Thanks to Arianna Venditti for collaborating on this article.
On June 14, the Italian Court of Cassation issued two rulings[1] with significant implications for transmitting and sharing encrypted communications across EU borders under a European Investigation Order (“EIO”).[2]
The rulings came in a case where French judicial authorities had obtained encrypted communications exchanged via the Sky Ecc system and shared them with Italian authorities under an EIO. The rulings clarify how evidence is to be shared across borders in the EU and discuss striking a balance between effective law enforcement and the protection of fundamental rights.
Key Elements of the Rulings
-
Streamlined Cross-Border Evidence Sharing under an EIO
The Italian Court of Cassation stated that encrypted communications obtained by an EU judicial authority can be transmitted for use in a proceeding in another EU Member State without separate judicial approval.
The court noted that the rules governing acquisition of data stored abroad under Section 234-bis of the Code of Criminal Procedure (CCP) typically require the consent of the data owner, but those rules do not apply in this scenario. An EIO allows direct judicial cooperation between EU Member States, so when data are obtained by a different EU judicial authority, authorities can exchange evidence in a streamlined manner.
-
Simplified Prosecutorial Access to Certain Types of Data
Another key aspect the ruling establishes is that an EIO allows an Italian prosecutor to request and use directly evidence obtained by another EU country. This reduces the time and complexity of cross-border investigations and ensures that prosecutors can move forward with their cases more efficiently. Additionally, the court clarified that when requests are made for certain types of data, such as communications traffic or device locations sought from service providers, a prosecutor’s request is sufficient. No separate authorization from a judge is needed, which streamlines the process further.
This ruling indicates to companies operating in EU countries that the EIO framework facilitates efficient and fast cross-border data exchange between judicial authorities. Bureaucratic obstacles are reduced and judicial proceedings are accelerated, but on the flip side data acquired by the judicial authority of one EU Member State may be accessed by another EU judicial authority without further consent from the company.
-
Safeguarding Fundamental Rights in Cross-Border Evidence Use
The court noted that while these rulings make the process of evidence sharing more efficient, it is important to safeguard fundamental rights, particularly the right to a fair trial and the protection of personal data. The court stated that encrypted communications should not be used as evidence in a criminal case if doing so would violate the rights of the individuals involved. However, the burden of proving such a violation lies with the party raising the issue.
In this case, the defense argued that not having access to the encryption algorithm needed to decrypt the communications was a violation of the defendant’s rights. However, the court concluded that no violation had occurred. It based this on the fact that the encrypted messages were linked to a specific encryption key and could not be altered. Without the correct key, the messages could not be decrypted, ensuring their integrity. Therefore, the lack of access to the decryption algorithm did not undermine the defendant’s rights, as there was no risk of data alteration.
These two rulings from Italy’s top court set a precedent likely to influence future cases on encrypted communications and cross-border evidence sharing within the EU and are particularly relevant for businesses and organizations operating across multiple jurisdictions. The rulings illustrate how technological evolution is reshaping criminal proceedings, while also highlighting the increasingly transnational nature of legal processes. International companies will want to adapt to these changes quickly by implementing a unified cross-border approach to data management.
Transnational companies should also keep in mind that it is now easier for judicial authorities across the EU to exchange evidence collected in domestic proceedings. The Italian court’s rulings pave the way for evidence to circulate around the EU without judicial authorization. This is no small matter for transnational companies. They should take an in-depth look at this development in evidence sharing via EIO and raise awareness of how easily they may now become involved in interconnected proceedings across EU countries.
[1] Nos. 23755 and 23756.
[2] https://portolano.it/en/newsletter/portolano-cavallo-inform-digital-ip/empowering-law-enforcement-beyond-borders-eu-breakthrough-accessing-e-evidence-service-providers#_ftn5.
