On 6 November 2019, the European Data Protection Supervisor (EDPS) issued his opinion on the new EU legal framework for gathering e-evidence in cross-border cases (for the Commission proposal, see eucrim 1/2018, pp. 35-36).

The EDPS endorses the objective of ensuring quick and effective access of law enforcement to electronically stored data in another state, but calls on the EU legislator to find a balanced approach respecting the Charter of Fundamental Rights of the EU and EU data protection law and implementing all necessary safeguards. The main suggestion in the opinion is to systematically involve judicial authorities of the enforcing Member State as early as possible. These authorities should then have the possibility to effectively and efficiently review compliance of the Production and Preservation Orders with the Charter and to raise grounds for refusal. This view is shared by many civil society stakeholders as well as by the European Parliament (see, e.g., eucrim 1/2019, pp. 38-40).

Furthermore, the EDPS is critical of the definition of the data categories and their overlap, which is not consistent with other EU law. He also calls for a re-balancing between the types of data for which European Production Orders could be issued and the categories of data concerned. The EDPS, in particular, believes that the proposed threshold for producing transactional and content data (three-year minimum of the maximum custodial sentence) is too low. Calling to mind the CJEU case law, which indicates that these data would enable precise profiles of individuals to be established, access can be made possible for serious crime only. The EDPS further argues that the sensitivity of subscriber and access data should not be underestimated because they may include privacy-invasive electronic communications metadata.

The EDPS makes concrete recommendations on the following other issues:

• Data security;
• Rights of the data subject, including enhanced transparency, and rights to remedy;
• Immunities and privileges;
• Legal representatives;
• Time limits to produce data;
• Possibilities for service providers to object.

Ultimately, the EDPS asks for more clarity on the interaction between the EU’s internal e-evidence rules and other instruments, especially a future EU-US agreement. In this context, the EDPS stresses that the EU legal framework must uphold a high level of data protection and constitute the reference for respect for fundamental rights when negotiating international agreements on cross-border access to electronic evidence.

The EDPS already issued detailed advice to the Commission regarding negotiations with the USA on an e-evidence agreement (eucrim 1/2019, p. 41). The present opinion also completes other data protection statements, e.g., those by the European Data Protection Board (see eucrim 3/2018, p. 162).