From Mutual Trust to the Gordian Knot of Notifications: The EU E-Evidence Regulation and Directive

Abstract

This entirely updated Chapter for The Cambridge Handbook of Digital Evidence in Criminal Matters provides the ultimate guide to the E-Evidence Regulation adopted by the European Union in June 2023.
This was considered to be one of the most pressing legislative projects, seen as essential to enable law enforcement authorities all over the EU to effectively investigate crimes. However, it took seven years since requesting that this project be considered and more than five years since the European Commission put forward the legislative package concerning electronic evidence (E-Evidence) in criminal matters, for the legislative process to be finally concluded in June 2023. Strongly divergent views on almost everything except the commonly held view that there is a need to adopt this legislative passage, have divided the two EU co-legislators, the Council of the European Union and the European Parliament.
So what exactly happened to E-Evidence? What can explain the divergences and delays that have occurred, in spite of the fact that all parties have acknowledged the importance of the project? Well, E-Evidence has been very much…‘lost in notification’. This project was initiated in order to provide an innovative legal framework that enables the unprecedented challenges that police and judicial authorities face in accessing electronic evidence to be addressed. Electronic evidence is essential in more than 85% of all criminal investigations, but is often found in other jurisdictions in which the service provider (for instance a cloud provider like AWS, Microsoft or Google, or a social media company like Meta) is established. Traditional mutual legal assistance instruments, or new ones based on the principle of mutual recognition (such as the European Investigation Order, EIO), which depend on inter-state requests, are deemed to be cumbersome and time-consuming.
The E-Evidence package was therefore based on an entirely different philosophy and mechanism, permitting law enforcement authorities (LEAs) to request data that are pertinent to criminal investigations directly from service providers. E-Evidence therefore aims to create an ‘unprecedented EU-wide legal framework for direct cooperation between judicial authorities and service providers in the field of criminal procedure’, without, in principle, involving a State other than the one issuing the order.
Such a system was founded, as we will see, on a kind of ‘absolute mutual trust’ between EU Member States, based on the idea that the actions of the authorities of the issuing Member State should be deemed sufficient and trustworthy by the other Member States, and that it will no longer be possible to review such requests – as is the case in mutual legal assistance mechanisms. However, this system of ‘absolute mutual trust’ was strongly challenged during the negotiations. Both the Council and the Parliament wished to introduce a notification system, whereby the issuing State would notify the other Member State(s) involved, giving it/them the option of reviewing the requests of the issuing authority, in order to ensure that human rights are protected and that no abuse occurs. While the Council and the EP agreed about the need for a notification system, they strongly diverged on the extent, content and outcome of such a system: Which State(s) should be notified? What would the content of the review be? What outcomes are desired? Should we provide the reviewing State with grounds for refusal and if so, which grounds? And how do we ensure that the notification mechanism will be able to exercise its protective function without hindering the effectiveness of the new ‘direct cooperation’ mechanism and bring us back to the philosophy (and problems) of the mutual legal assistance mechanisms?
This is one of the reasons why there has been such a delay on E-Evidence. Yet, the ‘notification knot’ has not been the only obstacle to the negotiation process. The Commission, the Council and the Parliament disagreed on several other issues, beginning with the very title of the legislative package (‘electronic evidence’ or ‘electronic information’?) and the legal instruments that it should contain, to important substantive issues such as how human rights will be protected, the role of service providers, how conflicts of law problems should be addressed, and which categories of data should be covered by the legislative package and their corresponding legal regime.
The objective of this chapter is to provide an overview of all these issues. Part 1 of the chapter briefly outlines the pre-history of E-Evidence, the different stages of the negotiating process and the overall context against which these developments took place. Part 2 lays out the positions of the various actors on some of the most contentious issues discussed during the negotiations. Part 3 focuses on the issue of notification and presents the various proposals submitted by the EU institutions on this fundamental issue, as well as the final solution given by the Regulation, while assessing their potential protective function and their capacity to keep the E-Evidence package effective and attractive to LEAs.

Keywords: Criminal Law; European Law; International Law; E-Evidence; Cloud Act; Cybercrime; Cybersecurity; Data Protection, Privacy, Human Rights, Law Enforcement, Territoriality; Extraterritoriality

JEL Classification: K00, K10, K14, K33, K40, K42