In April 2018, in response to the perception that traditional mechanisms for international data sharing were hindering the acquisition of electronic evidence, the European Commission proposed a Regulation on European Production Orders (EPO) and European Preservation Orders (EPrO) for electronic evidence.

In February 2019, the ECBA issued its detailed response to the proposal which, whilst acknowledging the significance of electronic evidence in criminal justice and the need for timely access to it by law enforcement authorities, expressed grave concern at the proposal as originally formulated.

The full ECBA response to the proposal can be found here but, in summary, the E-evidence Working Group was concerned at the Commission’s disregard for ways to enhance existing cross-border co-operation measures, the inherent jeopardy for the protection of legally privileged material, the potential for disproportionate requests by issuing authorities, inadequate protection for the ne bis in idem principle, the risk of conflict with the GDPR, and the inadequate procedures for dealing with potential conflicts of law. The ECBA called for the implementation of specific safeguards which might form the basis for wider international co-operation in the sharing of electronic evidence.

The draft Regulation proved highly controversial and a source of contention between the European Parliament and the Commission. One of the main points of dispute was whether and how the authorities of the country in which the relevant online service provider is located (the ‘enforcing authority’) should be involved in the EPO and EPrO process. In June 2023, the European Council and Parliament agreed a compromise text of the draft Regulation, which entered into the Official Journal of the European Union in July 2023 (regulation: L 191, 28, p. 118 ff., directive: directive : L 191, 28, p. 181 ff.).

Aspects of the Regulation remain open to criticism. For example, while the grounds for refusing to enforce an OPO include where the data requested is legally privileged, the ability of the enforcing authority (or of the service provider) to identify such material may well be constrained by differing international definitions of legal professional privilege, particularly where, as a result of the Regulation’s non-disclosure provisions, the person whose data is requested is unaware of the EPO and may not be consulted. These ‘gagging’ provisions may remain in force for an indeterminate period at the discretion of the issuing authority. Likewise, the Regulation remains vague on the remedies available to those whose data is obtained via EPOs, leaving these to the national laws of issuing states, potentially raising barriers such as language and travel to effective redress.

Nevertheless, several of the ECBA’s recommendations have been adopted in the Regulation. For example, EPOs issued for traffic and content data must include, inter alia, the grounds for believing the order is necessary and proportionate, as well as a summary description of the case; the issuing authority must normally inform the enforcing authority of the EPO and provide them with the detailed information stipulated in the Regulation when the order is made. However, the issuing authority is not obliged to notify the enforcing authority if the sole purpose of a request for specific types of data (e.g. IP addresses and time stamps) is to identify the user. Likewise, the various grounds under the Regulation on which the enforcing authority may refuse an EPO are restricted to requests for traffic and content data – there is no right to refuse EPOs where the data requested is for the sole purpose of identifying the user.

Going some way to meet the ECBA’s call for a dual criminality requirement, EPOs may only be issued if a similar order could have been issued under the same conditions in a similar domestic case; meaningful engagement and scrutiny by service providers may be ensured by providing for the reimbursement of their costs under national laws; and to ensure data minimisation is observed, strict time limits will apply to the duration of EPrOs.

With the exception of Denmark, the Regulation will apply throughout the EU from 18 August 2026. An evaluation of the legislation, including its impact on fundamental rights, must take place by August 2029, providing the ECBA with a useful opportunity to give expert feedback on the practical operation of the Regulation and the professional experience of its members.

The ECBA thanks rapporteurs Stefanie Schott and Julian Hayes for their ongoing work on the organisation’s response to the Regulation.