EUROPEAN COMMISSION Brussels, 5.2.2019 COM(2019) 71 final Recommendation for a COUNCIL DECISION authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185)



EXPLANATORY MEMORANDUM 1.CONTEXT The evolution of information and communication technologies – while bringing unprecedented opportunities for mankind – also raises challenges, including for criminal justice and thus for the rule of law in cyberspace. While cybercrime and other offences entailing electronic evidence on computer systems are thriving and while evidence relating to these offences is increasingly stored on servers in foreign, multiple, shifting or unknown jurisdictions, that is, in the cloud, the powers of law enforcement remain limited by territorial boundaries. The European Commission committed in the April 2015 European Agenda of Security to review obstacles to criminal investigations into cyber-enabled crimes, notably on cross-border access to electronic evidence. On 17 April 2018, the Commission proposed to the Council and the European Parliament a Regulation on European Production and Preservation orders for electronic evidence in criminal matters and a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings ("e-evidence proposals"). The purpose of these proposals is to speed up the process in the European Union to secure and obtain electronic evidence that is stored and/or held by service providers established in another jurisdiction. The Council of Europe Convention on Cybercrime The Council of Europe Convention on Cybercrime (CETS No. 185) aims at facilitating the fight against criminal offences making use of computer networks. It contains provisions (1) harmonising domestic criminal substantive law elements of offences and connected provisions in the area of cyber-crime, (2) provides for domestic criminal procedural law powers necessary for the investigation and prosecution of such offences as well as other offences committed by means of a computer system or evidence in relation to which is in electronic form, and (3) aims to set up a fast and effective regime of international cooperation. The Convention is open to Member States of the Council of Europe and non-members. 62 countries are currently Parties to the Convention, including 26 European Union Member States. The Convention does not envisage that the European Union may accede to the Convention. The European Union is nevertheless recognised as an Observer Organisation to the Convention Committee (T-CY). On that basis the European Union takes part in meetings of the Convention Committee. Article 46.1.c of the Convention provides that the Parties shall, as appropriate, consult periodically with a view to facilitating consideration of possible supplementation or amendment of the Convention. The Parties to the Convention on Cybercrime have been looking for some time now into existing challenges and obstacles to access by national judicial and police authorities to electronic evidence of crimes under criminal investigation in form of computer data, that is from 2012 to 2014 through a working group on transborder access to data and from 2015 to 2017 through the Cloud Evidence Group. Negotiations for a Second Additional Protocol to the Convention After proposals from the Cloud Evidence Group, the Cybercrime Convention Committee (T-CY) adopted several Recommendations, including on the negotiation of a Second Additional Protocol to the Convention on Cybercrime on enhanced international cooperation (‘Second Additional Protocol’). In June 2017, the Cybercrime Convention Committee approved the Terms of Reference for the preparation of the Second Additional Protocol during the period from September 2017 to December 2019. In accordance with the Terms of Reference, the Second Additional Protocol may include the following elements: ·Provisions for more effective mutual legal assistance, in particular: –a simplified regime for mutual legal assistance requests for subscriber information; –international production orders; –direct cooperation between judicial authorities in mutual legal assistance requests; –joint investigations and joint investigation teams; –requests in English language; –audio/video hearing of witnesses, victims and experts; –emergency Mutual Legal Assistance (MLA) procedures; ·Provisions allowing for direct cooperation with service providers in other jurisdictions with regard to requests for subscriber information, preservation requests, and emergency requests;

·Clearer framework and stronger safeguards for existing practices of transborder access to data; ·Safeguards, including data protection requirements. Negotiations of different provisions of the Second Additional Protocol are progressing at different speeds. The current situation in the working groups on the four main blocks of work outlined in the terms of reference are as follows: ·Provisions on “Languages of requests” and “Emergency mutual assistance” were preliminarily adopted by the Protocol Drafting Plenary in July 2018. ·Provisions on “Video conferencing” were preliminarily adopted by the Protocol Drafting Plenary in November 2018. ·The Protocol Drafting Plenary in November 2018 also allowed for detailed discussions (provisions on “Jurisdiction” and “Endorsement model”) and updates (“Direct cooperation with providers”, “International production orders”, “Extending searches/access based on credentials”, “Joint investigations and joint investigation teams” and “Investigative techniques”). ·Sufficient progress has not yet been made on other issues (safeguards, including data protection requirements). 2.OBJECTIVES OF THE PROPOSAL This recommendation is submitted to the Council in order to receive authorisation to participate in negotiations on behalf of the European Union and its Member States on a Second Additional Protocol, to adopt negotiating directives and to appoint the Commission as negotiator in accordance with the draft negotiating directives attached, pursuant to Article 218 TFEU. Article 3(2) TFEU provides that the Union has exclusive competence “for the conclusion of an international agreement ... in so far as its conclusion may affect common rules or alter their scope.” An international agreement may affect common rules or alter their scope where the area covered by the agreement overlaps with Union legislation or is covered to a large extent by Union law. The European Union has adopted common rules based on Article 82(1) and 16 TFEU on elements being considered for the Second Additional Protocol. The current European Union legal framework includes in particular instruments on law enforcement and judicial cooperation in criminal matters, such as the Directive 2014/41/EU regarding the European Investigation Order in criminal matters, the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union, Regulation 2018/1727 on Eurojust, Regulation 2016/794 on Europol, Council Framework Decision 2002/465/JHA on joint investigation teams, Council Framework Decision 2009/948/JHA on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings. Moreover, the Union has adopted several directives that reinforce procedural rights of suspects and accused persons. Externally, the European Union has concluded a number of bilateral agreements between the Union and third countries, such as the Agreements on Mutual Legal Assistance between the European Union and the United States of America and between the European Union and Japan. The protection of personal data is a fundamental right enshrined in EU Treaties and in the Charter of Fundamental Rights of the European Union and personal data may only be processed in accordance with the Regulation (EU) 2016/679 (the General Data Protection Regulation) and Directive (EU) 2016/680 (the Police Data Protection Directive). The fundamental right of everyone to the respect for his or her private and family life, home and communications is also enshrined in the Charter of Fundamental Rights, and includes the respect for the privacy of one’s communications as an essential element. Electronic communications data can only be processed in accordance with Directive 2002/58/EC (the ePrivacy Directive). Moreover, to assess whether an area is largely covered by common rules account must be taken not only of Union law as it currently stands in the area concerned, but also of its future development, in so far as that is foreseeable at the time of that analysis. The area covered by the Second Additional Protocol is of direct relevance to foreseeable future developments of the relevant common rules. In this respect, the Commission's April 2018 proposals on cross-border access to electronicevidence are also relevant. The scope of the proposals includes specific types of service providers that are providing services in the European Union. A provider is offering services in the European Union when it enables users in one or more Member States to use its services and where it has a substantial connection to the Union, for instance when it has an establishment in a Member State or because it provides services to a large number of users in that Member State. Those without a presence in the European Union are obliged to appoint a legal representative against whom production orders can be enforced. The European Council Conclusions of 18 October state that “Solutions should be found to ensure swift and efficient cross-border access to e-evidence in order to effectively fight terrorism and other serious and organised crime, both within the EU and at international level; the Commission proposals on e-evidence and access to financial information, as well as to better combat money laundering, should be agreed on by the end of the legislature. The Commission should also urgently submit negotiating mandates for the international negotiations on e-evidence”. The Commission's e-evidence proposals provide the basis for a coordinated and coherent approach both within the European Union and by the European Union at international level, with due regard to European Union rules, including on non-discrimination between European Union Member States and their nationals. While the Commission, in its Impact Assessment for the e-evidence proposals, already noted that the proposals could usefully be complemented by bilateral or multilateral agreements on cross-border access to electronic evidence with accompanying safeguards, the Commission decided to propose EU rules on the appropriate modalities and safeguards for cross-border access to electronic evidence, before engaging in international negotiations with third parties. At the international level, the Commission has continued to participate as observer in related discussions within the framework of the Council of Europe Convention on Cybercrime. Cross-border access to electronic evidence has been a regular point on recent EU-US Justice and Home Affairs Ministerial meetings. The two recommendations to participate in the negotiations of the Second Additional Protocol to the Convention on Cybercrime and to open negotiations with the United States of America are being adopted by the Commission at the same time. While the two processes will progress at a different pace, they address inter-linked issues and commitments taken in one negotiation may have a direct impact on other strands of negotiations. While the e-evidence proposals address the situation of specific types of service providers providing services on the EU market, there is a risk of conflicting obligations with laws in third countries. In order to address these conflicts of law, and in line with the principle of international comity, the e-evidence proposals include provisions for specific mechanisms in case a service provider is confronted with conflicting obligations deriving from the law of a third country when evidence is requested. These mechanisms include a review procedure to clarify such a situation. The Second Additional Protocol to the Council for Europe Convention on Cybercrime should aim to avoid conflicting obligations between the Parties to the Convention on Cybercrime.

It can therefore be considered that the conclusion of the Second Additional Protocol may affect common rules or alter their scope. The Union accordingly has exclusive competence for the negotiation of the Second Additional Protocol supplementing the Convention on Cybercrime (by virtue of Article 3(2) TFEU). The subject matter of the Second Additional Protocol would fall within EU policies and competences, in particular in the field of instruments on judicial cooperation in criminal matters (Article 82(1) TFEU) and data protection (16 TFEU) and, as a matter of EU law, negotiations could not be conducted without EU participation. Moreover, the Commission has a general role in representing the European Union provided for in Article 17(1) TEU. In view of the above, the Commission should be appointed by the Council as the negotiator for the Second Additional Protocol supplementing the Convention on Cybercrime (CETS No. 185). 3.RELEVANT PROVISIONS IN THE POLICY AREA The negotiations should ensure that the agreed provisions are compatible with EU law and Member States’ obligations under it, taking also account of its future development. Moreover, it will also be necessary to ensure that the Second Additional Protocol will include a disconnection clause allowing the European Union Member States that become Parties to the Second Additional Protocol to regulate the relations among themselves on the basis of EU law. In particular, the functioning of the European Commission’s e-evidence proposals, including as they evolve in the legislative procedure negotiations by the co-legislators and eventually in their final (adopted) form, should be preserved amongst European Union Member States. The Second Additional Protocol should include the necessary safeguards for fundamental rights and freedoms recognised by the Charter of Fundamental rights of the European Union, in particular the right to private and family life, home and communications recognised in article 7 of the Charter, the right to protection of personal data recognised in Article 8 of the Charter, the right to effective remedy and fair trial recognised in Article 47 of the Charter, the presumption of innocence and right of defence recognised in Article 48 of the Charter and principles of legality and proportionality of criminal offences and penalties recognised in Article 49 of the Charter. The Second Additional Protocol should be applied in accordance with those rights and principles. Appropriate data protection and privacy safeguards for the collection, transfer and subsequent use of personal data and electronic communications data must be part of the protocol so as to ensure full compliance by EU service providers with their obligations under EU data protection and privacy laws, insofar as such an international agreement could provide a legal basis for data transfers in reaction to production orders or requests issued by an authority from a non-EU Party to the Additional Protocol requiring a controller or processor to disclose personal data and electronic communications data. They should thus ensure the protection of fundamental rights and freedoms of EU citizens, including privacy and personal data protection when personal data or electronic communications data is disclosed to law enforcement authorities in countries outside the European Union. In view of the absence of provisions for authorities to access data without the help of an intermediary (‘direct access’) in the European Commission’s e-evidence proposals, any use of those measures can only be based on national law. Where the Second Additional Protocol may include provisions in relation to the ‘Extension of searches and access based on credentials’ and ’Investigative Techniques’, the main aim should be to pursue stronger safeguards for such cross-border direct access to data to ensure the protection of fundamental rights and freedoms of EU citizens, including privacy and personal data protection. The conclusion of the Second Additional Protocol should allow for the conclusion of bilateral agreements or treaties between the Parties to the Protocol and between the Parties of the Protocol and the European Union, governing their relations. To this end, an appropriate clause should be inserted envisaging that if two or more Parties to the Convention have already concluded an agreement or treaty on the matters dealt with in the Convention, or should they in future do so, they are entitled to apply that agreement or treaty or to regulate those relations accordingly, provided that this is done in a manner that is consistent with the Convention’s objectives and principles. The agreement between the European Union and the United States on cross-border access to electronic evidence for judicial cooperation in criminal matters should, in the bilateral relations between the United States of America and the European Union, take precedence over any agreement or arrangement reached in the negotiations of the Second Additional Protocol, in so far as it covers the same issues.



Recommendation for a COUNCIL DECISION authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185) THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 218(3) and (4) thereof, Having regard to the recommendation from the European Commission, Whereas: (1)On 9 June 2017, the Committee of Parties to the Council of Europe Convention on Cybercrime (CETS No. 185) (T-CY) adopted a decision adopting the Terms of Reference for the preparation of a Second Additional Protocol to the Convention. (2)The Terms of Reference for the Second Additional Protocol include the following elements for reflection: provisions for more effective mutual legal assistance (a simplified regime for mutual legal assistance requests for subscriber information; international production orders; direct cooperation between judicial authorities in mutual legal assistance requests; joint investigations and joint investigation teams; requests in English language; audio/video hearing of witnesses, victims and experts; emergency Mutual Legal Assistance procedures); provisions allowing for direct cooperation with service providers in other jurisdictions with regard to requests for subscriber information, preservation requests, and emergency requests; clearer framework and stronger safeguards for existing practices of transborder access to data; safeguards, including data protection requirements. (3)The Union has adopted common rules that overlap to a large extent with the envisaged elements being considered for the Second Additional Protocol. This includes in particular a comprehensive set of instruments in order to facilitate judicial cooperation in criminal matters, to ensure minimum standards of procedural rights, as well as data protection and privacy safeguards.