The controversial European e-Evidence regulation, aimed at improving cross-border access to electronic evidence, continues to be discussed among EU institutions, as the positions of the European Parliament and Council remain distant on the notification mechanism.
A group of 25 NGOs have warned against the current proposal, warning that it does not provide sufficient safeguards for fundamental rights, notably for certain categories such as journalists.
The European Production and Preservation Orders for electronic evidence in criminal matters (e-Evidence) aim to provide a legal framework for law enforcement agencies and judicial authorities to quickly access electronic evidence from other member states.
The initial proposal was published in April 2018. On 20 May, it was once again discussed in a trialogue bringing together the EU Parliament, Commission and Council.
While some progress was made on technical details, the provision for notifying the authorities of the executing country remains a blocking issue, according to a source close to the negotiation.
In a memo detailing its policy proposal, the Commission indicated that 85% of all criminal investigations employ electronic evidence, which in two-thirds of cases needs to be requested from a service provider located in another country, and another jurisdiction.
“The e-evidence proposal will provide the basis for a coherent approach both within the Union and by the EU at the international level,” a Commission spokesperson told EURACTIV.
“‘It will make it faster for police and judicial authorities to obtain electronic evidence while guaranteeing strong protection of fundamental rights including the right of personal data protection,’ added the spokesperson.
Based on the new provisions, judicial authorities will be able to issue a European Production Order, requiring the service provider or its legal representative located in another EU country to provide electronic evidence for an ongoing investigation.
In normal circumstances, the service provider will have 10 days to respond, whilst the timeframe is reduced to six hours in cases of emergency.
Electronic evidence might relate to emails, documents or in-app communication. The judicial authority could also request the service provider to preserve that specific data for later usage.
Complementary to the regulation, the Commission also proposed a directive that obliges online service providers to establish a legal representative in the European Union, which will be responsible for complying with the orders of the judicial authorities.
The e-Evidence proposal was not universally welcomed.
Twenty-five professional organisations including media and journalists associations, civil society groups, and internet companies have published an open letter demanding stronger safeguards for fundamental rights.
The letter points to the potential risks for people who require confidentiality for exercising their jobs, such as journalists, lawyers or even politicians and diplomats. The organisations also regret that the e-Evidence draft does not require the ex-ante authorisation from the judicial authorities in the executing country.
In a non-binding opinion issued in July 2019, the European Data Protection Supervisor (EDPS) called for more significant involvement of the relevant authorities in the executing member state, saying it feared that the new system might lead to abuses, a concern similar to the one voiced by the MEPs who opposed the proposal.
Moritz Körner (Renew Europe, Germany) considers that the draft regulation got through Parliament following a ‘weak’ compromise.
“I share the fear of the NGOs that the compromise with the Council will water down even further the necessary safeguards,” the MEP added, specifying that the liberal group had voted against the proposal precisely because it deemed the protection for journalists was insufficient.
German Green MEP Sergey Lagodinsky stressed the risks for abuse in countries where the rule of law is not ensured.
“The issue of eroding judicial trust is a sad consequence of rule of law deficits in the EU. Under those circumstances, we cannot introduce more automatism, but need more scrutiny,’ he told EURACTIV.
Categories and notification
In terms of safeguards, the European Commission points to the involvement of the judicial authorities and the protection of specific data categories. Four types of data categories have been defined in the proposal: subscriber data, access data, transactional data, and content data.
All these categories contain personal data, but transactional and content data is deemed more sensitive for the respect of fundamental rights and is therefore subject to stricter requirements. According to a source close to the trilogue negotiations, a preliminary agreement on the data categories was found during the technical discussions.
In terms of the involvement of judicial authorities, the most controversial point remains the notification mechanism. In the final draft adopted by the Parliament, the notification is mandatory, but ‘for information only’, as the authorities of the enforcing country do not have a legal basis for suspending the order.
The Council introduced a provision for a notification system for content data in its initial position in December 2018. Since then, most EU countries have opposed the notification system, arguing that it would bring back territoriality and undermine the rationale and effectiveness of the proposal.
Whether the person investigated will be informed about the investigation depends on the procedural law of the country where the investigation takes place, as there is no harmonised notification regime across the EU.
A new trilogue session is expected next month, before the end of the Portuguese Presidency of the EU Council. The source close to the negotiations said they are expected to last at least another two months and it is difficult to say when a breakthrough agreement will be found.
The European Commission is expected to put forward by the end of the year a proposal for establishing a system to exchange the production and preservation orders for e-evidence.
[Edited by Zoran Radosavljevic]