In April 2018, the Commission presented a proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters and a proposal for a Directive laying down harmonised rules on the appointment of legal representatives for the purposes of gathering evidence in criminal proceedings. The two proposals COM(2018) 225 final and COM(2018) 226 final are complementary. The overall goal pursued by the Commission is to improve cooperation between Member State authorities and services providers, including those based in non-EU countries, and to propose solutions to the problem of determining and enforcing jurisdiction in cyberspace.
While the draft Regulation foresees the rules and procedures applicable to issue, serve and enforce preservation and production orders on providers of electronic communication services, the draft Directive provides for minimum rules for the appointment of a legal representative for service providers not established in the EU.
In November 2017, before the Commission tabled any draft proposal, the Article 29 Working Party (WP29) recalled the necessity to ensure that any legislative proposal fully complies with the existing EU data protection acquis in particular, as well as EU law and case-law in general.
In particular, the WP29 warned against limitations to the rights to data protection and privacy with respect to data processed by telecommunications and information society providers, especially when further processed by law enforcement authorities, recalled the necessity to ensure consistency of any EU instrument with the existing Council of Europe Budapest Convention on cybercrime and with the EU Directive on the European Investigation Order (EIO), and recommended to clarify the respective procedural rules governing access to e-Evidence at national and EU level to ensure that the new instrument would not grant authorities new powers they would not have internally. In addition to these general remarks, the WP29 commented on the legislative options considered by the Commission at that time concerning the categories of data concerned and the corresponding safeguards to access them, on the possibility to address production orders/requests to compel service providers to provide data located outside the EU, and on the substantive and procedural conditions necessary safeguards to surround direct access to data.
With the concrete proposals on e-Evidence at hand, the European Data Protection Board gave a more detailed analysis of the proposed legal instruments from a data protection point of view adopting Opinion 23/2018 on Commission proposals on European Production and Preservation Orders for electronic evidence in criminal matters (Art. 70.1.b).
