- Notifications sent to member states where service provider is located
- Possibility to refuse an order when there are fundamental rights concerns
- Data protection rules must be respected and data controllers notified
On Tuesday, EP and Council negotiators reached a political agreement on core elements of a package on requesting electronic data for criminal investigations from elsewhere in the EU.
After negotiations on June 28, a political agreement was reached on core elements of the legislative package on collecting and preserving electronic evidence (“e-evidence”) across member state borders in the EU. The new legislation would allow national authorities to request evidence directly from service providers in other member states, or ask that data be preserved for future use. The new rules would also mandate companies to appoint EU legal representatives to deal with electronic evidence requests in a centralised way.
Fundamental rights in focus
In the negotiations, Parliament sought to ensure that criminal investigations become more efficient, while fundamental rights and EU data protection rules are respected. Parliament secured a requirement to notify the authorities in the member state where the service provider is located, for traffic and content data, except for situations where the suspect resides in the issuing member state and the crime is committed there. Orders can be refused on certain grounds, notably when there are concerns about fundamental rights. In addition, the protection of media freedom and journalists was one of the main priorities of the Parliament.
Co-legislators also agreed on the rules on the reimbursement of costs and sanctions that could be imposed to the service providers in case on non-compliance. Finally, it was agreed that orders would be communicated through a specific, secure IT system.
Rapporteur Birgit Sippel (S&D, DE) said: “As everyday life moves online, criminal activity also takes place more online, meaning that electronic evidence is increasingly important. But, accessing this evidence across borders can be a lengthy and cumbersome process, and data is too often deleted in the process. Today’s provisional agreement on the main elements of the package means that national authorities can make a direct request to service providers in other Member States to hand over or secure electronic evidence. As a long-standing advocate for the protection of personal data, I fought hard to secure safeguards that mean investigating authorities have to inform the target country’s authorities where the most sensitive data, traffic and content data, are concerned and give them an opportunity to refuse an order in specific circumstances, in particular where fundamental rights are at stake, while the service provider has to preserve the data. Parliament also made it clear that service provider will have the right to raise concerns to both the issuing and the enforcing State, for example, where the right to freedom of expression is at stake.”
The negotiating teams will still have to agree on outstanding aspects of the package, which consists of a regulation and a directive. Then, the European Parliament and the Council of the EU will have to formally adopt them.