e-evidence proposal

e-evidence proposal
Name	e-evidence proposal
Type	Legislative proposal
Location	European Union
Introduced	2018
Status	Proposed legislation

e-evidence proposal

The e-evidence proposal is a European Union legislative initiative introduced to streamline cross-border access to electronic evidence held by service providers in Member States and third countries. It seeks to reconcile investigative powers with obligations under the Charter of Fundamental Rights of the European Union, while interacting with instruments such as the European Arrest Warrant, the General Data Protection Regulation, and the Prüm Convention. The proposal generated debate among institutions including the European Commission, the European Parliament, and the Council of the European Union and prompted commentary from stakeholders like Eurojust, Europol, civil society groups including Electronic Frontier Foundation, and national authorities such as the Bundeskriminalamt.

Background and Rationale

The initiative emerged amid concerns raised by high-profile criminal investigations linked to events such as the Paris attacks (2015), the Nice truck attack (2016), and transnational criminal networks uncovered after operations coordinated by Europol (2017) and Eurojust (2018). Proponents cited difficulties faced by judicial authorities in Member States like France, Germany, Italy, and Spain when seeking swift access to data from US-based providers such as Google, Facebook, Microsoft, and Twitter. Influences included prior instruments like the Mutual Legal Assistance Treaty regime, the Budapest Convention on Cybercrime, and case law from the Court of Justice of the European Union including rulings related to data transfer mechanisms such as the Schrems II decision and interpretations involving the European Convention on Human Rights.

Scope and Key Provisions

The proposal defined categories of "electronic evidence" including content, subscriber data, and traffic data held by providers including Amazon (company), Apple Inc., Dropbox (service), and WhatsApp. It proposed two main procedural instruments: the "preservation order" and the "production order," modelled in part on measures used by authorities like the Federal Bureau of Investigation, National Crime Agency (United Kingdom), and the Polícia Judiciária (Portugal). It set thresholds for serious offences reflected in lists used by Member States such as Belgium, Poland, and Hungary and envisaged deadlines for compliance similar to emergency procedures employed by Interpol and bilateral arrangements with countries like the United States and Canada.

Legal and Procedural Mechanisms

The draft laid out mechanisms for direct judicial-to-provider requests bypassing traditional Mutual Legal Assistance Treaty channels, proposing designated "issuing authorities" in Member States comparable to national judges and prosecutors in France (country), Romania, and Greece. It incorporated safeguards including judicial review, challenge procedures, and notification rules informed by jurisprudence from courts such as the European Court of Human Rights and the Court of Justice of the European Union. Interaction clauses addressed existing frameworks including the Data Protection Directive, the Law Enforcement Directive, and agreements like the Privacy Shield (now invalidated), while operational cooperation envisaged roles for agencies such as Eurojust and Europol and liaison with national services like Carabinieri and Polícia Federal (Brazil) for cross-jurisdictional cases.

Data Protection and Fundamental Rights Concerns

Critics invoked standards from the Charter of Fundamental Rights of the European Union, the European Convention on Human Rights, and precedents from the Court of Justice of the European Union to argue for enhanced safeguards. Concerns referenced principles underpinning the General Data Protection Regulation, decisions such as Schrems II, and oversight mechanisms exemplified by national data protection authorities like the French Data Protection Authority and the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit. Civil society organizations including Privacy International and Access Now highlighted risks to rights protected under instruments like the Universal Declaration of Human Rights when enforcement powers extend to providers headquartered in jurisdictions such as United States or China.

International and EU Institutional Responses

The European Commission presented the draft and engaged with the European Parliament's committees including the Committee on Civil Liberties, Justice and Home Affairs and with the Council of the European Union working parties. National parliaments in Member States including Austria, Czech Republic, and Netherlands debated subsidiarity implications and liaised with third countries including United States through mechanisms like the U.S.–EU Privacy Shield context and dialogues involving the US Department of Justice and the U.S. Congress. International organisations such as the Council of Europe and OECD provided forums for discussion, while technology firms including Apple Inc. and Google LLC issued policy positions.

Criticisms and Support from Stakeholders

Supporters including law enforcement agencies such as the Bundeskriminalamt and prosecutors from Italy argued that faster access to data would aid investigations into offences associated with cases like Brussels bombings and organised crime uncovered by operations involving Europol. Opponents including Electronic Frontier Foundation, Amnesty International, and privacy regulators argued that the proposal risked weakening safeguards established by the General Data Protection Regulation and decisions from the Court of Justice of the European Union. Academic commentators from institutions such as Oxford University, University of Cambridge, and European University Institute published analyses weighing proportionality, necessity, and extraterritoriality.

Implementation, Impact, and Case Law

Implementation depended on transposition and cooperation across Member States including Sweden, Finland, and Portugal, with pilot applications involving providers like Microsoft Corporation in cross-border investigations. Subsequent litigation reached courts such as the Court of Justice of the European Union and national constitutional courts in Germany and Poland, producing jurisprudence addressing conflicts with rulings like Schrems II and principles from the European Convention on Human Rights. Empirical assessments from research centres at London School of Economics and Max Planck Institute examined operational impact on investigations into offences exemplified by cases prosecuted by Eurojust and outcomes reported by Europol.

Category:European Union law