In a move which has drawn fire from industry and civil-liberties groups, the European Union (“EU”) is moving forward with a bill to enable law enforcement authorities to access digital evidence held by private companies in other member states or outside the EU. On December 7, 2018, the bloc’s governing body, the European Council, voted to open negotiations with the European Parliament on the form and content of the final legislative package. A vote is expected by mid-2019, before the next round of European parliamentary elections.
One consequence of the widespread use of modern communications platforms is that a vast amount of personal data, including instant messaging and webmail, is now stored on computer systems owned by software companies and network service providers. When a crime is committed, the evidence stored on such computer systems often plays a critical role in subsequent investigations and prosecutions.
At present, law enforcement’s ability to access data from service providers is substantially limited by the degree to which private companies are willing to cooperate. The introduction of so-called “e-evidence” legislation seeks to turn the tables by creating two new trans-national legal instruments, the European Production Order Certificate (“EPOC”) and the European Preservation Order Certificate (“EPOC-PR”). It is intended that EPOC and EPOC-PR will be direct and mandatory judicial orders issued by law enforcement organisations in EU member states. Crucially, they would compel service providers to disclose data on criminal suspects irrespective of the storage location of the data they request.
The categories of data that may be sought under the EPOC framework are broad. They include the identity of a subscriber or customer (name, date of birth, address, billing or payment data, telephone or email), data related to the commencement and termination of a user access session (date and time of use, log-in to and log-off from the service, IP address), data related to the use of devices and online services (destination and source of messages, device location), and any other data stored in a digital format (text, voice recordings, videos, images). The draft legislation also aims to impose tight deadlines on EPOC respondents, from a standard period of 10 days to as little as six hours in emergency situations. Continuing in the same vein as the GDPR in terms of heavy penalties, failure to comply with an EPOC order carries penalties of up to 2% of worldwide revenue. Given the size of leading tech firms, potential fines could stretch to hundreds of millions of Euros.
Four member states – France, Spain, Ireland and Belgium – voted in favour of progressing the new legislation and opening a dialogue with the EU Parliament. However, according to media reports, several member states, including Germany, the Netherlands, Finland, Hungary, Latvia, the Czech Republic and Greece, refused to back the proposal. The bill has also received criticism from lobbying groups such as the Computer and Communications Industry Association and BSA | The Software Alliance.
A recent EU study of the legal implications of e-evidence (commissioned by the EU Parliament and conducted by the EU’s Policy Department for Citizens’ Rights and Constitutional Affairs) reached similarly critical conclusions. According to lead researcher Martin Böse of Rheinische Friedrich-Wilhelms-Universität in Bonn: “[T]he added value of the new cooperation regime (quick and effective access to provider data) is mainly based on the abolition of cooperation obstacles and procedures ensuring effective protection of fundamental rights.”
