Thanks to Marta Sponza for collaborating on this article
Two new pieces of European legislation approved in July 2023, the e-Evidence Regulation and the Representatives Directive, will revolutionize access to electronic evidence, empowering law enforcement to seek crucial data swiftly from digital service providers.
The new legal framework
In July 2023, the European legislature adopted a regulation covering European production and preservation orders (“e-Evidence Regulation”)[1] that grants law enforcement authorities the right to request relevant data directly from digital service providers operating in the EU. The e-Evidence Regulation is complemented by a directive on legal representatives (“Representatives Directive”),[2] which mandates that service providers within the EU appoint legal representatives or designate establishments, thus streamlining the process for issuing authorities to communicate their orders regarding electronic evidence.
Under the rules set forth in the e-Evidence Regulation—which will apply as of August 18, 2026—an authority of a Member State may, in the context of criminal proceedings, issue a European production order or a European preservation order requiring a service provider offering services in the European Union and established in another Member State or represented by a legal representative in another Member State to produce or preserve electronic evidence, regardless of the location of the data.
The Representatives Directive—which must be implemented by Member States by February 18, 2026—serves as an essential tool for implementation of the e-Evidence Regulation, as it is designed to establish rules concerning the appointment of legal representatives and designated establishments. These representatives will be tasked with receiving and responding to such orders. Additionally, the designation of one or more central authorities for each Member State is envisaged to ensure the enforcement of the directive. Member States will also need to establish sanctions for violations of national provisions regarding the appointment of representatives and designated establishments.
Scope of application
The e-Evidence Regulation[3] and the Representatives Directive[4] will apply to:
- electronic communications services;
- internet domain name and IP numbering services, such as IP address assignment, domain name registries, domain name registrars, and domain name–related privacy and proxy services;
- other information service companies that enable their users to communicate with each other or make it possible to store or otherwise process data on behalf of users to whom the service is provided, as long as storage of data is a defining component of the service provided to the user.
Even if the service provider operates outside the EU, the e-Evidence Regulation applies if its services are available in the EU. Such a service provider must appoint a legal representative or designate an establishment in the EU.
New EU law enforcement tools: European Production and Preservation Orders
A “European Production Order” is a ruling that orders the production of electronic evidence (such as data on subscribers, emails, and text messages) It is issued or validated by a judicial authority of a Member State and addressed to a designated establishment or a legal representative of a service provider offering services in the EU, when that designated establishment or legal representative is located in another Member State bound by the e-Evidence Regulation.
A European Production Order can be issued only if these conditions are met:
- The order is necessary for and proportionate to the purpose of the proceedings, taking into account the rights of the suspect or the accused;
- A similar order could have been issued under the same conditions in a similar domestic case.
A European Production Order can be issued to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user for any crime or execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in a case where the convicted person absconded from justice.
European Production Orders designed to obtain traffic data are admitted only in specific cases governed by Article 5, paragraph 4.
A “European Preservation Order” is a ruling that orders the preservation of electronic evidence for the purpose of a subsequent request for production. It is issued or validated by a judicial authority of a Member State and addressed to a designated establishment or a legal representative of a service provider offering services in the EU, when that designated establishment or legal representative is located in another Member State bound by the e-Evidence Regulation.
A European Preservation Order shall be proportionate to and necessary for the purpose of preventing the removal, deletion, or alteration of data with a view to issuing a subsequent request for production of those data via mutual legal assistance, a European Investigation Order (“EIO”),[5] or a European Production Order, taking into account the rights of the suspect or the accused.
These new rules will allow national authorities to request electronic evidence directly from service providers in other Member States or to request that data be preserved for up to 60 days, so that relevant information will not be destroyed or lost. The law also introduces a mandatory deadline of 10 days for responding to a production order (eight hours in emergency cases).
When an authority requests content and traffic data, it must notify the authority of another Member State (“Enforcing Authority”). The Enforcing Authority may refuse to provide data if the data requested are specifically protected by immunity, if the act upon which the proceedings are based is not punishable in the enforcing notified state, if execution of the order would violate the ne bis in idem principle, or if execution of the order would violate fundamental EU rights.
If the Enforcing Authority invokes grounds for refusal, it shall inform the addressee and the issuing authority thereof. The service provider shall stop execution of the European Production Order and shall not transfer the data, and the issuing authority shall withdraw the order.
Member States shall establish rules for pecuniary penalties applicable to infringement of the provision regarding the execution of these orders and shall take all measures necessary to ensure that they are implemented. The pecuniary penalties shall be effective, proportionate, and dissuasive. Member States shall ensure that pecuniary penalties of up to 2% of the total worldwide annual turnover of the service provider’s preceding financial year can be imposed.
Service providers shall not be held liable in Member States for prejudice caused to users or third parties that exclusively results from compliance in good faith with a European Preservation Order or a European Production Order.
Conclusion
The legislative package is expected to increase cross-border exchange of evidence within the EU, even in relation to non-EU-based companies that offer their services in the EU.
Although the new regulatory framework may make acquisition and storage of data—and consequently prosecution of crimes across borders—more efficient, it poses quite a few challenges for service providers.
Specifically, the short deadlines for data transfer may prove challenging, given the significant amounts of data that may be involved, as well as the technical difficulties that may be involved in collecting them. This, coupled with the risk of heavy penalties, requires service providers to get to work quickly and put in place appropriate internal processes that allow fast, direct, sustainable, and secure cross-border exchange of data, as well as trained teams to ensure prompt execution of orders and limit non-compliance risks.
[1] Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings.
[2] Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonized rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings.
[3] See e-Evidence Regulation, Article 3.
[4] See Representatives Directive, Article 3.
[5] Directive (EU) 2014/41. A European Investigation Order (EIO) is a judicial decision issued in or validated by the judicial authority in one EU country to have investigative measures to gather or use evidence in criminal matters carried out in another EU country. An EIO is based on mutual recognition, which means that the executing authority is, in principle, obliged to recognize and ensure execution of the request of the other country.
