Electronic evidence regulation: European production and preservation orders for electronic evidence in criminal matters

2018/0108(COD)

The European Parliament adopted by 433 votes to 157, with 34 abstentions, a legislative resolution on the proposal for a Regulation of the European Parliament and of the Council on the proposal for a regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters.

The European Parliament's position adopted at first reading under the ordinary legislative procedure amends the Commission's proposal as follows:

Coherent EU framework for handling electronic evidence

The regulation lays down the rules under which an authority of a Member State, in criminal proceedings, may issue a European Production Order or a European Preservation Order and thereby order a service provider offering services in the Union and established in another Member State, or, if not established, represented by a legal representative in another Member State, to produce or to preserve electronic evidence regardless of the location of the data. This regulation covers the data categories of subscriber data, traffic data and content data.

The issuing of a European Production Order or of a European Preservation Order may also be requested by a suspect or an accused person, or by a lawyer on that person’s behalf within the framework of applicable defence rights in accordance with national criminal procedural law.

The regulation will apply without prejudice to fundamental principles, in particular the freedom of expression and information, including the freedom and pluralism of the media, respect for private and family life, the protection of personal data, as well as the right to effective judicial protection.

European Production Orders and European Preservation Orders may be issued only in the framework and for the purposes of criminal proceedings, and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

European production orders and European preservation orders will be addressed directly to a designated establishment or a legal representative of the service provider concerned.

Execution of a European Production Order Certificate (EPOC)

Upon receipt of an EPOC, the addressee will act expeditiously to preserve the data requested. The addressee will ensure that the requested data are transmitted directly to the issuing authority or the law enforcement authorities as indicated in the EPOC at the end of that 10-day period. In emergency cases, the addressee will transmit the requested data without undue delay, at the latest within eight hours following receipt of the EPOC.

Where a notification to the enforcing authority is required, the enforcing authority may, if it decides to raise a ground for refusal, without delay and at the latest within 96 hours following receipt of the notification, notify the issuing authority and the addressee that it objects to the use of the data. Where a ground for refusal is raised by the enforcing authority, if the data have already been transmitted by the addressee to the issuing authority, the issuing authority will delete or otherwise restrict the use of the data or, in the event that the enforcing authority has specified conditions, the issuing authority will comply with those conditions when using the data.

Execution of a European Preservation Order Certificate (EPOC-PR)

Upon receipt of an EPOC-PR, the addressee will, without undue delay, preserve the data requested. The obligation to preserve the data will cease after 60 days. During that 60-day period, the issuing authority may, using the form, extend the duration of the obligation to preserve the data by an additional 30-day period, where necessary to allow for the issuing of a subsequent request for production. Where the preservation is no longer necessary, the issuing authority will inform the addressee without undue delay and the obligation to preserve on the basis of the relevant European Preservation Order will cease.

Grounds for refusal of European production orders

The Enforcing authority will, when notified, be able to refuse a European production order on the following grounds:

- the data requested are protected by immunities or privileges granted under the law of the enforcing State which prevent the execution or enforcement of the order, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent the execution or enforcement of the order;

- in exceptional situations, there are substantial grounds to believe, on the basis of specific and objective evidence, that the execution of the order would, in the particular circumstances of the case, entail a manifest breach of a relevant fundamental right as set out in Article 6 TEU and in the Charter;

- the execution of the order would be contrary to the principle of ne bis in idem;

- the conduct for which the order has been issued does not constitute an offence under the law of the enforcing State.

Where the enforcement authority invokes a ground for refusal, it will inform the addressee and the issuing authority.

Members also ensured that authorities requesting sensitive data would, in most cases, be required to inform the authorities of the target country in order to ensure transparency (such as traffic data, except where it is only used for identification purposes, and content data).

User information and confidentiality

The amended text specifies that the issuing authority will, without undue delay, inform the person whose data are being requested about the production of data on the basis of a European Production Order. Any person whose data were requested via a European Production Order should have the right to effective remedies against that order.

Sanctions

Without prejudice to national laws providing for the imposition of criminal penalties, Member States will lay down the rules on pecuniary penalties applicable to infringements of this Regulation and should take all measures necessary to ensure that they are implemented. Pecuniary penalties provided for must be effective, proportionate and dissuasive. Member States will ensure that pecuniary penalties of up to 2 % of the total worldwide annual turnover of the service provider’s preceding financial year can be imposed.

Secure digital communication and data exchange between competent authorities and service providers and between competent authorities

Written communication between competent authorities and designated establishments or legal representatives under this Regulation, including the exchange of forms provided for in this Regulation and the data requested under a European Production Order or a European Preservation Order, will be carried out through a secure and reliable decentralised IT system.