E-Evidence: Government wants to facilitate international access to cloud data

Making it easier for investigating authorities to access digital evidence ("e-evidence") in other EU countries is the aim of a draft law that the German government introduced on Wednesday. The law covers data such as emails, chat messages, IP addresses and mobile phone locations. With this project, the government wants to transpose the EU regulation and an associated directive from 2023 on the "cross-border preservation and handover of electronic evidence" in criminal proceedings into national law. The new provisions are intended to enable prosecutors to request electronic evidence directly from service providers in other member states or to initially request that it be preserved.

Until now, investigators have had to contact the country of domicile to access data stored abroad by a traditional request for mutual legal assistance or a European Investigation Order. There, the competent authority examines the request and forwards it if necessary. A potential transfer of data also takes place via the official channel. This time-consuming and resource-intensive process is to be replaced by direct access.

The traditional methods of investigative cooperation are often not up to the challenges of the digital space, explains the Federal Ministry of Justice, which is in charge of the project. Requests for legal assistance can take several months – particularly in the USA, where the majority of relevant service providers such as Meta, Microsoft, Apple, and Google are based. During this time, relevant digital data may have long since been deleted or become obsolete. In addition, the operators usually store the data decentralized and flexibly according to economic criteria, meaning that its storage location can change constantly.

Surrender and security orders

At the heart of the new EU legal framework are two new instruments: The European Production Order enables investigating authorities in one EU country to request digital evidence directly from providers in another member state. With a preservation order, they can also demand that data is initially stored and not deleted – until a surrender order is issued. Internet service providers – also those from countries outside the EU – must designate a permanent contact person in the Community to whom law enforcement authorities can turn.

As a rule, production orders must be complied with within ten days, in emergencies even within eight hours. The draft provides for protective mechanisms for particularly sensitive data, e.g. from public authorities or from individuals subject to professional secrecy such as doctors, journalists, and lawyers.

Germany in default: EU Commission threatens legal action

The term "service provider" is broadly defined. It includes access providers, messenger and video conferencing services, domain services, cloud, and hosting services as well as large online platforms such as Amazon, eBay, Google, Meta and Zalando. Computer game providers are also included if their services include a communication function or enable data storage. Sanctions are provided for if the provider violates its obligations. The amount of the fines to be imposed can be up to 500,000 Euro or up to two per cent of the total annual turnover.

There was already an initiative to this effect in the days of traffic lights, but it did not make it through the Bundestag. Due to the delay, the EU Commission has also initiated the second stage of infringement proceedings against Germany for not fully implementing the directive on the exchange of information between law enforcement authorities, which is linked to the e-evidence package. It has sent a further letter in the form of a "reasoned opinion" to the German government. The latter now has two months to respond and take the necessary measures. Otherwise, the EU Commission may take Germany to the European Court of Justice.

(ds)