E-Evidence Regulation

Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings – the E-Evidence Regulation (eER) for short – entered into force on 18 August 2023. After a three-year transition period, it will be binding from 18 August 2026.

Subject matter of the E-Evidence Regulation

The subject matter of the Regulation is the direct cross-border access of Member State law enforcement authorities to electronic evidence held by a provider of services which, in the broadest sense, concern electronic communications of their users and which are provided within the territory of the European Union (EU), regardless of whether the data are stored inside or outside the EU.

What does this mean - who is affected, what is regulated under European law?

To date, the exchange of evidence between Member States has taken place through mutual legal assistance procedures. Mutual legal assistance procedures are generally complex, time-consuming and therefore cumbersome. At the same time, the diversity of national instruments as a basis for carrying out a cross-border transfer of evidence makes it difficult to provide swift mutual support.

In contrast, the eER, based on the principle of mutual recognition, will in future allow law enforcement authorities to have direct access to data legally stored by a service provider in another Member State.  According to the principle of mutual recognition, decisions in the area of criminal law of one Member State are recognised in all other Member States on the basis of the concept of equivalence of legal systems. For the scope of application of the eER, this means the recognition, in principle, of procedural decisions, which are the prerequisite for the request for a cross-border transfer of evidence.

Against this background, the eER now provides the instruments of a preservation and a production order uniformly for all Member States. A preservation order allows a Member State’s (this is the so-called issuing State) judicial authority, which is authorised to issue orders, to directly preserve electronic evidence at a providers’ established in another Member State. The evidence then can be held there for a 60-day-period. The production order shall result in the direct delivery of evidence to the requesting judicial authority. In this way, the mutual legal assistance procedure is omitted.

Services covered by the rules of the Regulation include messengers, the provision of access to mobile/landline/satellite communications, VoIP, online marketplaces with options for communication between users or platforms for online games. Electronic evidence means subscriber data, content data and traffic data already held at the service providers’ at the time when the order is addressed to them. A distinction must be made in relation to forms of collecting such data that will only arise in the future as a result of user behaviour - these are not the subject of the eER.

However, the eER's provisions are only enforceable against service providers if they have a representative office subject to EU law.

In order to ensure that service providers can be addressed via a registered office or via an appointed representative in an EU Member State, the eER is accompanied by Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings, the so-called Representatives Directive.

Regulatory context – other international legal acts for the international exchange of evidence

Internationally, the proposal is to be seen in the context of two other legal developments which, in view of the growing importance of electronic evidence, lay down rules to facilitate access to data stored abroad in criminal proceedings: In November 2018, coinciding with the presentation of the Commission Proposal on the eER, the US adopted the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), and the Council of Europe adopted the Second Additional Protocol to the Council of Europe Convention on Cybercrime (so-called Budapest Cybercrime Convention) on enhanced cooperation and disclosure of electronic evidence in November 2021.

Development history – extensive need for clarification regarding data protection law

During the almost five-year development phase of the eER up to the submission of the final text in January 2023, the Proposal for a Regulation encountered various concerns in the intra-European legislative process, so that an agreement on the text of the Regulation was only reached after long trilogue negotiations. The significant criticism raised by the DSK (Datenschutzkonferenz, i.e. German Data Protection Conference) and the EDPB in particular was the concern that the simplification of the evidence-gathering procedure might, as it were, result a circumvention of the judicial authorities of the Member State in which the (preservation/production) order is served (so-called enforcing State). In addition, the criticism was that, as a result, it would solely lie with the provider to make findings on the legality relating to criminal law of the order issued to him. Overall, the assumption was that there would be no effective review of the legality and proportionality of the orders.

In response to these criticisms, a notification procedure was included in the regulation for production orders aimung at traffic and content data, which suspends the obligation to disclose data for a 10-day period. The authorities of the enforcing State, which are notified about the order to produce data, can within this period assert grounds for refusing the order. Thus, a legality and proportionality test is now embedded in law. Other grounds for refusal are the principle of ne bis in idem, the determination that the act is not punishable in the enforcing State, and the protection of communications from certain groups of people such as those bound by professional secrecy, journalists from the point of view of protecting sources, and diplomats. The grounds for refusal included also take into account the criticism of the lack of protection for sensitive groups of people and the concern that criminal prosecution in the absence of criminal liability in the enforcing State could be politically motivated. In addition, it was clarified that the service provider is not obliged to carry out a general legality review of the order, but only to check whether there are any legal conflicts in the provider’s area of responsibility due to conflicting legal regulations in the state in which the data are stored. This primarily concerns the situation in which the service provider stores the data in a third country, for example in a US-American cloud. Responsibility for the legality and proportionality of the order lies with the issuing State’s national judicial authority that issues the order in accordance with applicable national law.

The responsibility of the issuing State for the legality of the preservation and/or production orders means that persons concerned must assert any objections by asserting their criminal procedure rights in the issuing State in accordance with the law of the issuing State. The eER ensures that effective legal remedies are available and accessible in the Member States. However, criticism continues that, given linguistic and financial hurdles, asserting criminal procedure rights in the issuing State could represent a disproportionately high burden for the person concerned.

Links to original documents

1. E-Evidence Regulation, final Version
2. Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters
3. Timeline - Better access to e-evidence to fight crime
4. Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings, the so-called Representatives Directive.