The recently adopted e-Evidence Regulation (EU) 2023/1543* imposes new obligations on providers of electronic communications services. The new regulation will have direct implications on such businesses as automobile manufacturers and other businesses that offer such services.
From 18 August 2026, the date from which the regulation applies, electronic evidence, such as subscriber data, traffic data or content data stored by or on behalf of a service provider in an electronic form, can be demanded directly from providers of communications services in other EU countries.
The broad term “electronic communications services” means that, for example, automobile manufacturers can fall under this regulation, if they offer such services as enabling Internet surfing via WiFi hotspots in the vehicle, access to emails, or the conveyance of signals via a communication network. Providers of connected cars services may be subject of the e-Evidence Regulation.
The obligations affect both providers based in the EU and those based outside the EU but offering their services in the Union.
Background
The significance of data and data-based processes is becoming increasingly important for almost all areas of life. This also applies to law enforcement. Measures to obtain and preserve electronic evidence are therefore becoming increasingly important for criminal investigations and prosecutions across the European Union. Network-based services can be provided from anywhere and do not require physical infrastructure, premises or staff in the country where the relevant service is offered. Therefore, relevant electronic evidence is often stored outside the investigating state or by a service provider established outside of that state, creating challenges regarding the gathering of electronic evidence in criminal proceedings.
Currently, time-consuming requests for legal assistance have to be carried out; the new regulation removes this obstacle. Upon effectiveness of the regulation, authorities will be able to directly request service providers in other member states to transmit evidence.
European Production Order and European Preservation Order
In replacing such requests for legal assistance, the regulation provides for two new instruments: the European Production Order and European Preservation Order (“Orders”). A European Production Order is a decision from a competent authority ordering the production of electronic evidence, issued or validated by a judicial authority of a member state, while a European Preservation Order is a decision that orders the preservation of electronic evidence for the purposes of a subsequent request for production. These Orders are issued or validated by a judicial authority of a member state (see below).
Services and providers in scope of e-Evidence Regulation
The following types of services fall under the scope of this regulation:
(a) Electronic communications services, such as Internet access services, messenger, telephony and email services, transmission services for machine-to-machine (M2M) and Internet of Things (IoT) services, conveyance of signals via communication networks
(b) Internet domain name and IP numbering services, such as IP address assignment, domain name registry, domain name registrar and domain name-related privacy and proxy services
(c) Other information society services that (i) enable their users to communicate with each other, or (ii) make it possible to store or otherwise process data on behalf of the users to whom the service is provided, so long as the storage of data is a defining component of the service provided to the user
The new rules apply to all service providers that offer their services in the EU. This means when (i) natural or legal persons in a member state are enabled to use the above-listed-services, and (ii) the provider has a substantial connection, based on specific factual criteria, to the respective member state. Such substantial connection is considered to exist when the service provider has an establishment in a member state, or, in the absence of such establishment, if there are a significant number of users in one or more member states, or where there is a targeting of activities towards one or more member states.
Data to be produced and preserved
The data concerned is subscriber data, traffic data and content data stored by the addressee.
- Subscriber data (also known as inventory data) includes, for example, the name, address, ID number and contact details of the user.
- Traffic data refers to data whose collection, processing or use is required for the provision of a telecommunications service. This includes, for example, phone number, beginning and end as well as origin, route and destination of the respective connection, date and time or the transmitted data volume.
- Content data relates to the content of the communication, such as text, speech, videos, images, and sound recordings.
Live monitoring of communications is not covered by this regulation.
Proceedings
European Production and Preservations Orders must be issued by a judge, a court, an investigating judge, or a public prosecutor competent in the case concerned, or by any other competent authority acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law. In such case, the Order shall be validated, by a judge, a court, an investigating judge, or a public prosecutor in the issuing state.
The orders are directly addressed to the company that is presumed to have the relevant data. As a rule, upon presentation of a European Protection Order, the company has 10 days to make the data available—and within eight hours if the situation is deemed an emergency. The European Preservation Order is implemented by the addressee immediately backing up the requested data. The obligation to back up the data ends after 60 days but may be prolonged.
In the event that there is a conflict between EU regulations and those of a third country, the addressee is obliged to inform the issuing authority and the enforcing authority of its reasons for not executing the European Production Order, within 10 days after receipt of such order. In this case, the issuing authority is entitled to request a court review.
Consequences for recipients of Orders
Affected companies must have structures and guidelines in place to implement the Orders in a timely manner. They must also be able, with external support if necessary, to check at short notice whether the orders violate an applicable law of a third country and in such case to formulate valid objections. One advantage of the new regulation is that a predefined template must be used for the Orders. This will simplify the handling of Orders for recipients.
Penalties of up to 2 percent of the total worldwide annual turnover of the service provider’s preceding financial year can be imposed. Companies should therefore ensure that internal processes are adapted in good time.
* Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings, OJ L 191, 28. July 203, p. 118-180.
