I. Introduction

Legislative initiatives on e-evidence were presented more than five years ago. After conducting an in-depth assessment and following bilateral discussions with the delegations of the EU Member States, the European Commission published two proposals on 17 April 2018:

• A proposal for a Regulation on the European orders for the production and preservation of electronic evidence in criminal matters;¹

• A proposal for a Directive establishing harmonised rules on the appointment of legal representatives for the purpose of obtaining evidence in criminal proceedings².³

These instruments and the ensuing negotiations faced several complex challenges. One of the main challenges was striking a fair balance between the fundamental rights related to the protection of privacy and the rights of suspects and accused persons on the one hand, and enabling/facilitating investigations and prosecutions of crime on the other.

While even with traditional judicial cooperation instruments, this balance is always difficult to strike, the specific case of e-evidence encountered a further obstacle: the need for a direct relationship between the judicial authority of a prosecuting state (issuing state) and a (private) entity outside its jurisdiction, i.e. a service provider who holds data that may include traces of communications and activities of perpetrators who operate through IT means. Thus, this “e-evidence scenario” deviates from the traditional trilateral relationship on the basis of mechanisms of letters rogatory that require the involvement of the judicial authority of the state where the service provider is located. This resulted in the fundamental question to which extent the judicial authority in the service provider state was to actively be involved . Should the latter simply be obliged to execute the order of the issuing judicial authority? Should it verify the correctness of the activity carried out by the issuing authority? In short, the e-evidence package was a real litmus test for the principles of mutual trust and mutual recognition that kept being invoked and flaunted throughout the negotiations. This raised the more general question of whether “mutual trust” means “blind faith” or “reasoned trust”.

The following section (II.) outlines the background of the internal EU legislative rules on e-evidence and critical issues that emerged during the negotiations; this culminated in the provisional agreement of 25 January 2023 and – after linguistic and technical revision – the final texts that were signed on 12 July 2023 and published in the Official Journal of the European Union on 28 July 2023.⁴ However, the EU’s e-evidence package must also be seen in the context of the overall legal framework on e-evidence at the international level (comprised of the Council of Europe Second Additional Protocol to the Cybercrime Convention, the bilateral negotiations on an EU-US e-evidence agreement, and the starting negotiations on a United Nations legal instrument on cybercrime), to which Section III. is dedicated. Section IV. of this article provides a brief outlook to the next steps of the EU dossier before additional and concluding remarks (Section V.).

II. Background and Negotiations of the EU Legal E-evidence Package

1. Challenges/issues of electronic evidence acquisition in the current legal framework

Prior to the new e-evidence package, multiple international cooperation instruments had been used under the EU legal framework for cross-border electronic evidence gathering. These instruments include:

• Directive 2014/41/EU on the European Investigation Order in criminal matters (EIO)⁵;

• The European Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union;⁶

• Regulation (EU) 2018/1727 of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust);⁷

• Regulation (EU) 2016/794 on Europol;⁸

• Council Framework Decision 2002/465/JHA on joint investigation teams;⁹

• Bilateral agreements between the Union and third states, such as the mutual legal assistance agreements in force with the US;¹⁰

• The Council of Europe Convention on Cybercrime (Budapest Convention).¹¹

Yet in practice, these comprehensive and wide-ranging legal cooperation instruments have still failed to adequately address some of the difficulties encountered in the process of obtaining electronic data. One of the most significant obstacles in this context has been the refusal by Internet service providers to make data available in cases where the authority in question lacks jurisdiction over the place of the establishment of its headquarters, or because of the nationality of the affected person for whom data has been requested. More complex problems arise when a case is connected with the legal system of states outside the EU (third states), which is a recurring scenario given that the largest providers of telematic services are based in the United States.¹² In addition to the aforementioned jurisdictional problems, obtaining electronic evidence through judicial cooperation procedures – whether conventional or based on the principle of mutual recognition – has always necessitated the involvement of the (judicial and/or governmental) authority of the executing/requested state. This inevitably causes delays, which is clearly incompatible with the “volatility” of electronic data.

2. The Commission’s two regulatory proposals

With the two proposals listed earlier,¹³ the Commission intended to overcome these shortcomings. Notwithstanding this ambition, they are designed to complement, and not replace, existing judicial cooperation instruments, in particular the EIO. The Regulation aims to simplify and accelerate the process of securing and obtaining electronic evidence stored and/or held by service providers established in another jurisdiction. This objective is to be achieved by directly transmitting the order to preserve/produce data to the representative designated by the service provider, with the latter being obliged to comply by directly handing over the data to the requesting authority. This obligation applies unless there are specific and compelling reasons not to do so, and without being able to oppose reasons related to the place where the data are stored. In turn, the corresponding Directive aims to establish an obligation for service providers offering their services in the EU to designate a legal representative in at least one Member State.

It follows that the relevant procedural mechanisms need to be structured according to general models to make them useful from an operational point of view and ultimately ensure their practical applicability. In other words, the negotiations made it clear that unless speed and efficiency are to be improved with a new European production order, the prosecuting authorities would continue to use the cooperation tools already available.

3. Critical pre-trilogue issues emerged in the Council

Negotiations on the two proposals started in the COPEN Technical Working Group on 27 April 2018 under the Bulgarian Council presidency, and continued under the subsequent Council presidencies. From the outset, the process placed great emphasis on working around the principle of territoriality in the traditional sense, which was achieved by declaring the location of the data to be irrelevant. However, some technical issues immediately emerged as harbingers of several other critical points. These included:

• Potential conflicts with obligations under the law of third countries (and, in this context, the relationship between the proposed new instrument and the US CLOUD Act);

• A possible extension of the subject matter of the Regulation to include direct access to data by authorities and real-time interceptions, which are considered to be extremely relevant investigative tools;

• The question of whether orders should also be served to the relevant authority of the executing state or of another state that has a connection with the case at issue.

The Austrian Council presidency presented a compromise text (which reflected the negotiating efforts of the Member States to reach an agreement) to the Justice and Home Affairs (JHA) Council in December 2018.¹⁴ At this meeting, the Council’s general approach on the draft Regulation was adopted while that on the draft Directive was reached in the JHA Council in March 2019. While the Member States supported the compromise text of the Austrian presidency, some called for subtle changes. For example, two states suggested introducing a more incisive procedure of notifying authorities in the affected persons’ states; others would have preferred a more streamlined procedure that would have seen no other authorities or states notified at all.

4. Pre-trilogue contributions by other institutions

The European Economic and Social Committee adopted its opinion as early as on 12 July 2018. Conversely, the European Parliament (EP) as co-legislator appointed its rapporteur on 24 May 2018. Subsequently, several meetings and hearings were held in the LIBE Committee on the e-evidence proposal, including a public hearing on 27 November 2018.

The LIBE Committee developed amendments to numerous key provisions of the regulation, being in strong contrast with the Council’s general approach. The Committee, inter alia, proposed replacing the Directive and integrating some of its provisions into the Regulation (a solution that casted serious doubts on the appropriateness of the latter’s legal basis). The large number of proposed amendments tabled by the parliamentary political groups, together with the onset of the pandemic, further slowed down work on a final EP position, which was finally adopted as late as in mid-December 2020.¹⁵ The EP’s text was still far from the one that the Council had drafted in its general approach. The EP followed a much more restrictive approach on central issues, such as:

• The prerequisites for issuing orders (three additional prerequisites were inserted);

• The need for notification to the executing state with substantial effects for all orders and for all types of data;

• The extension of the grounds for refusal and the inclusion of mandatory ones;

• The merger of the Directive with the Regulation.

A rather carefully-worded position was also expressed by the European Data Protection Supervisor (EDPS) on 6 November 2019.¹⁶ On the one hand, the EDPS supported in his opinion “the objective of ensuring that effective tools are available to law enforcement authorities to investigate and prosecute criminal offences, and in particular welcomed “the objective of the Proposals to accelerate and facilitate access to data in cross-border cases by streamlining procedures within the EU.” On the other hand, the EDPS underlined “that any initiative in this field must be fully respectful of the Charter of Fundamental Rights of the EU and the EU data protection framework…” The EDPS advocated for a greater involvement of judicial authorities in the enforcing Member States and expressed a wish for them to be “systematically involved as early as possible in this process” in order to “have the possibility to review compliance of orders with the Charter and have the obligation to raise grounds for refusal on that basis.” In addition, the EDPS voiced the need to clarify the definitions of data categories in order to make them consistent with other definitions of data categories in EU law. He eventually recommended “reassessing the balance between the types of offences for which European Production Orders could be issued and the categories of data concerned in view of the relevant case law of the Court of Justice of the EU.”

5. The trilogue negotiations and compromise

The inter-institutional negotiations between the Commission, the Council, and the European Parliament (the so-called trilogue) started in January 2021 under the Portuguese Council presidency. The trilogue negotiations spanned four further Council presidencies (Slovenia, France, the Czech Republic, and Sweden). At the beginning of 2023, a compromise was found under the Swedish presidency.

Trilogue turned out to be particularly complex due to the profound differences between the text of the Council’s general approach and the EP’s position. The EP advocated a much more restrictive instrument, having proposed to introduce a greater number of prerequisites for orders by the issuing authority and a generalised regime of notification to the state of execution covering all orders and all types of data with substantial effects. This was accompanied by an extensive list of grounds for refusal, some of which were considered mandatory. Moreover, the EP proposed abandoning the Directive, incorporating some of its provisions into the Regulation (cf. above 4.).

On the part of the Council, diverging views emerged: Some more ambitious delegations supported the solution proposed in the general approach, considering it suitable to guaranteeing an adequate level of effectiveness of the instrument and at the same time high standards of protection of fundamental rights; yet other delegations reiterated their general support for a stronger and more extensive notification regime, while considering some options of the EP to be overly restrictive. In the absence of any obvious willingness to compromise on the part of the EP’s negotiators, the Council conducted the negotiations by sticking as closely as possible to the text of the general approach during this initial phase.

Given the EP’s persistence on its position, the Council adopted a different approach in the second half of 2021 and suggested compromise solutions, showing some flexibility with respect to its general approach. Such solutions included, for instance, the suggestion that all forms of notification for preservation and production orders related to subscribers’ data and so-called identification data (traffic data used solely for identification purposes, such as IP addresses, ports, etc.) be removed. In addition, no notification was to be needed for production orders of traffic data belonging to subjects residing in the issuing state, whereby such residence was to be presumed unless there were reasonable grounds to believe otherwise.

Even though this compromise solution was supported by the Member States (primarily as ultima ratio in order to break the deadlock), the EP found it insufficient in view of fundamental rights concerns.

Nevertheless, the Council continued its efforts to reach a final agreement on the instruments by tabling new compromise texts. In particular, issues not related to notification (on which a preliminary agreement had not yet been reached between the co-legislators) were brought back to the negotiating table. The discussion on the proposal for a Directive on harmonised rules for the appointment of legal representatives for the purpose of obtaining evidence in criminal proceedings, previously shelved as particularly controversial, was reopened. The debate on the Directive was fruitful, with the EP accepting to maintain the Directive as a separate instrument and as a way of settling good compromise solutions on almost all outstanding issues.

At the same time, the Council drew up a compromise proposal. While still aiming to uphold the residence criterion for both content and traffic data, it included some key points of the EP position, such as a single regime for content and traffic data, notification with suspensive effect, and a list of grounds for non-execution, including at least immunities and privileges, fundamental interests and security of the executing state, freedom of the press and freedom of expression, and fundamental rights. The proposal was supported by the majority of Member States, but attempts to reach an agreement with the EP were unsuccessful.

Following a deadlock, the dialogue between the EP and the Council resumed in May 2022. Despite significant disagreement on crucial issues (notification, grounds for refusal, residence criterion), intense negotiating efforts by the parties allowed them to make good progress in bilateral discussions. At the end of 2022, attempts were intensified to finally reach an agreement, in line with the Commission’s position. At the meeting of the Permanent Representatives Committee on 23 November 2022, the Council presidency asked the Member States to be granted a mandate for the trilogue meeting on 29 November to present an overall compromise package. This package, which was finally agreed on by both the Member State delegations and the EP, included the following:

• Application of the residence criterion to exclude notification to the executing state: Due to the burden of proof of residence being reversed and put on the issuing authority, the EP insisted on setting a number of requirements for proof of residence (e.g. proof by way of an identity document or entry in a public register, a minimum period of residence, and other circumstances that were considered to be mandatory). In practice, this makes such proof very difficult for the issuing authority. It was, however, agreed that said requirements were to be placed in a recital, with the understanding that they would be mere indicators that could be used to prove the stability of permanence in the territory of the issuing state, rather than representing necessary and prescriptive requirements.¹⁷

• Refusal of orders as a consequence of a pending rule-of-law procedure under Art. 7(1) and (2) of the Treaty on European Union (TEU): The EP initially proposed inserting grounds for refusal that referred to a pending Article 7 TEU procedure against the issuing State dealing with serious violations of the values mentioned in Article 2 TEU into the operative part of the Regulation. This was moved to a recital¹⁸and rephrased to avoid any automatism.

• Optional nature of the grounds for refusal and limited role of the service provider in non-execution of orders: The final compromise¹⁹ provides that service providers may only put forward a limited number of refusal grounds. In addition, they are obliged to inform the issuing authority and, if notification is required, the enforcing authority before a possible non-execution. Since service providers are private entities, they are not entitled to refuse requests on the grounds of fundamental rights violations; such assessment is reserved to the discretionary power of the judicial authority of the service providers’ location.

• The distinction between the service provider and the data controller: Where the data controller differs from the Internet service provider, the issuing authority has the general obligation to address the order to the controller; however, the issuing authority is granted extensive exceptions in order to not hamper or slow down the investigation.²⁰

• Deletion of data: The compromise includes an obligation to delete (or alternatively restrict the use of) data transmitted in response to orders issued in urgent cases in the absence of notification if grounds for refusal emerge after transmission. This was done in respect to the EP’s initial demand that the issuing authority be obliged to delete data received in an emergency case as and when grounds for refusal are raised.²¹

III. E-evidence for Criminal Proceedings: the International Context

The important step forward achieved with the EU’s internal rules on access to e-evidence by the EU’s judicial authorities also needs to be assessed against the background of parallel international legal instruments (existing and planned). The EU legal framework is a central starting point for negotiations on the same topic undertaken by the EU with third countries. At the same time, the new EU system constitutes an essential benchmark for verifying the consistency of other systems with the fundamental rights touched by the search and acquisition of electronic evidence, bearing in mind that it is subject to the case law of the Court of Justice of the European Union (CJEU) and, more broadly, of the European Court of Human Rights (ECtHR).

During the JHA Council meeting held on 6–7 June 2019, the justice ministers of the EU Member States approved the Council Decision authorizing the European Commission to initiate negotiations with the United States regarding cross-border access to electronic evidence in the context of judicial cooperation in criminal matters and the addendum containing the relevant negotiating directives.²² However, this dialogue with the US has been suspended pending the prior conclusion of the EU internal rules. It is now about to be resumed as the EU e-evidence package has been agreed.

At the JHA Council meeting of June 2019, the ministers had also adopted the Decision authorising the participation of the European Union in the negotiations for the adoption of a Second Protocol additional to the Budapest Convention on Cybercrime, which handed the European Commission a mandate to represent the European Union at the Council of Europe (CoE) level.²³ The Second Protocol was finalised in December 2021, and opened for signature on 12 May 2022 under the Italian presidency of the CoE. It will enter into force after ratification by at least five states. After consent by the EP on 17 January 2023, the Council adopted a decision on 14 February 2023 authorising the EU Member States to ratify the Second Protocol, in the interest of the EU.²⁴ The Second Protocol provides tools to strengthen cooperation and dissemination of electronic evidence and includes the following main features:²⁵

• In principle, direct cooperation between competent authorities of CoE member states and service providers of another state party;

• Effective means of obtaining subscriber information and traffic data;

• Obligation to create specific channels for rapid and direct cooperation between state authorities and between these authorities and private entities established in the territory of another state party;

• Competent state authorities may request the information necessary to identify or contact the registrant of a domain name in possession or under the control of the provider from service providers established in the territory of another state party;²⁶

• Considering that the range of participants in the Budapest Convention is broader and less homogeneous than EU Member States, a state party can always claim the right to notification to filter out requests;²⁷

• State authorities may require a service provider established in the territory of another state party to disclose the information on a subscriber, in possession or control of the service provider, where the information is necessary for specific criminal investigations and proceedings; ²⁸

• Detailed regulation of the content of the request and the time limit within which the order must be enforced. If a service provider does not disclose the requested information by the deadline or expressly refuses to provide it, the authorities of the requesting state may seek to enforce the order in accordance with the procedure set out in Art. 8;

• According to Art. 8, cooperation does not take place between the authority and the private service provider, but between the national authorities of the states concerned (requesting and requested): the requested state must make every reasonable effort to compel the service provider in its territory to disclose the subscriber information and traffic data as quickly as possible or, in any case, within the time limits laid down in the Budapest Convention;

• Establishment of a cooperation scheme in emergency cases to obtain data stored by a service provider, including accelerated communication channels;²⁹

• Possibility for two or more State parties to allow their competent authorities, on the basis of mutual agreements, to establish and operate a joint investigation team in their territories to facilitate criminal investigations or proceedings (where enhanced coordination is deemed to be of particular utility);³⁰

• Clarification that other bilateral or multilateral agreements regulating the exchange of e-evidence are applicable, including the EU e-evidence Regulation (and the corresponding Directive) as well as any future agreements between the EU and the US.³¹

Efforts to regulate e-evidence are also ongoing at the United Nations level. Through its Resolution 74/247 adopted on 27 December 2019, Countering the use of information and communications technologies for criminal purposes, the UN General Assembly established an Intergovernmental Committee of Experts (Ad Hoc Committee) with representatives from all UN countries to draft a global Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes. The first negotiating session of the Committee took place in New York from 28 February to 11 March 2022. The General Assembly decided, inter alia, that the Ad Hoc Committee should convene at least six sessions of ten days each, followed by a concluding session in New York. The sixth session took place in New York from 21 August to 1 September 2023 and a concluding session is scheduled to take place in New York between 29 January and 9 February 2024. The EU also participates in the negotiation as an observer. Even though it is premature to predict the final outcome, the EU Member States’ approach should be not to exceed the scope of the Second Protocol to the CoE Budapest Convention.

IV. Towards Adoption of the EU Legal Instruments – Next Steps

The e-evidence Regulation entered into force on 18 August 2023 and it will apply from 18 August 2026 (Art. 34 of the Regulation). According to Art. 33 of the Regulation, the Commission shall carry out an evaluation of it by 18 August 2029 (six years from the entry into force of the Regulation). The Commission shall transmit an evaluation report to the European Parliament, the Council, the European Data Protection Supervisor, and the European Union Agency for Fundamental Rights. This evaluation report should include an assessment of the application of the Regulation and of the results that have been achieved with regard to its objectives, and an assessment of the Regulation’s impact on fundamental rights. The evaluation should be conducted in accordance with the Commission’s better regulation guidelines.

As far as the Directive is concerned, Art. 7 provides that Member States must bring into force the laws, regulations and administrative provisions necessary to comply with it by 18 February 2025. The discrepancy between the date when the Regulation will become applicable in the Member States and the date to bring into force the laws, regulations, and administrative provisions necessary to comply with the Directive is obviously linked to the fact that the Directive is a necessary precondition to the Regulation. Art. 8 of the Directive provides for the Commission to carry out its evaluation by 18 August 2029, i.e., in parallel with the one of the Regulation.

V. Additional Remarks and Conclusion

Considering the relevance of electronic data as evidence, the agreement on the e-evidence package represents the achievement of a crucial tool in view of future developments in judicial cooperation in criminal matters. The most noticeable innovations of the e-evidence package concern, on the one hand, the irrelevance of the location of the data, and, on the other hand, the attempt to provide for a direct relationship between the requesting state and the service provider, with the competent authority of the executing state intervening only when the provider does not comply within a set period of time.

Given the potentially high invasiveness of the measures in question, it is noteworthy that the EU e-evidence Regulation³² contains a number of robust procedural safeguards, for example:

• Protecting personal data by referring to the applicability of the EU General Data Protection Regulation (GDPR)³³ and the EU Data Protection Directive for police and justice activities³⁴;

• Providing grounds for refusal which the judicial authority of the state in which the service provider is located and who must be notified of the request for data may oppose to the requesting state, particularly to ensure the protection of fundamental rights;

• Distinguishing between the different types of data according to their intrusiveness and providing different guaranties with reference to the issuing authority: If subscriber data or data requested for the sole purpose of identifying a person (e.g., the owner of an e-mail address) are to be obtained, the order has to be issued by a judge or by a public prosecutor. If the data is considered more invasive (i.e., traffic or content data), a request by a judge is required;³⁵

• Requiring that production orders may be issued in criminal proceedings in which offences are prosecuted for which a minimum term of imprisonment of four months is prescribed for the aforementioned first type of data or three years for traffic or content data. In the latter case, the possibility of issuing the order in relation to a number of particularly serious offences (albeit with a lower sanction) is also provided for (i.e., fraud and counterfeiting of non-cash means of payment; sexual abuse and sexual exploitation of children and child pornography; attacks against information systems [all if they are wholly or partly committed by means of an information system] and terrorism offences);

• Providing time limits for the preservation of data until a subsequent request for production.³⁶

It should finally be stressed, however, that the legal e-evidence instruments presented above regulate the access and/or the acquisition of data as evidence, which means that they presuppose the existence of such data. They do not regulate obligations to retain data. The retention of data is equally important and is closely linked to the subject matter of e-evidence. Adequate regulation on data retention cannot be negated. Even “ordinary” criminal proceedings are notoriously time-consuming, not least to ensure that a fair trial and the rights of the suspects/accused persons are duly guaranteed. Moreover, a crime is often discovered only after a considerable period of time has elapsed since the commission of the offence. If data are not retained or are retained for a too short period in such cases, all the rules governing their acquisition risk finding limited application; they might even risk remaining a purely stylistic exercise. This implies the need for striking a good balance between the strictness of the rules governing access to data and the retention of data for an adequate period of time. The CJEU has reaffirmed its stance on data retention in various judgments and emphasised that interference entailed by the retention of traffic and location data is justified only to combat serious crime or to prevent serious threats to public security.³⁷ It remains to be seen whether a very recent judgment (CJEU judgment of 7 September 2023 in Lietuvos Respublikos generalinė prokuratūra)³⁸ will provide fresh impetus to the discussion on the limits to and concrete rules on data retention. After a first reading of the judgment, the CJEU provided not only interesting pointers to how the leeway to regulate data retention can be implemented in the various legal systems, but also provided guidance as to the relationship between different kinds of proceedings and the mutual use of retained data. This raises the interesting question of whether a dividing line should be drawn a priori between the different kinds of proceedings (administrative, criminal) with a prejudicial distinction of the value of the interests protected therein or whether the level of the interests at stake should be assessed from time to time with a view to enabling the use of retained data in other proceedings regardless of their nature. At the same time, the CJEU ruled on the procedural consequences if the conditions of the Union law on data retention are not met. Whereas previous case-law left this question open, the Court now expressly precludes the use of the data as evidence.