The EU Parliament has accommodated the member states on crucial points, but now demands special attention to fundamental rights. The controversial question is how a state in which a company is based can object to an order.

The French EU Presidency wants to get things moving on the so-called E-Evidence dossier and has scheduled several meetings of the relevant Council working groups since January. However, the Member States and the Parliament have not yet been able to agree on essential points. Today, the issue is once again on the agenda of the meeting of Justice Ministers in Brussels.

Four years ago, the European Commission proposed a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters. The law enforcement authorities of the member states want to oblige internet service providers that are not located in their own country to directly transmit data of their users. These direct contacts between states and companies would bypass the usual legal process. The regulation concerns inventory, traffic and content data. It also covers companies that are based in third countries but offer their services in the EU. For this purpose, they are to designate a “point of contact” in an EU member state.

Notification also for traffic data?

The trilogue negotiations between the Commission, Council and Parliament finally began a year ago. Twice, the Member States have adopted a General Approach on the E-Evidence Regulation. In November 2021, the Slovenian Presidency presented a compromise proposal.

There, the question of notification in the case of a production order by an issuing state is particularly contentious. What is meant is the obligation to inform the state of domicile of the provider concerned (referred to in the regulation as the enforcing state) about the request. While the Council only wants to make this a requirement for content data, the Parliament also demands notification for orders for traffic data. This was confirmed by the parliamentary rapporteur of the E-Evidence dossier, Birgit Sippel (SPD), in a letter to the Council a fortnight ago.

Sippel justified the demand with the importance of traffic data, which “allows the most intimate insights into the life of a person”. For example, repeatedly accessing a website that informs about abortion options allows precise conclusions to be drawn about a person’s life. Several decisions of the European Court of Justice and constitutional courts of the member states confirm this assessment, most recently the French Cour constitutionnel ruled on data retention.

Questionable criterion of residence

Although the Council accommodates the Parliament, it brings into play the so-called residence criterion. In the case of traffic data, the state of residence would only be notified if the person concerned lives in a state other than the one issuing the order.

The reason given is that the issuing member state best protects the rights of a person living on its own territory and is thus best able to assess whether an order is lawful. In practice, however, a majority of member states are probably primarily concerned with keeping the number of notifications as small as possible, Sippel said. “Current developments in the rule of law in the EU” raise doubts that member states always have the protection of all people on their own territory in mind. The Parliament therefore “emphatically rejects” the residence criterion.

The internet service provider must abide by the laws of the state where it is located. According to Sippel, it is only possible to check this if the latter learns of the transactions in the first place. Often it is also not clear where the person actually lives or whether he or she is located in the issuing state after a production order has been presented.

Grounds for refusal and obligation to notify persons concerned

The catalogue of grounds on which the notified executing state can reject an order is also controversial. Such a positive list of criminal offences in which the states concerned promise themselves mutual legal assistance is contained, for example, in the annex to the European Investigation Order, which can also be used to collect evidence in criminal proceedings across borders.

In an interview, the rapporteur Sippel named reasons for rejection from which the Parliament does not want to deviate in any case. These include a possible violation of fundamental rights, immunities and privileges, freedom of the media or safeguards against multiple prosecution for the same offence. It should also be possible to reject an order if higher standards of protection exist in the executing state with regard to investigative measures.

Finally, Parliament does not want to give in on the issue of informing affected persons. According to Sippel, such immediate information “must be the general rule”, whereas the Council sees this as an exception. Affected persons could only make use of their rights if they knew about an order. According to the Parliament’s will, the duty to inform should also cover preservation orders and not only production orders. Although it would be possible to deviate from this in individual cases, such decisions would have to be well justified each time.

Council of Europe agreement to be signed as well

The trilogue negotiations for the E_Evidence dossier will probably not be concluded before the summer holidays, and it may even take longer. Indirectly, the delay also affects other EU legislative processes, including the planned extension of the list of crime areas to include hate and hate crime. In order to obtain relevant electronic evidence in such crimes in the first place, it is necessary to have the possibility of orders to secure and hand it over.

Although the E-Evidence Regulation has not yet been adopted, the EU Commission is discussing with the United States the possibility of issuing orders across EU borders. The Member States had issued a mandate to this effect in summer 2019, before the election of the new EU Parliament. The Council wants an inclusion in the so-called CLOUD Act, with which the US government forces domestic internet service providers to comply with surrender orders. These EU-US talks are continuing, but negotiations on this are – as far as is known – currently on hold.

In addition to the EU, the Council of Europe has also regulated the release of electronic evidence in the Second Additional Protocol to the Budapest Convention, but only in exceptional cases also for content data. The decision must now be ratified by the Council of Europe members. The Council of Europe brings together 47 member states, including all Schengen states, as well as countries such as Russia, Ukraine, Turkey and the candidates for accession to the European Union. The Commission negotiated the agreement on behalf of the EU member states, which is why the approval of the EU Parliament is needed here as well. The signing ceremony is scheduled for 12 May, so it must be done in a hurry.

Image: Kvistholt Photography on Unsplash.