Source: https://eucrim.eu/articles/european-commissions-proposal-cross-border-access-e-evidence/
Timestamp: 2019-04-25 00:46:35+00:00

Document:
With human activity becoming more and more dependent on digital technologies, criminal investigations increasingly depend on digital evidence. Yet the gathering of this type of evidence is far from straightforward. Besides technological challenges, one of the major obstacles that law enforcement authorities encounter is the fact that the data they need is often stored abroad or by a foreign service provider. At the international level, this results in the need to resort to mutual legal assistance and, at the EU level, to the European Investigation Order. Even the length of the procedure when resorting to the EIO is far too slow, because relevant data can be lost in the meantime. This article discusses the initiative of the European Commission to establish a European legal framework regarding direct requests for electronic evidence sent by law enforcement authorities in the EU to service providers in another EU Member State (the "e-evidence initiative"). The initiative, which is currently under debate in the EU Parliament after the Council agreed on proposed amendments, is not without controversy. The article analyses its overall structure and the most important aspects of its design, and it offers critical remarks on several major elements of the initiative.
A large number of criminal offences, not only cybercrime, is currently committed in a way that leaves digital traces that can serve as evidence. In order to effectively investigate and prosecute these offences, law enforcement must have access to digital data, which is mostly in the possession of service providers, often located abroad. The law of criminal procedure allows the authorities to access this data, while protecting suspects’ procedural safeguards. However, when the service provider is located in another country or the data is stored abroad, law enforcement should in principle resort to mutual legal assistance (MLA) because their coercive powers are limited to their national territory.
With the Conclusions of 9 June 2016 the JHA Council requested the Commission to develop a legal framework that would allow law enforcement to obtain relevant data.3 This request led to the proposal of the Commission of 17 April 2018 that is composed of two instruments: a regulation and a directive.4 The aim of this contribution is to provide an overview of and a few critical remarks on the Commission’s proposal, in particular focusing on the draft regulation, which is the main component of the legislative initiative.
At the same time, legislative work has also progressed in the U.S., with the ultimate adoption of the CLOUD Act in March 2018, which is meant to facilitate access to data held by U.S. companies by non-U.S. law enforcement authorities. This act is the subject of the contribution by Jennifer Daskal in this issue of eucrim.
The envisaged regulation would create two new instruments: a European Production Order (EPdO) and a European Preservation Order (EPsO).5 An EPdO is defined as “a binding decision by an issuing authority of a Member State compelling a service provider offering services in the Union and established or represented in another Member State, to produce electronic evidence” (Art. 2(1) of the draft regulation6). An EPsO is “a binding decision by an issuing authority of a Member State compelling a service provider offering services in the Union and established or represented in another Member State, to preserve electronic evidence in view of a subsequent request for production” (Art. 2(2)). It is interesting to note that an EPsO may result not only in an EPdO, but also for instance in a mutual legal assistance request or a European Investigation Order (Art. 6(2)).
The crucial characteristic of the Commission’s proposal is that the orders goes from the issuing authority in one Member State directly to the service provider in another Member State and the data should go back the same way. The involvement of an authority in the executing state is, in principle, avoided and the basic check of the order is done by the service provider. In order to guarantee the effectiveness of the regulation, the second piece of the Commission’s proposal, i.e. the directive, obliges the Member States to provide for a framework assuring that there is a known and empowered legal representative of a service provider to whom the order may be addressed. The choice both of the legal basis and of the legal instrument is noteworthy: The directive, which must be transposed by the EU Member States, has an internal market legal basis (see also 2. below), whereas the – binding and directly applicable − regulation is based on Art. 82(1) TFEU, which provides for judicial cooperation in criminal matters on the basis of the mutual recognition principle. While being a regulation, a number of issues will have to be clarified by national law, most notably sanctions and remedies (see below).
a) What may an order be issued for?
The EPdO and the EPsO have the same objective: they oblige the service provider to respectively produce or preserve electronic evidence. The term “electronic evidence” is explained in Art. 2(6). This definition is characterised by three elements: Firstly, evidence must be stored in an electronic form either by the service provider or on its behalf. Secondly, it has to be stored at the time of receipt of the EPdO or EPsO. This means that the order concerns the data that is already in the possession of the service provider and not any data to be obtained in the future, thus excluding any future surveillance. Thirdly, the term evidence is not defined as such, but the definition provides for four types of data of which that evidence might consist: subscriber data, access data, transactional data and content data.
These four categories of data are further defined in the draft regulation in Art. 2(7)–(10). The spectrum includes content and non-content data, with the latter being divided into three categories (subscriber data, access data, transactional data). In terms of infringement of fundamental rights, the regulation provides two groups of categories of data: subscriber and access data on the one hand, which are considered less intrusive, and transactional and content data, where the intrusiveness is deemed more significant. The differentiation particularly affects the possibility of using the order, which is limited to some categories of offences for the second group, whereas it is open to all offences for subscriber and access data. Furthermore, the differentiation has an impact on the radius of the action of the prosecutor’s, who is excluded from the list of competent issuing authorities when it comes to transactional and content data. As per the Explanatory Memorandum to the proposal, the differentiation between the two categories is made according to the following philosophy: data related only to the identification of the user is less intrusive and can be made more accessible, whereas data involving predominantly the content of a person’s activity should be more protected.7 The Explanatory Memorandum considers that the starting point of an investigation is often the subscriber data or access data in order to reveal the identity of the suspect, before data about the content is sought.
b) Who may issue the order?
While the Member States may differ as to which authorities they give the right to ask for data from service providers in the national context, the draft proposes a quasi-harmonised approach in that regard. It should be borne in mind, that no margin of discretion is allowed, because no implementation of the provisions of a regulation is needed (see above). The Commission singled out three categories of authorities that can be entitled to issue an EPdO or EPsO (Art. 4).
The first group contains authorities that are entitled to issue both types of orders and for all types of data: judges, courts and investigative judges. The second group is composed of prosecutors whose authority is limited to what the draft considers to be less sensitive measures (cf. recital 30 of the preamble). Prosecutors may issue an EPsO for any type of data, but an EPdO only for subscriber and access data. Given the fact that a regulation (and not a directive) will be enacted, it does not seem to be possible for the Member States to restrict the circle of authorities entitled to issue the orders, e.g. by further limiting the power of the prosecutor. As a result, it may happen that a prosecutor might be in the position to issue an EPsO for content data at the European level, while he or she would not be able to do so in a purely domestic context.
The third group is defined as follows: “any other competent authority as defined by the issuing State which, in the specific case, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law.” Such orders will need to be examined for their conformity with the conditions set out for the validity of the orders. The authorities entitled to validate the order are the same two (aforementioned) groups as those for issuing the orders, according to the same range of competences (with the prosecutor’s competence limited to the less intrusive types of data). In other words, the third category would include authorities that are equipped with the necessary power to gather electronic evidence according to the national laws of the Member States. Thus, prosecutors can also be entitled to ask for transactional and content data, but with the necessary authorisation and conferral of powers is at the discretion of the national legislator. The language of the draft indicates that a piece of national legislation would be necessary in this respect because, contrary to other instances (e.g. Art. 5(2)), the draft regulation does not refer to similarities with national rules or comparable domestic situations.
c) Who is the recipient of the order?
Internet domain name and IP numbering services.
Another requirement is that providers of the services described above fall within the scope only if they are offering services in the Union and are established or represented in another Member State. These terms are further explained in the Directive itself (Art. 2(4)) and in the Explanatory Memorandum.10 Mere accessibility of the service from the territory of the European Union cannot be a sufficient criterion, as this would cause every provider in the world to fall within the scope. Furthermore, the service provider has to be established or represented in another EU Member State, since otherwise there would be a purely domestic situation, which is excluded from the scope.
An EPdO or an EPsO should be addressed directly to a legal representative that the service provider shall designate for the purpose of gathering evidence in criminal proceedings (Art. 7(1)). The efficiency of this approach is supported by the proposed Directive (see below 2.) and alternative addressees if such a representative is not designated (cf. Art. 7(2) – (4)).
d) Under what conditions may the order be issued?
The draft regulation provides for a set of common conditions for issuing EPdOs and EPsOs as well as specific conditions for each of them. The first common condition is that the order may be issued only for criminal proceedings, which includes the pre-trial and the trial phase (Art. 3(2)). According to Art. 3(2), the order may also be issued in proceedings against legal persons, where these persons may be held liable or punished. This formulation excludes any sort of double criminality requirement in this respect: even if the executing Member State does not provide for criminal liability of legal persons, the order still needs to be executed.
The second condition applicable to both orders refers to necessity and proportionality. The draft regulation distinguishes, however, between the two types of orders if it comes to the reference point of the evaluative criteria, which is founded in the different objectives of these instruments. The EPdO must be necessary and proportionate for the purpose of the criminal proceedings in question (Art. 5(2)). By contrast, the EPsO must be necessary and proportionate to prevent the removal, deletion or alteration of data in view of a subsequent mutual legal assistance request, a European Investigation Order or an EPdO (Art. 6 (2)).
Two additional conditions limit the issuing of an EPdO, both referring to the national law of the issuing Member State. First, a similar measure must be available for the same criminal offence in a comparable domestic situation. This excludes the use of the EPdO in an issuing Member State that does not provide for such a measure in this context, thus limiting the harmonising effect of the regulation and positioning the applicability of the EPdO within the realm of national law. This limiting effect must, however, be relativized: firstly, the limitation affects the power of the national authority, but not the foreign one. Secondly, the formulation does not state that the condition of application must be identical.
The EPdO or EPsO will be transmitted to the recipient through certificates.11 The certificates are to be issued according to the models annexed to the draft regulation (Annex I and II). Some flexibility is granted as far as the transmission of the certificate is concerned. Any means are acceptable provided that they are capable of producing a written record and allow to establish the authenticity of the certificate (Art. 8).
Tight deadlines are foreseen for the execution of the orders (Art. 9). As far as the EPdO is concerned, the draft distinguishes as follows: in regular cases, the service provider should transmit the data to the issuing authority at the latest within 10 days from the moment of receiving the certificate. In emergency cases, which are defined as an “imminent threat to life or physical integrity of a person or to a critical infrastructure,”12 this deadline is brought down to 6 hours. An EPsO has to be executed without “undue delay”.
In order to guarantee the practical effectiveness of the instrument, while taking into account potential reservations and constraints on the side of the service provider or other affected persons, the regulation provides for a set of procedures and tools, some of which are prescribed by the regulation itself, and some of which require intervention on the part of the national legislator. On the one hand, in order to accommodate the interests of the service providers, the regulation provides for instruments of dialogue13 between law enforcement and service providers in addition to remedies for the latter, the suspects and accused persons as well as for other persons whose data were obtained. On the other hand, in order to guarantee effectiveness of the measures, there are procedures for enforcement which engage authorities in the executing Member State and eventually pecuniary sanctions.
After receiving the order, the service provider would have to perform a check of the order. The draft regulation provides this as a right, but on many occasions the check will instead be a duty because of the contractual relationship with the user or data protection rules. According to the draft, there are three groups of reasons which may create difficulties for the service provider to comply with the order and for which the regulation provides ways of remedying the situation. The objections shall be transmitted to the issuing authority by using a standard form (annexed to the draft regulation).
The first group of reasons concerns the situation when the order is incomplete, contains manifest errors or does not contain sufficient information to execute. In this case, the service provider may ask for clarification. The reasons of the second group arise if the service provider is unable to execute the order because of force majeure or de facto impossibility, e.g. either because the order does not concern their customer or because the data has been deleted already. If the issuing authority confirms the objection, it shall withdraw the order. The third group of reasons is described as “other”. So, for any other reason that the service provider does not provide the requested data within the deadline or does not provide it exhaustively, it shall also send the annex to the issuing authority explaining the reasons for failing to provide the data. The only potential consequence of this action is that the issuing authority shall review the order and, if necessary, set a new deadline. This does not seem to oblige the authority to withdraw the order even if there is good reason to do so.
If the addressee does not comply with the order and the above dialogue procedure does not cause the issuing authority to accept the reasons provided, the issuing authority may transfer the order to the competent authority in the executing Member State. This transforms the procedure into a more traditional mutual recognition process: the enforcing authority should recognise the order, except if there are grounds to oppose, which are enumerated in Art. 14(4) or (5), immunity or privilege under national law, or if its disclosure may impact its fundamental interests such as national security and defence.
So far, the above rules apply to both types of orders (EPdO and EPsO). The draft regulation provides, however, an additional reason for the service provider not to provide information if it comes to the EPdO. This reason is an example of the above-mentioned “other” reasons and refers to an EPdO that “cannot be executed because based on the sole information contained in the [order] it is apparent that it manifestly violates the Charter of Fundamental Rights of the European Union or that it is manifestly abusive.” In this case, the service provider must send the respective annex to the enforcement authority in the Member State of the addressee. The latter authority may then seek clarification from the issuing authority, including through Eurojust or the European Judicial Network.
The impact of this rule is problematic. While it seemingly concerns a fundamental question – a significant abuse − it seems only procedural in nature: it requests that another authority be informed, an authority which may be potentially involved if the enforcement is needed. How should this fundamental rights clause be construed? Should it be read as if the violation or abuse is not manifest, it is not a ground to object? Or should it merely be read as saying, that if the violation or abuse is not manifest, the other authority should not receive the annex at this stage? If this provision is read together with the enforcement part, one notices that the executing state authority cannot oppose the execution of the order if it finds that it violates the Charter or that it is abusive, unless the violation/abuse is manifest. It results from this interpretation that, without the fulfilment of this adverbial condition (“manifestly”), the abuse or violation have no relevance and the execution of the EPdO would be obligatory. This is a highly questionable outcome. In addition, the Explanatory Memorandum does not explain how to interpret the word “manifest,” which usually means “obvious” or “clearly apparent.” Yet, an abuse is an abuse irrespective of whether it is visible prima facie or not. If the court in the executing member state reveals its abusiveness, why should it not be allowed to oppose the order just because it was not possible to spot it prima facie?
The draft regulation contains provisions on sanctions (Art. 13) and remedies (Arts. 15–17), although these are relatively restrained, making mostly reference to national law. The Member States are also obliged to put in place provisions on pecuniary sanctions applicable to service providers in the event of infringements of their duties (as described above). While the sanctions do not need to be of a criminal nature, they have to be effective, proportionate and dissuasive. The proposal does not clarify who shall impose a sanction and who should enforce it. It is also not clear whether good reasons to refuse providing information on the part of the service provider, such as a (non-manifest) violation of the Charter or a (non-manifest) abuse of the order (see f) above), may be taken into account in the process of imposing such sanctions.
The draft regulation further contains a chapter entitled “Remedies”, which complements the measures described above and grants rights not only to the service providers, but also to suspects and accused persons as well as other persons whose data were obtained. Except for the service providers, the remedies concerning all the other persons are to be provided by national law. Such right to an effective remedy shall be exercised before a court in the issuing state and must offer the possibility to challenge the legality of the measure, including its necessity and proportionality. The issuing authority is also responsible for informing the interested persons about that right (Art. 17). Within this framework these persons should be able to address issues of violation of the Charter or the abuse of the order.
It should also be underlined, that Art. 1(2) of the draft regulation contains the same clause as Art. 1(3) of the Framework Decision on the European Arrest Warrant, which has recently resulted in cases where the execution of the EAW was put under question or refused because of fundamental rights concerns.14 It cannot be excluded that the clause could result in similar questioning of the orders based on the same or similar concerns.
On other grounds (Art. 16).
If the court finds no relevant conflicts of law, it shall uphold the order.
If the court finds that there is a conflict because of “other grounds,” the court lifting of the order is not mandatory. The court must (only) consider the conflict when evaluating a number of criteria specified in Art. 16(5) that are based on the requirements of data protection, investigation and the addressee’s interests.
If the conflict is grounded in the protection of the fundamental rights of the individuals concerned or of the fundamental interests of the third country in relation to its national security or defence, a central authority of the third state is engaged. This authority shall respond within 15 days (a deadline that may be extended upon request from that authority), whether it objects to the execution of the EPdO. Such an objection obliges the court in the issuing state to lift the order. Lack of response of the authority results in a reminder with a five days deadline and if that brings no reaction, the order shall be upheld. It is worth noticing that the authority in the third state is not obliged to comply with the deadlines. While questions of national security or defence may be a sufficient motivation for the authority to comply with the deadline, the protection of fundamental rights may not in all cases. Then, such an authority in the third country may only be motivated by comity or by the will to protect the service provider because of its connection with the third state.
The draft directive obliges the Member States to set up rules ensuring that service providers offering services in the European Union designate at least one legal representative in the Union empowered to receive and respond to the orders described in the regulation. In order for the regulation to be effective, it is crucial that the name of such representative is made known, also in view of relatively short deadlines that the regulation imposes for the execution of the orders.
Some Member States have already created such obligations – at the national level – to nominate a service provider’s representative. This action is, however, in conflict with the internal market logic: imposing mandatory legal representation within the territory of a Member State is in conflict with the freedom of services within the internal market.16 Therefore, the directive aims not only to assure the possibility of an effective enforcement of the EPdO and EPsO, but also to avoid the risk that other Member States launch further unilateral initiatives in this regard, creating divergent legal frameworks and further obstacles to the internal market. Hence, the directive is issued on an internal market legal basis, which is explained by its aim. While the problem described affects the service providers that are not established in a Member State in question, it does not exist if they have already been established. As a consequence, and similarly to the draft regulation, the directive does not affect service providers offering services exclusively in the territory of one EU Member State.
The obligation to “designate at least one legal representative in the Union for the receipt of, compliance with and enforcement of decision and order issued by competent authorities of Member States for the purpose of gathering evidence in criminal proceedings” concerns service providers established in the European Union as well as those that are not established in the Union, but offering services in the territory of the Member States concerned (Art. 3 (1) and (2) of the draft Directive). The latter means that such a service provider should have a substantial connection to the Member State. The meaning of substantial connection is the same as for the draft regulation (see above 1c).17 In order to guarantee the fulfilment of these duties, the Member States should also provide for effective, proportionate and dissuasive sanctions applicable for infringements of these duties and make sure that they are implemented (Art. 5).
Including the speciality principle providing limitations on the use of electronic evidence other than for the purpose of the proceedings for which it was obtained and its transmission to another Member State, third country or international organisation (new Art. 12b).

References: Art. 82
 Art. 2
 Art. 2
 Art. 5
 Art. 7
 Art. 3
 Art. 14
 Art. 1
 Art. 1
 Art. 16
 Art. 12