Binding cross-border data orders promise faster investigations but place new pressure on judicial scrutiny, privacy and source protection European judicial…
Binding cross-border data orders promise faster investigations but place new pressure on judicial scrutiny, privacy and source protection
European judicial authorities will gain a faster route to digital evidence from Tuesday, when new EU rules allow binding production and preservation orders to be sent directly to service providers in another member state. The system could reduce costly delays in criminal investigations, but its legitimacy will depend on whether courts, governments and technology companies apply its safeguards consistently.
Regulation (EU) 2023/1543 becomes applicable on 18 August, three years after its adoption. It covers electronic communications, internet addressing, cloud storage and other data-processing services offered in the European Union, even when the requested information is stored elsewhere.
The change reflects a practical difficulty confronting investigators. Emails, messages, subscriber records and traffic data can be relevant to an offence committed in one country while being controlled by a company represented in another. According to the EU institutions, electronic evidence is potentially relevant to about 85% of criminal investigations.
A direct judicial channel
Under the new European e-Evidence framework, authorities can issue a European Production Order requiring a provider to hand over specified data. A European Preservation Order can require the company to prevent information from being deleted or altered while a subsequent request is prepared.
Providers will normally have 10 days to transmit data covered by a production order. In an emergency, the deadline falls to eight hours. Preservation orders must be acted upon immediately, with the information ordinarily retained for 60 days. The issuing authority may extend that period by another 30 days.
The orders cannot be used as open-ended demands for whatever information a company may hold. They must concern specific data, be necessary and proportionate, and be available under comparable conditions in a domestic investigation.
The level of judicial involvement depends partly on the sensitivity of the information. Judges, courts and investigating judges may issue the orders, while prosecutors can act independently for less intrusive categories such as subscriber information and data used solely to identify a user. More sensitive traffic and content data require stronger judicial authorisation.
Safeguards across borders
The central institutional innovation is also the source of the greatest concern. An issuing authority will usually communicate directly with the provider’s designated establishment or legal representative, avoiding the slower process of asking authorities in the provider’s country to obtain the evidence.
For certain demands involving traffic or content data, the enforcing state must receive the order at the same time as the provider. Its authorities may object where the information is protected by an immunity or professional privilege, where the order would manifestly breach fundamental rights, or where it conflicts with the prohibition on trying someone twice for the same offence.
That review is not universal. Notification is generally unnecessary for preservation orders, subscriber information and data requested solely to identify a user. It can also be omitted where the issuing authority has reasonable grounds to believe that the offence occurred, and the person concerned resides, in the issuing state.
Those distinctions matter for journalists, lawyers, doctors, activists and others whose communications may reveal protected relationships. The regulation instructs authorities and providers to consider immunities, privileges, press freedom and freedom of expression. Yet identifying protected information can be difficult when an order provides limited context or crosses several legal systems.
The person whose data are obtained must normally be informed without undue delay. Notice may be postponed where disclosure would obstruct an investigation, but the postponement must be justified. The individual can challenge the order before a court in the issuing state.
In practice, that remedy may involve a foreign legal system, another language and significant cost. Rights that exist formally will therefore need accessible procedures, legal assistance where appropriate, and courts capable of reviewing necessity and proportionality before the consequences become irreversible.
Companies become operational gatekeepers
Service providers must alert the issuing authority if an order is incomplete, manifestly erroneous or impossible to execute. They must also raise concerns when the requested information may be protected by professional privileges or rules concerning press freedom.
Companies that fail to comply without an acceptable reason can face penalties reaching 2% of their total worldwide annual turnover. This creates a strong incentive to respond quickly, particularly during the eight-hour emergency window.
European Digital Rights has argued that the notification system remains too narrow and leaves providers carrying too much responsibility. Its analysis of the legislative compromise warns that journalists, human-rights defenders, political opponents and lawyers could be especially exposed when another state does not examine an order before data are transferred.
Providers should not become substitute constitutional courts. Their role is to recognise evident defects, protect data and follow lawful orders. The responsibility for assessing legality, proportionality and fundamental rights must remain with independent public authorities that can be held accountable.
Implementation will determine trust
Member states have been required to establish competent authorities and ensure that covered providers appoint an EU establishment or legal representative able to receive orders. The Commission must also begin monitoring the regulation’s operation and complete an evaluation by August 2029.
That monitoring should reveal more than the total number of orders. Legislators and the public will need to know how often emergency procedures are used, how many orders are corrected or refused, whether notices to affected people are repeatedly delayed, and whether challenges provide remedies before improperly obtained data enter criminal proceedings.
Particular attention should be paid to differences between member states. Mutual recognition depends on confidence that every participating justice system applies comparable standards. Where judicial independence or the treatment of journalists and civil society is already disputed, a direct cross-border order can transmit those weaknesses beyond national borders.
As previous European Times reporting on surveillance and democratic accountability has shown, the existence of a legitimate security objective does not make every investigative measure proportionate. Independent authorisation, narrow targeting and effective remedies remain essential.
Speed requires accountability
The regulation does not itself create indiscriminate data retention or give investigators unrestricted access to online accounts. It establishes a targeted procedure for obtaining or preserving information already controlled by specified providers. That distinction should be maintained in both public debate and enforcement practice.
Faster access can serve victims and the administration of justice when evidence is at risk of disappearing. It can also magnify errors when an order is overly broad, politically motivated or issued without sufficient scrutiny.
From Tuesday, the e-Evidence system moves from legislation to daily institutional practice. Its success should not be measured only by how quickly data cross a border. The more important measure will be whether Europe can accelerate criminal cooperation without weakening the judicial protection that gives such cooperation democratic legitimacy.
