes of the decision of the office’s management board of 6 june 2018 to release the previous executive director from his duties with immediate effect; notes the designation of an ad interim executive director on 6 june 2018 and the appointment of a new executive director on 16 june 2019; takes notes of the follow-up report by the office on the observations of parliament for the 2017 financial year , in particular the corrective measures taken by the office’s management board , the ad interim executive director and the new executive director in order to improve the governance structure and efficiency of the office , restore transparency and build trust; strongly supports and appreciates the measures outlined by the 2019 easo governance action plan; welcomes the positive message and intention for future close cooperation expressed by the new executive director in the public hearing of 4 september 2019 especially after the european parliament decision of 23 october 2019 to refuse granting the office’s executive director discharge for the financial year 2017;


### 2. recalls the irregularities at the office reported by the european anti-fraud office (olaf) in 2017 and olaf’s recommendations of disciplinary action to the easo management board , the decision of easo’s management board of 6 june 2018 to release the executive director from his duties with immediate effect , the designation of an ad interim executive director on 6 june 2018 and the appointment of a new executive director on 16 june 2019; ### 2. recalls that easo’s executive director resigned in 6 june 2018 following the irregularities reported by the european anti-fraud office (olaf) in 2017 , and was replaced by an ad interim executive director until 16 june 2019 , when a new executive director was appointed;


### 2. recalls that , according to the report of the court for the financial years 2016 and 2017 , that contracts on the provision of interim workers in greece and travel services to the office’s premises in lesbos are irregular; notes the court’s opinion that , except for the effects of the financial years 2016 and 2017 for which the court issued a qualified opinion on the legality and regularity of payments , payments underlying the accounts for the year ended 31 december 2018 are legal and regular in all material aspects; ### 2. notes that , except for the effects of the financial years 2016 and 2017 for which the court issued a qualified opinion on the legality and regularity of payments , payments underlying the accounts for the year ended 31 december 2018 are legal and regular in all material aspects;


### 4. notes that easo’s budget was substantially increased from 79 million eur to 98 million eur (+24%) while the staff only increased from 200 to 207 (+3.5%); is concerned by the court’s finding that contingency funds in easo’s budget to cover unforeseen and urgent operational needs were absent; calls on the office to address this situation in consultation with budgetary authorities and the commission , especially in light of the nature of easo’s operational activity; ### 4. notes that easo’s budget was substantially increased from 79 million eur to 98 million eur (+24%) while the staff only increased from 200 to 207 (+3.5%); is concerned by the court’s finding that contingency funds in easo’s budget to cover unforeseen and urgent operational needs were absent; calls on the office to strengthen the dialogue with the commission and the budgetary authorities regarding its operational planning and resource allocation , especially in light of the nature of easo’s operational activity; welcomes the intention of easo to establish sound processes and timely planning for contingency situations;


### 5. regrets that limited annual budgets and the absence of any contingency funds in the office’s budget to cover the financing of unforeseen urgent operational needs create budgetary uncertainties and hamper emergency planning; calls on the office to address budgetary constraints in consultation with the commission and the budgetary authorities; ### 5. regrets that limited annual budgets and the absence of any contingency funds in the office’s budget to cover the financing of unforeseen urgent operational needs create budgetary uncertainties and hamper emergency planning; calls on the commission to address budgetary constraints of the office in consultation with the budgetary authorities;


### 9. regrets to note that , according to the court’s report , as from the end of 2017 , the human resources situation at the office has deteriorated exponentially; notes that , by the end of 2018 , the office had 219 staff members; 89 offer letters were sent out and 60 contracts were signed; observes , however , that there were still 78 vacancies to be filled by the end of 2018; in particular , notes with deep concern the lack of managers in the administration department , as four out of five management posts were either vacant or saw the persons occupying it suspended from their duties; express its grave concern that this situation entails a significant risk to the continuation of the office’s operations at the current scale; calls on the office to make additional efforts to fill the vacant posts , in collaboration with the commission and member states and to keep the discharge authority up to date on the corrective measures taken to mitigate that risk; ### 9. notes that the human resources situation at the office has deteriorated exponentially up until the appointment of the new management in june 2018; notes that , by the end of 2018 , the office had 219 staff members; 89 offer letters were sent out and 60 contracts were signed; observes , however , that there were still 78 vacancies to be filled by the end of 2018; in particular , notes with deep concern the lack of managers in the administration department , as four out of five management posts were either vacant or saw the persons occupying it suspended from their duties; recognises the efforts and measures to improve the situation by the office's new management; calls on the office to continue with on-going efforts to fill the vacant posts , in collaboration with the commission and member states and to keep the discharge authority up to date on the corrective measures taken to mitigate that risk;


### 10. notes , in light of observations and comments from the discharge authority related to serious weaknesses in four of the fourteen recruitment procedures audited in 2017 , that the office has implemented new standard operating procedures on recruitment which reflect all the recommendations made by the court; notes , furthermore , that selection procedures are better documented , more transparent and much more robust in terms of containing the risk of fraud; ### 10. notes that the office has implemented new standard operating procedures on recruitment which reflect all the recommendations made by the court; notes , furthermore , that selection procedures are now better documented , more transparent and much more robust in terms of containing the risk of fraud;


### 14. acknowledges from the office that , in 2018 , it began to implement the commission decision regarding whistleblowing and developed a practical guide for the management and prevention of conflicts of interests , which should be adopted by the management board by q3 of 2019 as well as rules for the protection of whistle-blowers; ### 14. acknowledges from the office that , in 2018 , it began to implement the commission decision regarding whistleblowing and developed a practical guide for the management and prevention of conflicts of interests , with an adoption calendar by the management board by q3 of 2019 as well as rules for the protection of whistle-blowers; notes with appreciation that the office has organised a series of staff-dedicated training sessions on ethics , with a specific emphasis on prevention of conflicts of interest and with a special tailor-made module dedicated to managers; notes with satisfaction that relevant rules regarding conflict of interest have also been transposed on the relevant standard operating procedures and policies; calls on the office to continue to pay particular attention to the prevention of conflict of interest and the proper implementation of whistle-blowing rules and procedures;


### 15. notes with concern that , although the office publishes the declarations of interest and cvs of its management board members on its website , it is still not publishing the declarations of interests of the senior management; ### 15. notes with concern that , although the office publishes the declarations of interest and cvs of its management board members on its website , it is still not publishing the declarations of interests of the senior management and calls on the office to immediately take action in this regard;


### 17. deplores that , at the end of 2018 , the office did not have an internal audit capability and that there were no comprehensive internal audit service audit reports that had been issued since january 2018; furthermore , notes that the creation of ex-post controls to verify the legality and regularity of transactions was in its infancy; takes note on the office’s reply that it has agreed and documented corrective measures on the internal control systems including the creation of audit capability by q4 of 2019 and an ex-post internal control capability by q3 of 2019; calls on the office to report back to the discharge authority on the measures taken in that respect; ### 17. is aware that , at the end of 2018 , the office did not have an internal audit capability and that there were no comprehensive internal audit service audit reports that had been issued since january 2018; furthermore , notes that the creation of ex-post controls to verify the legality and regularity of transactions was in its infancy; takes note on the office’s reply that it has agreed and documented corrective measures on the internal control systems including the creation of audit capability by q4 of 2019 and an ex-post internal control capability by q3 of 2019; calls on the office to report back to the discharge authority on the measures taken in that respect;


### 18. notes that the office has taken positive steps in order to improve organisational governance; notes that 30 out of the 61 measures in the action plan were completed , while 31 had an ongoing status at the time of the court’s audit; ### 18. notes with satisfaction that the office has taken positive steps in order to improve organisational governance; notes that 30 out of the 61 measures in the action plan were completed , while 31 had an ongoing status at the time of the court’s audit;


### 19. regrets that there is still no policy regarding sensitive posts at the office , which is not in line with the office’s internal control standards whereby sensitive functions should be clearly defined , recorded and kept up to date; takes notes on the office’s reply that a sensitive posts policy is being finalised and is expected to be approved by q3 of 2019 and to be implemented by q4 of 2019; calls on the office to report to the discharge authority on developments on this matter; ### 19. regrets that in 2018 there was no policy regarding sensitive posts at the office , which is not in line with the office’s internal control standards whereby sensitive functions should be clearly defined , recorded and kept up to date; takes note of the office's reply that a sensitive post policy was adopted in september 2019 , to be implemented by q4 of 2019; calls on the office to report to the discharge authority on further developments on this matter;


### 19. regrets that there is still no policy regarding sensitive posts at the office , which is not in line with the office’s internal control standards whereby sensitive functions should be clearly defined , recorded and kept up to date; takes notes on the office’s reply that a sensitive posts policy is being finalised and is expected to be approved by q3 of 2019 and to be implemented by q4 of 2019; calls on the office to report to the discharge authority on developments on this matter; ### 19. regrets that in 2018 there was still no policy regarding sensitive posts at the office , which is not in line with the office’s internal control standards whereby sensitive functions should be clearly defined , recorded and kept up to date; takes notes on the office’s reply that a sensitive posts policy was being finalised and expected to be approved by q3 of 2019 and implemented by q4 of 2019; calls on the office to report to the discharge authority on developments on this matter;


### 8. notes the agency’s existing measures and ongoing efforts to secure transparency , prevention and management of conflicts of interest and whistle-blower protection; notes the potential conflict of interest case identified concerning a recruitment procedure in 2018; notes that no follow-up action was needed as the adviser recused himself; ### 8. appreciates the agency’s existing measures and ongoing efforts to secure transparency , prevention and management of conflicts of interest and whistle-blower protection; notes the potential conflict of interest case identified concerning a recruitment procedure in 2018; notes that no follow-up action was needed as the adviser recused himself; welcomes the publication on the agency's website of cvs and declarations of interests for management board members and directorate;


### 1. stresses that the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) (the 'agency') offers an important contribution to a safer europe by providing high-quality services and helping to align member states’ technological capabilities with their needs; reminds that the agency’s capacity to both improve existing and develop new information systems was enhanced by its new mandate which entered into force in december 2018; ### 1. stresses that the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) (the 'agency') offers an important contribution to a safer europe by providing high-quality services and helping to align member states’ technological capabilities with their needs;


### 3. notes the agency's very low budget implementation in 2018 , with close to 25 % (eur 49 million) of commitment appropriations carried forward and 76 % (eur 74 million) of payment appropriations unused; acknowledges that this was due to reasons beyond the control of the agency , namely the late adoption or entry into force of certain legislative acts; believes , however , that the lower absorption capacity should have been anticipated and therefore calls on the agency and the commission to improve the budgetary planning in the future; ### 3. notes the agency's very low budget implementation in 2018 with close to 25 % (eur 49 million) of commitment appropriations carried forward and 76 % (eur 74 million) of payment appropriations unused; believes , however , that the lower absorption capacity should be anticipated and therefore calls on the agency and the commission to improve the budgetary planning in the future;


### 5. takes note of several flaws detected by the court in relation to compliance with public procurement rules; regrets that the flaws related to a framework contract for provision of ‘corrective maintenance in working order of the schengen information system’ led to irregular payments totalling eur 759 000; deplores that the court detected further shortcomings in the quality , completeness and consistency of information related to that contract; takes note of the agency’s reply that the irregular payment was necessary to comply with its legal obligation to continuously maintain the schengen information system as the procedure for the successor framework contract was launched too late; welcomes the new organisational structure put in place by the agency to reinforce the capabilities needed for operational planning and the underlying procurement , including the provision of legal and technical input , but calls for further efforts to ensure compliance with procurement rules and more accurate reporting; ### 5. takes note of several flaws detected by the court in relation to compliance with public procurement rules; regrets that the flaws related to a framework contract for provision of ‘corrective maintenance in working order of the schengen information system’ led to irregular payments totalling eur 759 000; deplores that the court detected further shortcomings in the quality , completeness and consistency of information related to that contract; welcomes the new organisational structure put in place by the agency to reinforce the capabilities needed for operational planning and the underlying procurement , including the provision of legal and technical input , but calls for further efforts to ensure compliance with procurement rules and more accurate reporting;


### 16. notes that in november 2018 the agency finalised the implementation of the new rules on the prevention and management of conflicts of interest for the members of the management board and the advisory groups which encompasses annual submission of their declarations of interest and the assessment of the declarations by the chairpersons of the management board and the respective advisory groups , as applicable , with the support of the agency , followed by their publication on the agency’s website; notes that the agency has in place rules on the prevention and management of conflicts of interest for staff members; notes that in 2018 , all members of staff submitted declarations of interest of which 31 declared an interest (corresponding to 20 % of the staff) that was assessed by the line managers and that for three staff members (corresponding to 2 % of the staff) actions were taken to mitigate the risk of potential conflict of interest; notes that in june 2018 , the management board adopted the agency’s decision on guidelines on whistleblowing; notes that according to the agency’s reply there is no legal obligation to publish the cvs of the members of its management board; ### 16. notes with satisfaction that in november 2018 the agency finalised the implementation of the new rules on the prevention and management of conflicts of interest for the members of the management board and the advisory groups which encompasses annual submission of their declarations of interest and the assessment of the declarations by the chairpersons of the management board and the respective advisory groups , as applicable , with the support of the agency; welcomes the adoption of a new model of declarations of interest , followed by their publication on the agency’s website; notes that the agency has in place rules on the prevention and management of conflicts of interest for staff members; notes that in 2018 , all members of staff submitted declarations of interest of which 31 declared an interest (corresponding to 20 % of the staff) that was assessed by the line managers and that for three staff members (corresponding to 2 % of the staff) actions were taken to mitigate the risk of potential conflict of interest; regrets however that the new model of declaration of interest has not also been applied to the executive leadership; notes with regret that only a declaration of absence of conflict of interest is available for the executive director; notes that in june 2018 , the management board adopted the agency’s decision on guidelines on whistleblowing; notes that according to the agency’s reply there is no legal obligation to publish the cvs of the members of its management board; highlights in that respect that the union agencies should set a model in terms of transparency and calls on the members of the management board to publish their cvs on the agency's website;


### 8. notes that , according to the court’s report , eurojust signed an it framework contract with a company which provided the same service under a previous framework contract , without prior publication of a contract notice during the negotiated procurement procedure; notes that all payments made under that framework contract and all related specific contracts are irregular and that a simplified procedure is only acceptable under specific circumstances which were not substantiated by eurojust; notes eurojust’s reply that the negotiated procedure was done on the basis of article 134 (f) of the rules of application of the commission delegated regulation (eu) 2015/246216 , which allow this procedure to be used where a change of supplier would result in incompatibility or disproportionate technical difficulties in operation and maintenance; ### 8. notes that , according to the court’s report , eurojust signed an it framework contract with a company which provided the same service under a previous framework contract , without prior publication of a contract notice during the negotiated procurement procedure; notes that all payments made under that framework contract and all related specific contracts are irregular and that a simplified procedure is only acceptable under specific circumstances which were not substantiated by eurojust; acknowledges from eurojust’s reply that the negotiated procedure was done on the basis of article 134 (f) of the rules of application of the commission delegated regulation (eu) 2015/246216 , which allow this procedure to be used where a change of supplier would result in incompatibility or disproportionate technical difficulties in operation and maintenance , and that , therefore , this solution was considered to be the most cost-effective; calls on eurojust to ensure compliance with public procurement rules;


### 10. notes that , in light of the observations from the discharge authority , the publication of declarations of interest are at present being addressed by the project team on rules of procedure in the draft code of ethics for the college of eurojust; notes that eurojust adopted the updated anti-fraud strategy through college decision 2018-19 of 6 november 2018; ### 10. welcomes the fact that , in light of the observations from the discharge authority , the publication of declarations of interest in the draft code of ethics for the college of eurojust are at present being addressed by the project team on rules of procedure; notes that for the time being eurojust has published declarations of absence of conflict of interest; calls on eurojust to also publish the cvs of the management board members and of its executive leadership; notes that eurojust adopted the updated anti-fraud strategy through college decision 2018-19 of 6 november 2018;


### 9. recalls from the court´s report that by the end of 2017 the agency had not yet introduced all the tools launched by the commission aiming to introduce a single solution for the electronic exchange of information with third parties participating in public procurement procedures (e-procurement); notes that according to the agency’s reply , it has introduced e-invoicing and e-tendering , and it intends to adopt e-submission; ### 9. recalls from the court´s report that by the end of 2017 the agency had not yet introduced all the tools launched by the commission aiming to introduce a single solution for the electronic exchange of information with third parties participating in public procurement procedures (e-procurement); notes that according to the agency’s reply , it has introduced e-invoicing and e-tendering , and it intends to adopt e-submission; calls on the agency to report to the discharge authority on the progress made in this regard by june 2020;


### 10. notes with concern that the agency awarded a framework contract for travel arrangements for its own staff and for participants in training , without requesting an explanation from the winning tenderer for its potentially abnormally low tender; notes that according to the agency’s reply , it accepts the court’s observation that this assessment was not formalised in the evaluation report; calls on the agency to request and analyse the reasons behind potentially abnormally low tenders; ### 10. notes with concern that the agency awarded a framework contract for travel arrangements for its own staff and for participants in training , without requesting an explanation from the winning tenderer for its potentially abnormally low tender; notes that according to the agency’s reply , the evaluation committee did not proceed in seeking clarifications because , due to their daily work , they were already aware of the prices charged by the company holding the previous contract; acknowledges that the agency accepts the court’s observation that this assessment was not formalised in the evaluation report; calls on the agency to request and analyse the reasons behind potentially abnormally low tenders , and to ensure that all assessments are adequately formalised in future evaluation reports;


### 11. acknowledges the agency’s existing measures , and its ongoing efforts in relation to securing transparency , in relation to prevention and management of conflicts of interests , and in relation to whistle-blower protection; expresses satisfaction that the agency has set up and implemented internal rules on whistleblowing; ### 11. appreciates the agency’s existing measures , and its ongoing efforts in relation to securing transparency , in relation to prevention and management of conflicts of interests , and in relation to whistle-blower protection; expresses satisfaction that the agency has set up and implemented internal rules on whistleblowing and that it has published cvs and declarations of interest for members of the management board and of the executive director;


### 2. recalls that the edps is neither covered by the report of the european court of auditors (‘the court’) on the implementation of the 2018 eu budget nor the 2018 report on union agencies and other bodies; takes note of the court’s position that the small budget of the edps , its low volume of financial transactions and the low level of assessed risks do not justify the publication of such reports; stresses , however , that information regarding the results of external independent audits by the court should be publicly available for all unions bodies; calls therefore on the court to reconsider its position and start publishing audit reports covering the edps from the coming year; highlights that the independence of the edps should not prevent the court from publishing audit reports on this union body; ### 2. recalls that the edps is not a decentralised union agency and takes the view that even if its budget represents a very small percentage of the union budget , the legality and regularity of edps transactions should nevertheless be properly examined by the court as transparency is vital for the appropriate functioning of all union bodies; notes that the edps is neither covered by the report of the european court of auditors (‘the court’) on the implementation of the 2018 eu budget nor the 2018 report on union agencies and other bodies; stresses , however , that information regarding the results of external independent audits by the court should be publicly available for all unions bodies; calls therefore on the court to reconsider its position and start publishing audit reports covering the edps from the coming year; requests therefore that the court issues separate annual activity reports on the annual accounts of this important union body which aims to ensure that european institutions and bodies fully respect the right to privacy and data protection;


### 6. takes note of the follow-up of the ep resolution concerning the discharge of the 2017 budget; notes that the edps has tackled the issues of retaliation and whistleblowing in its code of conduct for staff and has shown commitment to raise awareness regarding this issue among its staff. ### 6. takes note of the follow-up of the ep resolution concerning the discharge of the 2017 budget; notes that the edps has tackled the issues of retaliation and whistleblowing in its code of conduct for staff and has shown commitment to raise awareness regarding this issue among its staff; welcomes the positive trend towards a gender balance;


### 16. reiterates the importance of data protection in relation to cybersecurity; notes that the scandal over the misuse of facebook data by cambridge analytica and the growing evidence of illegal interference in elections request responses from the edps; underlines that the edps must fight against potential misuse of digital data; ### 16. reiterates the importance of data protection in relation to cybersecurity; welcomes the edps' efforts in providing guidance to the union institutions on how to protect personal data when implementing cybersecurity measures , how comprehensive information security management systems serve as the basis for fulfilling both data protection and cybersecurity obligations and on how to carry out data protection notification and information obligations in relation to personal data breaches; notes that the scandal over the misuse of facebook data by cambridge analytica and the growing evidence of illegal interference in elections request responses from the edps; underlines that the edps must fight against potential misuse of digital data;


### 17. welcomes that the decision on anti-harassment has been made available to the entire staff via the edps intranet; notes that 69 % of colleagues acknowledged in the 2018 staff survey that they are aware of the existing policy on psychological and sexual harassment; welcomes that in 2018 a team of two confidential counsellors was set up; ### 17. welcomes that the decision on anti-harassment has been made available to the entire staff via the edps intranet; notes with appreciation that the edps is currently working on revising the anti-harassment decision , as well as on a mandate to appoint additional confidential counsellors; notes that 69 % of colleagues acknowledged in the 2018 staff survey that they are aware of the existing policy on psychological and sexual harassment; welcomes that in 2018 one confidential counsellor was trained;


### 23. welcomes that the importance of the edps communication activities has increased considerably over the past years; recognises the efforts to improve the impact of its online presence; notes the organisation of two important communication campaigns , namely the 2018 international conference focusing on debating ethics by reaching the widest possible audience with the debate on digital ethics , and , in december 2018 , its communication campaign on the new data protection regulation for the union institutions; ### 23. welcomes that the importance of the edps communication activities has increased considerably over the past years; recognises the efforts to improve the impact of its online presence; notes the organisation of two important communication campaigns , namely the 2018 international conference focusing on debating ethics by reaching the widest possible audience with the debate on digital ethics , and , in december 2018 , its communication campaign on the new data protection regulation for the union institutions; further encourages the use of free open-source self-hosted social network platforms having special regard to users data protection;


### article 80 ### deleted


### (2) an integrated financial system will enhance the resilience of the economic and monetary union to adverse shocks by facilitating private cross-border risk-sharing , while at the same time reducing the need for public risk-sharing. in order to achieve these objectives , the union should complete the banking union and further develop a capital markets union (cmu). addressing high stocks of npls and their possible future accumulation is essential to completing the banking union as it is essential for ensuring competition in the banking sector , preserving financial stability and encouraging lending so as to create jobs and growth within the union. ### (2) addressing high stocks of npls and their possible future accumulation is essential to completing the banking union as it is crucial for ensuring competition in the banking sector and preserving financial stability.


### (6) this directive should enable credit institutions to better deal with loans once these become non-performing by improving conditions to either enforce the collateral used to secure the credit or to sell the credit to third parties. the introduction of accelerated collateral enforcement as a swift mechanism for the recovery of collateral value would reduce the costs for resolving npls and would hence support both credit institutions and purchasers of npls in recovering value. moreover , when credit institutions face a large build-up of npls and lack the staff or expertise to properly service them , one viable solution would be to either outsource the servicing of these loans to a specialised credit servicer or to transfer the credit agreement to a credit purchaser that has the necessary risk appetite and expertise to manage it. ### deleted


### (7) the two solutions for credit institutions to deal with npls provided for by this directive are mutually reinforcing. the shorter time for enforcement and the increased recovery rates , as expected with accelerated extrajudicial collateral enforcement increases the value of an npl. in turn , this would raise bid prices in npl transactions. a further effect is that selling npls will be less complicated if the loan is collateralised. the reason for this is that price determination is simpler for a collateralised npl than an unsecured one in a secondary market transaction because the value of the collateral sets a minimum value of a npl. with a more liquid and better functioning secondary market for npls where investors would show greater interest for npls incorporating the accelerated enforcement feature , there would be additional incentives for credit institutions to use accelerated extrajudicial collateral enforcement at the time of issue of the new loans. moreover , the harmonisation achieved by this directive would foster development of pan-union npl investors , thus further improving market liquidity. ### deleted


### (9) this directive should foster the development of secondary markets for npls in the union by removing impediments to the transfer of npls by credit institutions to non-credit institutions , while at the same time safeguarding consumers' rights. any proposed measure should also simplify and harmonise the authorisation requirements for credit servicers. this directive should therefore establish a union-wide framework for both purchasers and servicers of credit agreements issued by credit institutions. ### (9) this directive should aim at regulating existing secondary markets for npls in the union by safeguarding consumers' rights. any proposed measure should also simplify and harmonise the authorisation requirements for credit servicers. this directive should therefore establish a union-wide framework for credit institutions , credit purchasers , credit servicers and credit service providers.


### (22) union credit institutions and their subsidiaries undertake credit servicing activities as part of their normal business. they have the same obligations with regard to credit they have issued themselves and credit they purchased from another credit institution. since they are already regulated and supervised , application of this directive to their credit servicing or purchasing activities would mean unnecessary duplication of authorisation and compliance costs and therefore they are not covered by this directive. ### (22) union credit institutions undertake credit servicing activities as part of their normal business. they have the same obligations with regard to credit agreements that they have issued themselves and those purchased from another credit institution or which they service on behalf of a credit purchaser. since they are already regulated and supervised , application of this directive to their credit servicing or purchasing activities would mean unnecessary duplication of authorisation and compliance costs and therefore they are not covered by this directive. also , the outsourcing by the credit institutions of credit servicing activities , in relation to both performing and non-performing credit agreements , to credit servicers or other third parties , is outside the scope of this directive because the credit institutions already have to observe the applicable outsourcing rules. moreover , creditors that are not credit institutions but are nevertheless regulated and supervised by a competent authority of a member state in accordance with directive 2008/48/ec and directive 2014/17/eu and undertake credit servicing activities for loans granted to consumers as part of their normal business are not covered by this directive when performing in that member state credit servicing activities for loans issued by credit institutions. further , alternative investment fund manager , management company and investment company (provided that the investment company has not designated a management company) authorized or registered under directive 2011/61/eu or directive 2009/65/ec should not fall within the scope of this directive. also , there are some professions that undertake ancillary activities similar to servicing activities namely public notaries , lawyers , bailiffs and officials that perform under national law court provisions and implement the enforcement of binding measures and , therefore , member states may decide not to apply this directive for those professions.


### (31) where a credit institution transfers a credit agreement , they should be required to inform their supervisor and the competent authority for supervising compliance with this directive about the main characteristics of the transferred credit portfolio and the identity of the purchaser and , where applicable , its representative in the union. that competent authority should be obliged to transmit that information to the authorities competent to supervise the credit purchaser and the competent authority where the borrower is established. such transparency requirements allow for a harmonised and effective monitoring of the transfer of credit agreements within the union. ### (31) where a credit institution transfers a credit agreement , they should be required to inform their supervisor and the competent authority for supervising compliance with this directive on a quarterly basis and on an aggregated level about at least the aggregated outstanding balance of the transferred credit portfolio as well as number and size of the loans included and whether it includes agreements concluded with consumers. for each portfolio transferred in a single transaction information should include the legal entity identifier , or when not available the identity and address of the purchaser and , where applicable , its representative in the union. that competent authority should be obliged to transmit that information to the authorities competent to supervise the credit purchaser. such transparency requirements allow for a harmonised and effective monitoring of the transfer of credit agreements within the union. in order to comply with the principle of proportionality , competent authorities should , in order to avoid the duplication , take into account information that is already available to them by other means , in particular as regards credit institutions. it remains understood that the notification requirements to the national competent authority on a credit portfolio once such portfolio has been transferred to a credit purchaser is under the responsibility of the latter. in addition , in case of securitisation transactions , where mandatory transparency templates are foreseen , any double reporting according to this directive should be avoided.


### (33) since the valuation of a portfolio of non-performing credit is complicated and complex , actual buyers on secondary markets are sophisticated investors. often they are investment funds , financial institutions or credit institutions. as they are not creating new credit , but are buying existing credit at own risk , they do not cause prudential concerns and their potential contribution to systemic risk is negligible. it is therefore not justified to require those types of investors to apply for an authorisation or to set special conditions for them to engage in such activities. it is however important that union and national consumer protection rules continue to apply and the borrowers' rights continue to be those arising from the initial credit agreement. ### (33) since the valuation of a portfolio of non-performing credit is complicated and complex , actual buyers on secondary markets are sophisticated investors. often they are investment funds , financial institutions or credit institutions. as they are not creating new credit , but are buying existing credit at own risk , they do not cause prudential concerns and their potential contribution to systemic risk is negligible. it is therefore not justified to require those types of investors to apply for an authorisation or to set special conditions for them to engage in such activities. it is however important that union and national consumer protection rules continue to apply and the borrowers' rights continue to be those arising from the initial credit agreement. however , credit purchasers that are not credit institutions but are nevertheless regulated or supervised by a competent authority of a member state may provide in certain cases new credit to business borrowers in an effort to exercise reasonable recovery measures.


### credit servicers acting on behalf of a credit institution or a credit purchaser in respect of a credit agreement issued by a credit institution or by its subsidiaries; ### credit servicers of creditor's rights under a credit agreement or of the credit agreement itself , issued by a credit institution , its subsidiaries established in the union or other creditors , who are creditors or act on behalf of a credit purchaser or a credit institution;


### credit purchasers of a credit agreement issued by a credit institution or by its subsidiaries; ### credit purchasers of a creditor's rights under a credit agreement or of the credit agreement itself issued by a credit institution , its subsidiaries established in the union or other creditors;


### a supplementary common accelerated extrajudicial collateral enforcement mechanism in respect of secured credit agreements concluded between creditors and business borrowers which are secured by collateral. ### deleted


### a credit servicer of a credit agreement issued by a credit institution established in the union or by its subsidiaries established in the union which acts on behalf of a creditor , in accordance with applicable union or national law. ### credit servicers of creditor's rights under a credit agreement or of the credit agreement itself , which acts on behalf of a creditor , in accordance with applicable union or national law.


### a credit purchaser of a credit agreement issued by a credit institution established in the union or by its subsidiaries established in the union , whereby the credit purchaser assumes the creditor's obligations under the credit agreement , in accordance with applicable union and national law; ### credit purchasers of a creditor's rights under a credit agreement or of the credit agreement itself whereby the credit purchaser assumes the creditor's obligations under the credit agreement , in accordance with applicable union and national law;


### 2. articles 3 , 23 to 33 and 39 to 43 of this directive shall apply to secured credit agreements concluded between creditors and business borrowers which are secured by any movable and immovable assets owned by the business borrower and which have been posed as collateral to a creditor in order to secure repayment of claims arising from the secured credit agreement. ### deleted


### 3. this directive does not affect the protection granted to consumers , pursuant to directive 2014/17/eu , directive 2008/48/ec , council directive 93/13/eec and the national provisions transposing them , with regard to credit agreements falling within its scope. ### 3. with regard to credit agreements falling within its scope , this directive shall not affect neither contract law principles or civil law principles under national law with regard to the transfer of creditor’s rights under a credit agreement or of the credit agreement itself , nor the protection granted to consumers or borrowers pursuant in particular , to regulation (eu) no 1215/2012 , regulation (ec) no 593/2008 , directive 2014/17/eu , directive 2008/48/ec , council directive 93/13/ec and the national provisions transposing them or other relevant union law and national consumer protection laws.


### 4. articles 3 to 22 and 34 to 43 of this directive shall not apply to the following: ### deleted


### the transfer of credit agreements transferred before the date referred to in the second subparagraph of article 41(2). ### the transfer of creditor’s rights or the credit agreement itself transferred before the date referred to in the second subparagraph of article41(2).


### 5. articles 3 , 23 to 33 and 34 to 43 of this directive shall not apply to: ### deleted


### (5) 'credit agreement' means an agreement as originally issued , modified or replaced , whereby a creditor grants or promises to grant a credit in the form of a deferred payment , a loan or other similar financial accommodation; ### (5) 'credit agreement' means an agreement by a credit institution or any other creditor as originally issued , modified or replaced , whereby a creditor grants or promises to grant a credit in the form of a deferred payment , a loan or other similar financial accommodation


### (7) 'credit purchaser' means any natural or legal person other than a credit institution or a subsidiary of a credit institution which purchases a credit agreement in the course of his trade , business or profession; ### (7) 'credit purchaser' means any natural or legal person which purchases a credit agreement in the course of his trade , business or profession;


### (8) 'credit servicer' means any natural or legal person , other than a credit institution or its subsidiaries , which carries out one or more of the following activities on behalf of a creditor: ### deleted


### are of sufficiently good repute; ### are of sufficiently good repute on the basis of article 5a;


### 1. member states shall ensure that the competent authorities of the home member state may withdraw the authorisation granted to a credit servicer , where such a credit servicer either: ### 1. member states shall ensure that the competent authorities of the home member state have the necessary supervisory , investigatory and sanctioning powers in accordance with article 21 in order to withdraw the authorisation granted to a credit servicer , where such a credit servicer either: