The Council of the European Union announced, on 25 January 2023, that it had reached an agreement with the European Parliament on the Proposal for a Regulation on European Production and Preservation Orders for Electronic Evidence in Criminal Proceedings and for the Execution of Custodial Sentences Following Criminal Proceedings, and the Proposal for a Directive Laying Down Harmonised Rules on the Designation of Designated Establishments and the Appointment of Legal Representatives for the Purpose of Gathering Electronic Evidence in Criminal Proceedings. In particular, the Council highlighted that the proposed Regulation and Directive will make it possible for relevant authorities to address judicial orders for electronic evidence directly to service providers in another Member State.

More in detail, the Council outlined that the proposed Regulation introduces European production and preservation orders that can be issued by judicial authorities in order to obtain or preserve e-evidence regardless of the location of the data. Notably, the Council specified that such orders may cover any category of data, including subscriber, traffic, and content data. Moreover, the Council detailed that service providers would face monetary penalties of up to 2% of their total worldwide annual turnover for the previous financial year in case of non-compliance with an order.

Specifically, the proposed Regulation explains that the service providers most relevant for gathering evidence in criminal proceedings are providers of electronic communications services and specific providers of information society services that facilitate interaction between users, noting that the categories of service providers concerned include online marketplaces providing consumers and businesses with the ability to communicate with each other, and other hosting services, including where the service is provided via cloud computing, as well as online gaming platforms and online gambling platforms. Notably, the proposed Regulation clarifies that it does not stipulate a general data retention obligation for service providers, nor any obligation for service providers to decrypt data.

Separately, the Council highlighted that the proposed Directive will be an essential instrument in applying the proposed Regulation, explaining that the same establishes the rules applicable to the appointment of service providers’ legal representatives or designation of their designated establishments who are responsible for receiving and responding to production and preservation orders. In this regard, the Council specified that the appointment of legal representatives or designated establishments is necessary because of the lack of a general legal requirement for non-EU service providers to be physically present in the EU.

You can read the press release here, the proposed Regulation here, and the proposed Directive here.

UPDATE (2 February 2023)

Civil Liberties Committee endorses agreement with Council

The Parliament announced, on 1 February 2023, that its Civil Liberties Committee endorsed the agreement with the Council on the new rules to obtain electronic evidence. In regard to the next steps in the legislative process, the Parliament highlighted that the Parliament plenary and the Council will decide on the final approval of the proposed Regulation and the proposed Directive, which will enter into force 20 days after their publication in the EU Official Journal and will apply after a transition period of 36 months.

You can read the press release here.