Electronic evidence in criminal matters

Opinion 7/2019

EDPS Opinion on Proposals regarding European Production and Preservation Orders for electronic evidence in criminal matters

6 November 2019 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under article 58(3)(c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’.

He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and to foster accountable policymaking in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS supports the objective of making cross-border access to electronic evidence more efficient but stresses the need to improve the legislative Proposals presented by the Commission to ensure respect for fundamental rights and compliance with data protection requirements. Both are key to establishing a functioning framework for the European Production and Preservation Orders to gather electronic evidence in criminal matters.

2 | P a g e

Executive Summary

In April 2018, the Commission tabled two Proposals - for one Regulation and one Directive to establish a legal framework that would make it easier and faster for police and judicial authorities to secure and obtain access to electronic evidence in cross-border cases. Since then, the Council has adopted general approaches on the Proposals and the European Parliament issued several working documents. The European Data Protection Board issued its opinion. Related developments have taken place at international level, most notably with the launch of negotiations of an international agreement with the United States on cross-border access to eevidence as well as work on a Second Additional Protocol to the Cybercrime Convention. With the present opinion, the EDPS wishes to provide the EU legislator with new input for the forthcoming work on the Proposals, taking into account the developments listed above. In today’s world transformed by new technologies, time is often of the essence to enable those authorities to obtain data indispensable to carry out their missions. At the same time, even when investigating domestic cases, law enforcement authorities increasingly find themselves in “cross-border situations” simply because a foreign service provider was used and the information is stored electronically in another Member State. The EDPS supports the objective of ensuring that effective tools are available to law enforcement authorities to investigate and prosecute criminal offences, and in particular welcomes the objective of the Proposals to accelerate and facilitate access to data in cross-border cases by streamlining procedures within the EU. At the same time, the EDPS wishes to underline that any initiative in this field must be fully

respectful of the Charter of Fundamental Rights of the EU and the EU data protection

framework and it is essential to ensure the existence of all necessary safeguards. In particular, effective protection of fundamental rights in the process of gathering electronic evidence cross-border requires greater involvement of judicial authorities in the enforcing Member State. They should be systematically involved as early as possible in this process, have the possibility to review compliance of orders with the Charter and have the obligation to raise grounds for refusal on that basis. In addition, the definitions of data categories in the proposed Regulation should be clarified and their consistency with other definitions of data categories in EU law should be ensured. He also recommends reassessing the balance between the types of offences for which European Production Orders could be issued and the categories of data concerned in view of the relevant case law of the Court of Justice of the EU. Furthermore, the EDPS makes specific recommendations on several aspects of the e-evidence Proposals that require improvements: the authenticity and confidentiality of orders and data transmitted, the limited preservation under European Preservation Orders, the data protection framework applicable, the rights of data subjects, data subjects benefiting from immunities and privileges, the legal representatives, the time limits to comply with European Production Orders and the possibility for service providers to object to orders. Finally, the EDPS asks for more clarity on the interaction of the proposed Regulation with future international agreements. The proposed Regulation should maintain the high level of data protection in the EU and become a reference when negotiating international agreements on cross-border access to electronic evidence.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC , and in particular, Articles 42(1), 57(1)(g) and 58(3)(c) thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION AND BACKGROUND

1. On 17 April 2018, the Commission released two legislative Proposals (hereinafter “the Proposals”), accompanied by an Impact Assessment , including:  a Proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters (hereinafter “the proposed Regulation”);  a Proposal for a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings (hereinafter “the proposed Directive”).

2. The proposed Regulation would co-exist with Directive 2014/41/EU regarding the European Investigation Order in criminal matters (hereinafter “EIO Directive”) , which aims at easing the process of gathering evidence in the territory of another Member State and covers every type of evidence gathering, including electronic data . All Member States which took part in the adoption of the EIO Directive had until May 2017 to implement it in their national legislation .

3. On 26 September 2018, the European Data Protection Board (hereinafter “EDPB”) adopted an opinion on the Proposals.

4. On 7 December 2018 and 8 March 2019, the Council adopted its general approach on the 13 14 proposed Regulation and the proposed Directive respectively. The European Parliament published a series of working documents. 5 | P a g e

5. The European Data Protection Supervisor (hereinafter “EDPS”) welcomes that he has been consulted informally by the Commission services before the adoption of the Proposals. The EDPS also welcomes the references to the present Opinion in Recital 66 of the proposed Regulation and Recital 24 of the proposed Directive.

6. On 5 February 2019, the Commission adopted two recommendations for Council Decisions: a Recommendation to authorise the opening of negotiations in view of an international agreement between the European Union (EU) and the United States of America (US) on cross-border access to electronic evidence for judicial cooperation in criminal matters and a Recommendation to authorise the participation of the Commission, on behalf of the EU, in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185) (hereinafter “Convention on Cybercrime”) . The two recommendations were the subject of two EDPS Opinions . Both negotiations with the US and at the Council of Europe are closely linked.

7. In February 2019, the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament addressed similar letters to the EDPS and the EDPB to request a legal assessment of the impact of the US CLOUD Act that was passed by the US Congress in March 2018, on the European legal framework for data protection. On 12 July 2019, the EDPS and the EDPB adopted a Joint Response to this request with their initial assessment .

8. On 3 October 2019, the United Kingdom and the United States signed a bilateral agreement on cross-border access to e-evidence for the purpose of countering serious crime . It is the first executive agreement allowing US service providers to comply with requests for content data from a foreign country under the US CLOUD Act.

9. This Opinion covers both Proposals, with however a main focus on the proposed Regulation. In line with the EDPS mission, it is primarily focussed on the rights to privacy and to the protection of personal data and aims to be consistent and complementary to the EDPB Opinion 23/2018, also considering the general approaches of the Council and the working documents of the European Parliament.

2. AIMS OF THE PROPOSALS

10. The overarching objective of the proposed Regulation is to speed up the process of securing and obtaining electronic evidence across borders . To this end, it would introduce two new types of binding orders: the European Production Order (hereinafter “EPO”) for the production of data by a service provider and the European Preservation Order (hereinafter “EPO-PR”) for the preservation of data in view of subsequent requests to produce these data, which may be used as evidence in criminal proceedings.

11. The proposed measures would entail the processing of personal data and limitations on both the right to privacy guaranteed by Article 7 of the Charter and the right to protection of personal data guaranteed by Article 8 of the Charter. To be lawful, such limitations on the exercise of fundamental rights protected by the Charter must comply with the conditions laid down in its Article 52(1). This includes ensuring that any limitation on the right to personal data protection is “necessary” and “proportionate”. In order to assist the EU legislator in assessing compliance of proposed legislative measures involving the processing of personal data, the EDPS published a “Necessity Toolkit” based on relevant case law and his previous opinions. 6 | P a g e

12. Under the proposed Regulation, the orders would be issued only in cross-border situations and not in domestic ones . Production orders would only be issued or validated by a judicial authority of a Member State if a similar measure is available for the same criminal offence in a comparable domestic situation in the issuing State. The orders would be directly addressed by the issuing authority to service providers offering services in the European Union (hereinafter “EU”) and established or represented via a legal representative in another Member State. They would be transmitted to service providers through European Production Order Certificates (hereinafter “EPOC”) or European Preservation Order Certificates (hereinafter “EPOC-PR”). The orders would be directly executed in the enforcing Member State, without a prior procedure for recognition and enforcement in this Member State. However, under certain conditions, limited grounds could be raised in the enforcing Member State to oppose the recognition or enforcement of the orders (Article 14) or to request in the issuing Member State the review of an EPO (Articles 15 and 16).

13. The proposed Directive aims at providing a common EU solution to identify the addressees of EPOC and EPOC-PR . To this end, it introduces an obligation for all service providers offering services in the EU to designate a legal representative in the EU , which would be responsible for the reception of EPOC and EPOC-PR and their timely and complete execution .

14. In light of the challenges faced by police and judicial authorities to gather electronic evidence in today’s digital world which knows no borders, the EDPS supports the objective of providing effective tools to law enforcement authorities to quickly obtain access to electronic evidence across borders. In many cases, time is of the essence to enable those authorities to obtain data that are indispensable for their investigations and prosecutions. Even when investigating domestic cases, law enforcement authorities increasingly find themselves in “cross-border situations” simply because a foreign service provider was used and the information is stored electronically in another Member State. Therefore, the EDPS welcomes the objective of the e-evidence proposals to accelerate and facilitate such access in cross-border cases and to increase legal certainty by streamlining procedures within the EU. At the same time, he insists on the need to ensure that the preservation of and access to electronic evidence are fully respectful of the Charter of Fundamental Rights of the EU (hereinafter “Charter”) and the data protection framework.

15. The EDPS notes that the Impact Assessment accompanying the Proposals envisages the right to liberty and security enshrined in Article 6 of the Charter as “the fundamental rights of persons who are or may become victims of crime” . The EDPS underlines that this right is intended to protect individual liberty and security against the State, not to guarantee it through the State .

16. In order to comply with conditions of Article 52(1), the EDPS recalls that the CJEU found that the EU legislator should “lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards so that the persons whose data have been retained have sufficient guarantees to effectively protect their personal data against the risk of abuse and against any unlawful access and use of that data” . The Proposals constitute the latest instalment of a series of legislative measures in which the EU legislator is called to balance data protection rights of individuals against public interest in combating and prosecuting criminal offences. Such measures are obviously liable to conflict with data protection rights . It is therefore essential to closely 7 | P a g e scrutinise these Proposals and pay particular attention to the existence of all necessary safeguards.

3. MAIN RECOMMENDATIONS

3.1. Clear definitions of the categories of personal data

17. Electronic evidence is defined in Article 2(6) of the proposed Regulation and is divided in four sub-categories of “subscriber data”, “access data”, “transactional data” and “content data” defined in Article 2(7), (8), (9) and (10), respectively. This division focus on the 35 36 “sensitivity” of each data category and, on this basis, provides for different requirements for accessing data falling under these categories. 3.1.1. Consistent definitions of data categories in EU law

18. The EDPS stresses the importance of ensuring consistency between definitions of data categories in the proposed Regulation and other definitions of data categories in EU law. In this regard, the EDPS notes that the proposed Regulation takes into account the definitions proposed in the context of the draft ePrivacy Regulation, which would define electronic communications data and distinguish between the two categories of electronic 38 39 communications content data and electronic communications metadata .

19. While the category of content data in the proposed Regulation seems consistent with the one of electronic communications content data in the proposed ePrivacy Regulation, the categories of transactional data and access data in the proposed Regulation are new data categories. They are not currently defined in EU data protection law and they both include - but are not limited to - electronic communications metadata as defined by the proposed ePrivacy Regulation. The future ePrivacy Regulation would apply to the preservation and production of data of electronic communications service providers under the proposed Regulation on e-evidence. The EDPS considers that it is therefore essential to ensure full consistency between the definitions of these two texts throughout the legislative process. The EDPS recalls that he has repeatedly called for a swift adoption of the ePrivacy Regulation to avoid legal uncertainty . 3.1.2. Lack of clarity and overlap of data categories

20. The EDPS stresses the importance of laying down clear and straightforward definitions of each data category in order to ensure legal certainty for all stakeholders involved - which is one of the main objectives of the proposed Regulation . The effectiveness of the orders could easily be undermined by the lack of precision and clarity of the core definitions in the proposed Regulation.

21. The proposed Regulation would introduce a new category of “access data” defined as “data related to the commencement and termination of a user access session to a service”. Article 2(8) also defines access data in relation to the purpose for processing such data, i.e. they are “strictly necessary for the sole purpose of identifying the user of the service”. It further specifies that they also include electronic communications metadata. The Explanatory Memorandum explains that it is essential to cover this category of access data since it often constitutes, with subscriber data, “the starting point to obtain leads in an investigation about the identity of a suspect” . However, the EDPS observes that this new category of data is 8 | P a g e not consistent with existing definitions of data categories in EU law and Member States’ law . The creation of this data category seems artificial and to have as only objective to attach lower requirements to the production of such data, similar to those attached to the production of subscriber data (Article 4(1)). Therefore, the EDPS recommends to reconsider the need for introducing this new data category of access data.

22. Alternatively, should the category of access data remains in text, the EDPS considers, as already raised by the EDPB , that the proposed definition of access data lacks clarity. The EDPS notes that both definitions of transactional data and access data include “electronic communications metadata” as defined by the proposed ePrivacy Regulation. They both list a number of data falling in their category as examples. Some examples are explicitly covered by both definitions, such as the date and time. In addition, the definition of transactional data excludes data falling in this category if “such data constitute access data”. Service providers may have difficulty to distinguish between access data and transactional data in practice, while the proposed Regulation provides that these categories should be produced under different conditions. Therefore, the EDPS recommends clarifying the definitions of access data and transactional data and making a clear delineation between these categories to ensure legal certainty. The same data should not be produced under different conditions depending on the category under which it is requested. Otherwise, EPO for access data must be subject to the same conditions as transactional data and content data (Article 4(2)).

23. Furthermore, the EDPS shares similar concerns as regard the category of subscriber data. The Convention on Cybercrime already includes a definition of “subscriber information” , which is not always interpreted uniformly among Parties to the Convention . The proposed Regulation provides the first definition of subscriber data in EU law. The EDPS considers that defining this data category in the proposed Regulation is a difficult but important exercise. The EDPS points out that it is essential to avoid any confusion between the categories of transactional data and subscriber data, in particular with regard to point (b) of Article 2(7), since the production of these two data categories would also be submitted to different conditions. In this regard, the EDPS points out that IP addresses could fall in both categories of transactional data and subscriber data, in addition to the category of access data which specifically mentions IP address. The EDPS recommends amending the proposed definition of subscriber data in order to further specify this category, in particular point (b) of Article 2(7) and in relation to IP address, and to avoid overlap with other data categories. 3.2. The type of offences concerned

24. The EDPS takes note of the type of offences for which authorities may issue EPO and EPO-PR. First, EPO may only be issued if a similar measure would be available for the same criminal offence in a comparable domestic situation in the issuing State (Article 5(2) of the proposed Regulation). EPO to produce subscriber data and access data may be issued for all criminal offences (Article 5(3) of the proposed Regulation), whereas EPO to produce transactional data and content data may be issued for a variety of offences listed in Article 5(4) of the proposed Regulation: (a) all “criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least 3 years”; 9 | P a g e (b) offences “if they are wholly or partly committed by means of an information system” related to fraud and counterfeiting of non-cash means of payment, sexual abuse and exploitation of children, child pornography and attacks against information systems; (c) terrorist offences.

25. Second, EPO-PR to preserve any type of electronic evidence may be issued for all criminal offences without distinction (Article 6(2) of the proposed Regulation). The requirement of a similar measure available for domestic cases does not apply to EPO-PR.

26. The EDPS considers that the proposed threshold of three-year minimum of the maximum custodial sentence in Article 5(4)(a) and the list of cyber-dependent and cyber-enabled offences in Article 5(4)(b) are highly problematic given the sensitivity of the transactional data and content data and the seriousness of the interference with the rights to privacy and data protection that accessing such data would entail. The threshold of three-year minimum of the maximum custodial sentence in Article 5(4)(a) of the proposed Regulation would in practice apply to a very large number of offences in Member States’ national criminal codes, including many offences that may not be considered as “serious” .

27. The EDPS recalls that the CJEU found in relation to metadata retained by providers of publicly available electronic communications that “taken as a whole, [they] may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them” and “[provide] the means [...] of establishing a profile of the individuals concerned, information that is no less sensitive, having regard to the right to privacy, than the actual content of communications” . In relation to content data, the CJEU found that access to such data may even affect the essence of the right to privacy and the right to data protection .

28. Furthermore, the EDPS raises that the CJEU held in its recent judgment in Case C-207/16 that “[i]n accordance with the principle of proportionality, serious interference can be justified, in areas of prevention, investigation, detection and prosecution of criminal offences, only by the objective of fighting crime which must also be defined as ‘serious’” and “in [those areas], only the objective of fighting serious crime is capable of justifying public authorities’ access to personal data retained by providers of electronic communications services which, taken as a whole, allow precise conclusions to be drawn concerning the private lives of the persons whose data is concerned” . The EDPS considers that access by national competent authorities to the categories of transactional data and content data would allow such precise conclusions to be drawn concerning the private lives of persons whose data would be sought with EPO. Thus, it is essential that access to these categories of data is limited to cases of serious crime only.

29. In relation to the list of cyber-dependent and cyber-enabled offences in Article 5(4)(b), the EDPS is not convinced by the justification in Recital 32 that these offences are “specific offences where evidence will typically be available exclusively in electronic form” and that “applying the same threshold as for other types of offences would predominantly lead to impunity”. The EDPS considers that not all cyber-dependent and cyber-enabled offences listed in Article 5(4)(b) may constitute “serious crimes”. Nevertheless, recognising that it might be necessary and proportionate to obtain transactional or content data in certain cases, this could be achieved through the preservation of any type of data via EPO-PR, with 10 | P a g e a request for production of the preserved data through traditional channels of cooperation (such as EIO), thus preserving the necessary high safeguards.

30. For these reasons, the EDPS recommends to reassess the balance between the types of offences for which EPOs could be issued and the categories of data concerned. In particular, the possibility to issue an EPO to produce transactional data and content data should be limited to serious crimes only .

31. Furthermore, given the potentially revealing nature of transactional data and content data, the EDPS considers that access to such data should only be granted in the context of specific serious crimes. Providing a closed list of such serious crimes would also increase legal certainty for all stakeholders involved. While the option to limit the scope of application of the EPO to certain crimes was discarded at an early stage of preparation of the Proposals , the EDPS recommends to reconsider this possibility, taking into account the relevant case law of the CJEU .

32. Finally, the EDPS points out that similar considerations might also be relevant for EPO to produce subscriber data and access data as currently defined in the proposed Regulation, to the extent these categories are not further specified and circumscribed and could potentially include electronic communications “metadata” . 3.3. Data Security

33. Ensuring the security of personal data is a clear requirement under EU data protection law . Data security is also essential to ensuring the secrecy of investigations and the confidentiality of criminal proceedings. While welcoming Article 11 on the confidentiality of information and Recital 57 of the proposed Regulation , the EDPS notes that it does not adequately address the question of the authenticity of the certificates received by service providers , the security of the transmission of personal data to the relevant authorities in 59 60 response and the security of orders received by enforcing authorities .

34. The verification of authenticity of certificates and orders is essential to ensure that all personal data transmitted remain confidential and avoid potential data breaches that could have adverse consequences for individuals concerned and engage the liability of the enforcing authorities, service providers or their legal representatives under the applicable data protection laws. Therefore, the EDPS recommends introducing in the proposed Regulation provisions defining how the authenticity of certificates and orders can be ensured and verified. The EDPS notably suggests investigating the use of digital signatures in cases where orders and certificates are transmitted electronically. He underlines that ensuring that the necessary means are put in place so that the personal data are disclosed and communicated under the Proposals in a secure environment with the means to ensure the authenticity of documents is key for achieving the objective of a fast gathering of electronic evidence in compliance with fundamental rights.

35. The EDPS welcomes that, with regard to the security of the transmission of certificates and the requested data, the Council general approach specifies that EPOC and EPOC-PR shall be transmitted “in a secure and reliable way allowing the addressee to produce a written record and to establish the authenticity of the Certificate” and that the requested data shall be “transmitted in a secure and reliable way allowing the establishment of authenticity and integrity” . He considers however that more specific and effective 11 | P a g e safeguards are required, including with regard to the security of orders received by enforcing authorities.

36. Regarding in particular the transmission of certificates, Article 8(2) of the proposed Regulation and of the Council general approach would allow, the use of already established dedicated platforms or secure channels to handle requests of law enforcement and judicial authorities. However, this remains optional and would not be expressly allowed for other communications by the issuing authority involving personal data that are to take place following that transmission.

37. The EDPS also notes that “the Commission is working to strengthen the existing judicial cooperation mechanisms through measures such as the creation of a secure platform for the swift exchange of requests between judicial authorities within the EU” and that the Commission suggests considering “a possible expansion of the eCodex and SIRIUS platforms to include a secure connection to service providers for the purposes of the transmission of the EPOC and EPOC-PR and, where appropriate, responses from the service providers” . The EDPS notes in this regard that during the negotiations in Council, one Member State proposed “the addition of a new recital requesting the Commission and the Member States to work on and establish as soon as possible secure electronic channels of communication allowing the establishment of authenticity and integrity” . In this regard, the EDPS recalls that any establishment of a new IT system processing personal data requires a legal basis and that in particular, at least, where such IT system entails the involvement of an EU institution, body, agency or office, this legal basis shall be found in an EU legal act. The EDPS therefore recommends to provide clearly in the Regulation for an explicit legal basis for an IT system to be used for the processing of personal data for the purpose of the Regulation.

38. Additionally, the EDPS welcomes the fact that the publicity of the information related both to the identification of the authorities and legal representatives of services providers is provided for under the Proposals and under the Council general approach . However, he recommends modifying the proposed texts so as to impose these obligations before the date of application of other provisions, thus ensuring that all the required information is available at the date of application of the main provisions and avoiding any risk of personal data breach . 3.4. Greater involvement of judicial authorities in the enforcing Member State

39. According to the proposed Regulation, the control over compliance with fundamental rights of data subjects concerned by the EPO/EPO-PR, including over the necessity and proportionality of the orders and the possible applicability of immunities and privileges, would primarily be ensured by the issuing authority. Competent authorities in the enforcing Member State would only intervene as enforcing authorities in cases where service providers do not comply with an order. Hence, once orders are issued, given that in most cases data subjects would not be immediately informed of the orders , service providers would be the only actors having the possibility to protect data subjects privacy and data protection rights.

40. In the traditional approach to cross-border access to electronic evidence, it is primarily the responsibility of the enforcing State to ensure the review of limited grounds of refusal. While the EDPS recognises the need to identify alternative approaches to gathering evidence in a cross-border context, the need for effective guarantees for fundamental rights of data 12 | P a g e subjects remains of paramount importance. It has to be considered that relevant laws in the EU Member States - inter alia on the admissibility of evidence gathered in another Member State and what constitutes a criminal offence - may diverge . Even in the context of these Proposals if adopted, conditions for issuing an order are not fully harmonised across the EU and important objections, stemming from the respect of fundamental rights, against the execution of such order may exist . In the context of the EIO Directive negotiations, the Fundamental Rights Agency emphasised that “respect for fundamental rights constitutes a key component of the area of freedom, security and justice, as foreseen by Article 67 (1) TFEU: ‘The Union shall constitute an area of freedom, security and justice with respect for fundamental rights and the different legal systems and traditions of the Member States’ . So, even if mutual recognition is presented as a ‘principle’ which is used by EU Member States to facilitate cooperation in the area of freedom, security and justice, Member States must comply with their legal obligations to respect fundamental rights ”.

41. The EDPB found “no justification for the procedure foreseen in the draft e-Evidence Regulation to allow for the production of content data without any involvement at least of the competent authorities of the Member State where the data subject is” . The EDPB also expressed “its concerns as regards the removal of any double check by the receiving competent authority of the order transmitted, compared to the other instruments” . In its general approach on the proposed Regulation, the Council has introduced a notification to the competent authorities of the enforcing Member States. This notification would take place at the same time as EPOC are sent to service providers. However it would have no suspensive effect; it would have a limited scope (it would only be required for EPOC 78 79 concerning content data - which is the least common requested data - where the data subject does not reside in the issuing Member State); finally, the notified authorities would only be able to raise a limited number of issues (there is no general ground for refusal based on fundamental rights as such), without the power to prevent directly the enforcement of the order . Hence, several Member States requested that greater power be granted to the notified authority and covering also orders for non-content data .

42. The EDPS considers that effective protection of fundamental rights in this context requires a degree of involvement of judicial authorities of the enforcing Member State. He therefore recommends involving systematically judicial authorities designated by the enforcing Member State as early as possible in the process of gathering electronic evidence in order to give these authorities the possibility to effectively and efficiently review compliance of the orders with the Charter and ensure the obligation for these authorities to raise grounds for refusal on that basis .

43. Furthermore, the systematic involvement of judicial authorities in the enforcing Member States could ensure compliance with the dual criminality principle. Considering that there is no harmonisation of criminal offences within the EU, the abandonment of the dual criminality principle in the proposed Regulation means that personal data may be disclosed by a service provider for the purpose of the prosecution of an act, which, under the law of the Member State where it is established, does not constitute a criminal offence . The EDPS considers that the dual criminality principle is an additional safeguard for fundamental rights that should be part of the proposed Regulation. As already raised by the EDPB , such safeguard would "ensure that a State cannot rely on the assistance of another to apply a criminal sanction which does not exist in the law of another State" . The EDPS therefore recommends introducing the requirement of the dual criminality principle in the proposed Regulation, for all cases where data are requested on the 13 | P a g e basis of an offence which is neither defined at EU level nor agreed upon at EU level in a closed list to be inserted in the Regulation .

44. Finally, the involvement of the judicial authorities of the enforcing State would also be Regulation. The EDPS notes indeed that so far this Article has been used to establish cooperation mechanism between judicial authorities only. Consistently with his Opinions 2/2019 and 3/2019 , the EDPS has strong doubts that this provision could serve as a legal basis to adopt an EU Regulation establishing cross-border direct cooperation between judicial authorities and service providers in criminal matters with - in principle - no involvement of any authority in the enforcing Member State . 3.5. Limited preservation under European Preservation Orders

45. The proposed Regulation would establish EPO-PR to compel service providers to preserve data in view of a subsequent request to produce these data via a Mutual Legal Assistance (hereinafter “MLA”) request, an EIO or an EPO. Such orders aim to “prevent the removal, deletion or alteration of relevant data in situations where it may take more time to obtain the production of this data” . The EDPS understands that the EPO-PR concerns specific data stored by the service provider at the time of receipt of the EPOC-PR and does not relate to future data stored after this point in time. It is also important to stress that EPO-PR would not establish a general data retention obligation .

46. The EDPS recalls the principle of storage limitation according to which personal data should be kept for no longer than is necessary for the purposes for which they are processed. The proposed Regulation provides that the preservation must be limited to a maximum of 60 days “unless the issuing authority confirms that the subsequent request for production has been launched” (Article 10(1)). If the issuing authority makes such a confirmation during the 60 days period, the addressee shall continue to preserve the data as long as necessary to allow their production (Article 10(2)). Recital 42 further explains that this 60 day period was calculated to allow for the launch of an official request and that such “launch” requires that at least some formal steps have been taken, e.g. by sending a MLA request to translation. When the preservation of the data is no longer necessary, the issuing authority must inform the addressee without undue delay (Article 10(3)). The EDPS understands that each preservation order should in principle be linked to a subsequent request for production. The period of preservation of the data sought is therefore also linked to the future of this subsequent request. The EDPS thus suggests clarifying that the preservation would no longer be necessary and should stop if the subsequent

47. Furthermore, as already raised by the EDPB , the EPO-PR should “never serve as a basis for the service provider to process the data after the initial date of erasure”. The EDPS also understands that the data preserved should not be altered as from the time of receipt of the EPOC-PR and until their production following a subsequent request for production. Therefore, the EDPS recommends further specifying in the proposed Regulation that the data sought with an EPO-PR should be kept aside and their processing should be limited to their storage until their production. 14 | P a g e

4. ADDITIONAL RECOMMENDATIONS

4.1. Complete reference to applicable data protection framework

48. The EDPS welcomes that the proposed Regulation takes into account the EU data protection framework and states that personal data may only be processed in accordance with the GDPR and the Law Enforcement Directive for the police and justice sectors in Recital 56 of the proposed Regulation. The EDPS recommends to add a reference to the ePrivacy Directive 2002/58/EC (to be replaced by the proposed ePrivacy Regulation, once adopted ).

49. The EDPS notes that in its general approach, the Council added a provision on the further transfer of the received data by Member States authorities to third State authorities, referring to the conditions set out in the proposed Regulation and Chapter V of the Directive (EU) 2016/680 . The EDPS recalls that pursuant to Article 35 of the Directive (EU)2016/680, a transfer of personal data to a third country is subject not only to the conditions provided for Chapter V but also to compliance with the national provisions adopted pursuant to other provisions of this Directive. The EDPS therefore advises against including such a provision in the final text. 4.2. Rights of the data subjects 4.2.1. Enhanced transparency

50. The EDPS considers that general awareness about the frequency and volume of preservation and production orders addressed to service providers would give citizens in general and also public bodies the possibility to benchmark and assess the general practice in the use of these instruments. Transparency may thus play an important role in helping ensure respect for fundamental rights. The EDPS notes that some service providers already publish transparency reports on a regular basis in which they indicate overall number of access requests received from public authorities and responses to these requests.

51. The EDPS therefore suggests introducing an obligation to publicly disclose periodically and in an aggregate form the number of EPOC and EPOC-PR received by services providers under the proposed Regulation, and whether or not these requests were fulfilled . 4.2.2. Right to a remedy

52. The EDPS welcomes Article 17 of the proposed Regulation which clarifies that remedies available under the GPDR and the Law Enforcement Directive for the data subject whose data has been obtained remain. He recommends adding the case where the data has been preserved (as it cannot be excluded that a breach of data protection obligations arises in relation to such data).

53. The conditions for the remedies against service providers on grounds of a violation of a data protection provisions under EU law as controllers or processors are already provided for under the GDPR. For instance, under Article 82(3) GDPR, “[a] controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage”. 15 | P a g e

54. Recital 46 of the proposed Regulation provides that “[n]otwithstanding their data protection obligations, service providers should not be held liable in Member States for prejudice to their users or third parties exclusively resulting from good faith compliance with an EPOC or an EPOC-PR”. The EDPS considers that an instrument relating to cooperation in criminal matters should not amend the conditions for liability of controllers or processors (i.e. service providers or competent authorities) under data protection law. Recital 46 should therefore be deleted. 4.3. Data subjects benefiting from immunities and privileges

55. The EDPS welcomes Article 5(7) of the proposed Regulation whereby an EPO concerning access, transactional or content data should not be issued if the issuing authority finds that the data are protected by immunities and privileges under the law of the Member State where the service provider would be addressed . He regrets that under the Council general approach, the obligation of the issuing authority to take immunities and privileges into account and, where necessary, not to issue an EPO or to adapt it has been limited only to situations where the immunities and privileges under the law of the enforcing States concern transactional data and the “person whose data are sought” is not residing in the issuing Member State .

56. In addition, the issuing authority might reasonably not be aware of immunities or privileges under the law of the enforcing Member State. Therefore, the EDPS welcomes the fact that, if an EPO has been issued despite such immunities and privileges under the law of the enforcing State, Article 14(2) of the proposed Regulation allows the enforcing authority to refuse the enforcement of an order, without limitations as to the data concerned . However, the EDPS notes that it is only in cases where, for another reason, the certificate would not have been complied with by the service provider, that the enforcing authority could raise such objection . Under the Council’s general approach, such objection has been limited to cases where the “person whose data are sought” does not reside in the issuing State and to content data .

57. He also takes note of Article 18 of the proposed Regulation which provides that if data were obtained despite such immunities and privileges, “these grounds are taken into account in the same way as if they were provided for under their national law” .

58. The EDPS recommends modifying the proposed Regulation so as to at least ensure that:  an EPO cannot be issued where the transactional and content data are protected by immunities and privileges under the law of the enforcing Member State and it was not possible to obtain such immunities and privileges to be waived ;  there is an obligation in the enforcing State to review this ground for all such data . 4.4. Legal representatives

59. As already stressed by the EDPB , any confusion should be avoided between legal representatives appointed by service providers offering services in the EU for the purpose of gathering evidence in criminal proceedings and the representatives appointed to comply with Article 27 GDPR. Similarly, confusion should be avoided with the representatives that would have to be appointed to comply with the proposed ePrivacy Regulation . 16 | P a g e

60. Representatives appointed to comply with the proposed Directive and the GDPR may share some similarities as they would act as contact points of the service providers they represent. However, they would have very different tasks and responsibilities in nature and they would answer to different types of stakeholders . These two functions require different knowledge and competencies. Furthermore, these obligations to designate representatives may apply to different service providers, depending on whether they are subject to the proposed Directive or the GDPR . Therefore, the EDPS recommends clarifying that these different types of representatives would pursue different objectives and have different tasks and responsibilities. 4.5. Time limits to produce data

61. One of the main objectives of the proposed Regulation is to speed up the cross-border procedure to obtain evidence in another State compared to existing cooperation mechanisms. The EDPS notes that the time limits provided under the proposed Regulation are not only a time period to ensure a swift preservation and production of data but also the time in which the compliance check of the certificates with fundamental rights, among other grounds, has to take place.

62. While understanding the objectives of the proposed Regulation (such as preventing the volatility of data or ensuring the effectiveness of criminal proceedings), the EDPS considers that the time limits in all cases are too short to appropriately assess the certificates received and identify if there are any grounds not to comply with them (e.g. violation of the Charter or conflict of laws) and take the appropriate decision. He notes that, comparatively, the EIO Directive provides a time limit of 30 days for judicial authorities in the executing State to perform their assessment and decide on the “recognition or execution” of an order and for 90 days following the taking of that decision to carry out the investigative measure . He underlines also that in any event, in order to avoid the deletion of the data sought while assessing the EPOC, Article 9(6) obliges service providers to “preserve the data requested, if it does not produce it immediately” and “[t]he preservation shall be upheld until the data is produced”.

63. Therefore, the EDPS recommends setting longer time limits than 10 days, which would allow an appropriate assessment of the certificate as well as the transmission of the requested data in due time.

64. Moreover, the EDPS notes that, besides emergency cases, the proposed Regulation allows in all cases issuing authorities to define shorter time limits than 10 days if they indicate “reasons for earlier disclosure”. Unless further justification is provided for giving issuing authorities the possibility to define themselves shorter deadlines in all cases and to depart from the time limits allowed under the EIO Directive, the EDPS recommends removing this possibility for issuing authorities to impose compulsory time limits on service providers that are shorter than the one provided by the proposed Regulation.

65. Finally, the EDPS considers that the 6 hour time limit to produce the data in emergency cases might not always be realistic and recommends making it a preferred time limit rather than a compulsory one. 17 | P a g e 4.6. Possibility for service providers to object

66. The EDPS supports that the proposed Regulation allows service providers to object the enforcement of an order. Such objections should however be based on limited grounds. These grounds should be clearly defined so as not to allow providers to decide on a caseby-case basis on whether and how to cooperate. In this regard, the EDPS recommends in particular introducing a ground to object the execution of an EPOC (Article 9) and the enforcement of an EPO (Article 14) where the data is protected by immunities and privileges under the law of the enforcing Member State (see section 4.3). The EDPS notes that service providers are not obliged to assess such grounds before enforcing the order but only that they “may oppose” the enforcement of an order on that basis (Article 14(4) and (5)). The EDPS could support such approach if, on the other hand, a true review mechanism by the authorities of another Member State than the issuing State is introduced as explained above (see section 3.4). In particular, the EDPS is concerned that submitting service providers to possible pecuniary sanctions in case of non-compliance with their obligations - inter alia to preserve or transmit the data upon receipt of the certificates - might in practice dissuade them from raising objections in specific cases . 4.7. Interaction with other instruments

67. The EDPS notes that the scope of the proposed Regulation is so defined that it would allow as a matter of principle competent authorities in the EU to gather data from a service provider established in a third country, regardless of the location of the requested data, as long as it offers services in the EU. The service provider or the processing of such data may therefore be under the jurisdiction of a third country law, which may lead to conflicting obligations for service providers, under the EU framework, on the one hand and under a third country law, on the other hand. For instance, the US Stored Communications Act prohibits in principle the disclosure, by a provider of electronic communication services under US jurisdiction, of content data following requests from foreign authorities, unless such requests are from authorities of qualifying foreign governments which concluded an executive agreement with the US and the data concerns non-US persons.

68. The Commission sought to address this issue by providing in the proposed Regulation for a review procedure establishing a dialogue with the authorities of the concerned third country in case of conflicting obligations based on fundamental rights (Article 15), in an attempt to set an example for foreign legislators when drafting their own legislations . At the same time, the Commission issued recommendations for Council Decisions, for the opening of negotiations with the US on an international agreement and the authorisation to negotiate, on behalf of the EU, the second Additional Protocol to the Convention on Cybercrime (see section 1). In May 2019, the Council adopted the decisions . The negotiating directives for a EU-US agreement provide specific objectives, among which “address conflicts of law” and “set common rules for orders for obtaining electronic evidence, in the form of content and non-content data, from a judicial authority in one contracting party, addressed to a service provider that is subject to the law of the other contracting party” . The negotiating directives on the second Additional Protocol to the Convention on Cybercrime provide that the protocol should contain “a clause providing that Member States shall, in their mutual relations, continue to apply rules of the European Union rather than the Second Additional Protocol” . However, at this stage, it is not yet clear on the basis of which criteria the delineation between intra-EU cross-border cases (i.e. cases falling within the scope of the Proposals) and international cases (i.e. cases covered by an international agreement) will be defined. In this regard, the EDPS took note of the 18 | P a g e provision introduced by the Council in its general approach (Article 23) . However the EDPS recommends providing more clarity on this issue in order to ensure legal certainty. This is important for the lawfulness of any processing of personal data in this context.

69. The EDPS also recalls that, as far as data protection is concerned, the communication of personal data to third country authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties can only take place in accordance with the rules on transfer as provided by Chapter V of the Law Enforcement Directive in absence of international agreements applicable to the taking of evidence in criminal matters between the Member State and the third country concerned. In general, the EDPS underlines that it is important to ensure that the final text of the proposed Regulation maintains the high level of data protection in the EU so that, when negotiating any international agreement in matters of cross-border access to electronic evidence, it constitutes a reference that ensures respect for fundamental rights, including the rights to privacy and data protection, and provides strong safeguards.

5. CONCLUSIONS

70. The EDPS supports the objective of ensuring that effective tools are available to law enforcement and judicial authorities to investigate and prosecute criminal offences in a world transformed by new technologies. At the same time, the EDPS would like to ensure that this action is fully respectful of the Charter and the EU data protection acquis. The proposed Regulation would require the storage and communication of personal data inside and outside the EU between Member States’ competent authorities, private entities and in some cases third countries’ authorities. It would entail limitations on the two fundamental rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter. To be lawful, such limitations must comply with the conditions laid down in Article 52(1) of the Charter and notably meet the necessity condition.

71. The EDPS first considers that other alternatives that would provide greater safeguards while achieving the same goals should be further assessed.

72. Second, the EDPS takes note that the proposed Regulation already includes a number of procedural safeguards. However, the EDPS is concerned that the important responsibility of reviewing compliance of EPOC and EPOC-PR with the Charter is entrusted to service providers and recommends involving judicial authorities designated by the enforcing Member State as early as possible in the process of gathering electronic evidence.

73. The EDPS recommends ensuring further consistency between the definitions of categories of electronic evidence data and existing definitions of specific categories of data under EU law and reconsidering the category of access data, or to submit the access to these data to similar conditions to those for accessing the categories of transactional data and content data. The proposed Regulation should lay down clear and straightforward definitions of each data category in order to ensure legal certainty for all stakeholders involved. He also recommends amending the proposed definition of the category of subscriber data in order to further specify it.

74. He further recommends reassessing the balance between the type of offences for which EPOs could be issued and the categories of data concerned, taking into account the 19 | P a g e recent relevant case law of the CJEU. In particular, the possibility to issue an EPO to produce transactional data and content data should be limited to serious crimes. Ideally, the EDPS would favour the definition of a closed list of specific serious criminal offences for EPOs to produce transactional data and content data, which will also increase legal certainty for all stakeholders involved.

75. The EDPS also makes recommendations aiming at ensuring the respect for data protection and privacy rights while achieving a speedy gathering of evidence for the purpose of specific criminal proceedings. They focus on the security of the transmission of data between all stakeholders involved, the authenticity of orders and certificates and the limited preservation of data under an EPO-PR

76. Beyond the general comments and main recommendations made above, the EDPS has made additional recommendations in this Opinion regarding the following aspects of the Proposals:  the reference to the applicable data protection framework;  the rights of the data subjects (enhanced transparency and the right to a legal remedy);  data subjects benefiting from immunities and privileges;  the appointment of legal representatives for the gathering of evidence in criminal matters;  the time limits to comply with EPOC and produce the data;  the possibility for service providers to object to orders based on limited grounds.

77. Finally, the EDPS is aware of the broader context in which the initiative has been tabled and of the two Council Decisions adopted, one regarding the Second Additional Protocol to the Convention on Cybercrime at the Council of Europe and one regarding the opening of negotiations with the United States. He asks for more clarity on the interaction of the proposed Regulation with international agreements. The EDPS is eager to contribute constructively in order to ensure consistency and compatibility between the final texts and the EU data protection framework. Brussels, 6 November 2019 Wojciech Rafał WIEWIÓROWSKI Assistant Supervisor 20 | P a g e

NOTES

21 | P a g e

22 | P a g e

23 | P a g e

24 | P a g e

25 | P a g e

26 | P a g e

27 | P a g e