Mandate for the EU-U.S. cooperation on electronic evidence
08 February 2019by eub2 -- last modified 08 February 2019
The European Commission recommended on 5 February engaging in two international negotiations on cross-border rules to obtain electronic evidence.
Advertisement
What is electronic evidence?
Electronic evidence refers to various types of data in electronic form that are relevant in investigating and prosecuting criminal offences — including 'content data' such as e-mails, text messages, photographs and videos – often stored on the servers of online service providers, as well as other categories of data, such as subscriber data or traffic information regarding an online account. These types of data are often essential in criminal investigations to identify a person or to obtain information about their criminal activities.
Why improve the access to electronic evidence?
In the offline world, authorities can request and obtain documents necessary to investigate a crime within their own country, but electronic evidence is stored online by service providers often based in a different country than the investigator, even if the crime is only in one country. Some data may even be stored in multiple locations.
More than half of all investigations today involve a cross-border request to access electronic evidence. Electronic evidence is needed in around 85% of criminal investigations, and in two-thirds of these investigations there is a need to request evidence from online service providers based in another jurisdiction. The number of requests to the main online service providers grew by 84% between 2013 and 2018.
What are the current arrangements in place between the European Union and the United States of America?
The U.S., where the largest service providers are headquartered, is today one of the main recipients of Mutual Legal Assistance (MLA) requests for access to e-evidence from EU Member States. An agreement on Mutual Legal Assistance between the EU and the U.S. was signed on 25 June 2003 and entered into force on 1 February 2010. While this agreement is a key transatlantic mechanism for ensuring effective cooperation in the field of criminal justice and combatting organised crime and terrorism, when it comes to electronic evidence procedures often prove to be too cumbersome and slow.
Why is it necessary to open negotiations with the US on access to electronic evidence?
While the European Union's electronic evidence proposals focus on service providers operating on the EU market, many of them are based outside of the EU, which may result in conflicting legal obligations. The United States is headquarters to some of the largest internet service providers that store electronic evidence and which operate in the U.S. jurisdiction as well as in the EU. Today's mandate seeks to address any conflicts of law, in line with the principle of international comity and the approach set out by the Commission in April 2018. It would include common rules with specific safeguards to allow the data to be transferred. It should reduce the risk of fragmentation of practices and legal rules and enhance legal certainty when obtaining electronic evidence in criminal proceedings.
An EU-U.S. agreement would also significantly speed up procedures and ensure efficient prosecution of criminals in the digital age. While acquiring e-evidence via Mutual Legal Assistance takes on average 10 months, under a bilateral agreement based on the Commission's e-evidence proposal it would only take 10 days. This is not only important to save time but also to secure the evidence as electronic evidence can be more easily moved or deleted than other forms of evidence.
Why the need for direct cooperation with service providers when a Mutual Legal Assistance Agreement exists with the United States?
The judicial cooperation between public authorities, including with the U.S. is often too slow when it comes to electronic evidence, taking on average of 10 months. The 2016 joint review of Mutual Legal Assistance Agreement encouraged Member States specifically on electronic evidence to cooperate directly with U.S. service providers in order to secure and obtain electronic evidence more quickly and effectively.
Direct cooperation with U.S. service providers has developed as an alternative channel to judicial cooperation. It is limited to non-content data and is voluntary from the perspective of U.S. law. In practical terms, the public authorities of the EU Member States directly contact a service provider in the U.S. with requests to access data, typically on a user of the services it provides. Because of the voluntary nature of this channel, providers have created their own policies or decide on a case-by-case basis on whether and how to cooperate.
In addition, the prohibition under United States law for service providers to hand over content datato foreign authorities is an obstacle for EU authorities. The U.S has recently adopted a law – the U.S CLOUD ACT (23.03.2018)- which provides for a legal basis for the United States government to conclude agreements with foreign governments on access to data held by United States service providers and vice-versa. The Commission believes that an EU-US Agreement with the e-evidence proposals as the baseline could help settle any conflicting obligations for service providers and would allow them to deliver content data directly to law enforcement and judicial authorities in the EU or the United States, as the case may be.
How would fundamental rights be protected?
The protection of fundamental rights and freedoms, including privacy and data protection, will be central to the Agreement. The new Agreement will ensure that individuals are protected in line with the EU Charter of Fundamental Rights, general principles of EU law and relevant case law of the European Court of Justice.
The electronic evidence proposals from April 2018 already provide for a high level of protection of fundamental rights and will serve as the baseline for the Commission's negotiations to guarantee the necessary safeguards. As the proposals are still being considered by the Parliament and the Council, the Commission will take account of the positions of the co-legislators as the proposals evolve in the negotiations.
The Commission takes the view that any personal data covered by this agreement is protected and may only be processed in accordance with the General Data Protection Regulation (GDPR), the e-Privacy Directive and for authorities in the European Union, the Data Protection Directive for Police and Criminal Justice Authorities.
The agreement should complement the EU-U.S. Data Protection and Privacy Agreement, otherwise known as the "Umbrella Agreement" which entered into force on 1 February 2017 and the U.S. Judicial Redress Act (JRA), extending the benefits of the U.S. Privacy Act to Europeans. Additional safeguards will be added to take into account the level of sensitivity of the categories of data concerned and the unique requirements of the transfer of electronic evidence directly by service providers.
The agreement should also respect other fundamental rights, freedoms and general principles of EU law as enshrined in the European Union Treaties and Charter of Fundamental Rights, including procedural rights such as the right to an effective remedy and to a fair trial, presumption of innocence and right of defence, the principles of legality and proportionality of criminal offences and penalties and any obligations incumbent on law enforcement or judicial authorities in this respect.
What is the role of the European Parliament?
For the negotiation and conclusion of international agreements by the European Union, the Treaty provides that the European Parliament should be informed throughout the procedure. In addition, the European Parliament is involved by the Council before an international agreement can be concluded. However, the European Parliament does not have a formal role in the opening of negotiations for an international agreement by the European Union. Where the negotiations for the Second Additional Protocol may affect future EU legislation – in particular the Commission proposals on cross-border access to electronic evidence – the Commission will take account of the positions of the Council and the European Parliament as the proposals evolve in the negotiations.
Why is the Commission requesting two negotiating mandates at the same time?
There is an urgent operational need for EU Member State authorities to obtain access to electronic evidence for criminal investigations. With today's proposal the Commission is following up on the call of EU leaders in the European Council conclusions of October 2018.
In addition, the Commission believes that to avoid fragmentation and different levels of protection in different EU Member States there should be a common EU approach rather than bilateral agreements between the U.S., third countries and some EU Member States.
The Commission is requesting today two negotiating mandates: to launch discussions with the United States; and to participate in negotiations on a Second Additional Protocol to the Council of Europe "'Budapest'" Convention on Cybercrime. Although there may be a number of differences between the types of negotiations and the scope of the international agreements, the two are closely related to each other. While the scope of the agreement with the U.S. is more limited and focuses on access to electronic evidence, the Second Additional Protocol provides for a more comprehensive framework of cooperation amongst more than 60 countries. Both cover areas which are relevant to existing and future developments of common EU rules, in particular as regards the EU's approach to cross-border access to electronic evidence. The Commission considers that the negotiations will often address related issues, and that commitments taken in one negotiation may have a direct impact on the other negotiation. Therefore, the Commission adopted the two recommendations at the same time.
What is the timeline for the negotiations?
First, the Commission's recommendations will have to be adopted by the Council, which will also have to approve the negotiating directives set out in the mandates. Once the mandates are adopted, the Commission will be able to start negotiations.
Links to all the documents available here.