E-Evidence: Buschmann wants to facilitate international access to cloud data

Investigators are to be able to access data in cloud services and other online storage much more easily. Federal Minister of Justice Marco Buschmann (FDP) has published a draft bill for a law that aims to transpose the Regulation and a related Directive of 2023 on the "cross-border preservation and production of electronic evidence" in criminal proceedings within the EU into national law. The new provisions are intended to enable law enforcement authorities to request electronic evidence directly from service providers in other member states or to initially demand that it be preserved.

Until now, investigators have had to contact the country where a service provider based abroad is based in order to gain access to data stored there by means of a traditional request for mutual legal assistance or a European Investigation Order. The competent authority there examines the request and forwards it to the service provider if necessary. A potential transfer of data also takes place via the official channel. This process is considered to be time-consuming and resource-intensive. The e-evidence mechanism with direct access to service providers, which has now also been launched nationally by the Ministry of Justice, is intended to change this.

The core of the package is the new instrument of a European production or surrender order. Law enforcement authorities from a member state can use this to request subscriber data, connection and location information, including IP addresses, as well as content data from emails or chats, for example, directly from service providers that are active in the EU or have their headquarters or a branch in a member state, regardless of their location. Such requests must be answered within ten days, in emergencies within eight hours. Preservation orders are a further tool. This allows investigators to request data retention for up to 60 days so that nothing is deleted.

"As respectful of fundamental rights as possible"

Service providers from third countries must designate authorized recipients ("addressees") in the EU who can be contacted by law enforcement officers to request the surrender or preservation of data. If a surrender order relates to content or traffic data, a transfer may only take place with judicial approval in the case of criminal offenses that are punishable in the issuing state by a maximum prison sentence of at least three years. This also includes cybercrime, depictions of child sexual abuse, counterfeiting of non-cash means of payment or terrorism. Stricter requirements apply to particularly sensitive data, for example from public authorities or professional confidants such as doctors, journalists or lawyers.

The term service provider is broadly defined and includes access providers, domain services, cloud and hosting services as well as platforms such as Amazon, eBay, Google, Meta or Zalando. Gaming providers are also included if their services include a communication function. "It was particularly important to me to incorporate the European requirements into German law in a way that protects fundamental rights as much as possible," emphasized Buschmann. "We have therefore placed particular emphasis on the standardization of robust legal remedies." On the other hand, the liberal pointed out: "The world is becoming a uniform digital space – this also applies in connection with criminal offenses." Messenger services in particular are playing an increasingly important role in the initiation and coordination of crime. The draft, which still has to pass the cabinet, was sent to the federal states and associations on Monday. Interested parties have until December 6 to comment on it.

(mma)