On 17 April 2018, the European Commission proposed new rules in the form of a Regulation and an accompanying Directive, which aim to improve law enforcement authorities’ cross-border access to e-evidence.
The proposed Regulation on European Production and Preservation Orders enables a judicial authority in a Member State to obtain electronic evidence in criminal matters directly from a service provider in another Member State. The Directive complements the Regulation, as it sets out the rules for the appointment of service providers’ legal representatives, whose role is to receive and respond to judicial orders. The new rules will ensure swift access to e-evidence, with service providers being required to respond to judicial orders within 10 days and in emergency cases within 6 hours, compared to 10 months under the current Mutual Legal Assistance process.
Will Ireland opt in?
Under the Lisbon Treaty, Ireland has an option to opt in to European laws relating to freedom, security and justice. As a result, Ireland has discretion as to whether to adopt the new e-evidence rules. Irish support for the new rules are clear, and the Government has indicated its intention to take part in the adoption and application of the new rules (see here and here).
The draft Directive
Last month, the Council reached its position on the draft Directive, which lays down precise rules for the appointment of legal representatives by internet service providers for the purposes of gathering evidence in criminal proceedings. The Directive is an essential tool for the application of the Regulation, on which the European Council adopted its position in December 2018. The creation of legal representatives was necessary because of the lack of a general legal requirement for non-EU service providers to be physically present in the EU when providing services within the EU. The legal representatives designated under the Directive could also be used for domestic procedures.
The rules will affect internet service providers in two key ways:
- Internet service providers will be required to publically designate legal representatives for receiving, complying with and enforcing orders issued by competent EU authorities.
- Internet service providers and their legal representatives will be held jointly and severally liable for non-compliance.
Current Problems with Cross-Border Access to Evidence
The proposed legislation represents a welcome development for law enforcement agencies which have battled against outdated mechanisms for accessing e-evidence stored in servers across the EU for years. As it stands, the main method for accessing e-evidence in Ireland are Mutual Legal Assistance Treaties (MLATs), governed by the Criminal Justice (Mutual Assistance) Act 2008.
The MLAT process requires a criminal investigation to be taking place in a Member State, a lawful interception warrant and a nominated authority in the Member State to make a request for interception to the Minister for Justice, Equality and Law Reform. This process takes on average, 10 months to complete.
The enforcement of MLATs is further complicated by the fact that there is no requirement for non-EU internet service providers to be present in the Union when providing services within it. This dramatically increases the time it takes to gain access to e-evidence and the likelihood that it will be disposed of or destroyed in the interim.
How will the new rules help?
The key point for these new rules is how they work in tandem. The creation of European Production Orders under the proposed Regulation will permit law enforcement authorities in one Member State to order the production and preservation of e-evidence in another Member State for the investigation of criminal matters.
The legal representatives established by internet service providers under the Directive will be compelled to respond to the European Production Orders within ten days of receiving it but there is an emergency provision whereby replies will be required within six hours. It is only SMEs who will be granted some relief.
Under the Regulation, SMEs will be able to pool together and have the same legal representative for receiving requests. Additionally, any financial sanctions imposed on SMEs will be obliged to take into account the enterprise’s financial capacity to pay.
This legislation will drastically inflate the already substantial burden on private companies, often seen in the media as too lax in their handling of personal data, to verify requests and determine the information they will provide while conforming to the protections given to personal data under GDPR.
The exchange of e-evidence is becoming increasingly important as major technology firms continue to locate their European headquarters in Ireland. The rise in demand for the gathering of e-evidence will only continue as criminal and terrorist organisations become more technologically advanced, spreading themselves across multiple EU states to avoid detection. The requirement of the proposed Directive that internet service providers appoint legal representatives to directly respond to their EPOs will present a major opportunity for Irish law firms to continue to be at the cutting edge of the European IP/IT market. This may become invaluable as the uncertainty of Brexit looms ever closer.
The European Council is ready to start trilogue negotiations on both the draft Regulation and Directive as soon as Parliament has adopted its position. It is unlikely that these negotiations will take place before the European elections in May 2019.