17.04.2018

eco: “Direct Cross-Border Data Access Leads to Legal Uncertainty and Liability Issues”

The European Commission today presented a concrete proposal on how law enforcement authorities could in future gain cross-border access to electronic evidence (“e-evidence”). According to the proposal, requests should as a rule be answered within 10 days, and in an emergency situation within six hours. This applies to all companies that offer their services within the EU, regardless of where the data or the company are located. Until now, the mechanisms for judicial cooperation, such as the EU-US mutual legal assistance agreement or the bilateral, mutual recognition in criminal matters, were used for the handing over of e-evidence. This international legal process, which can take up to 10 months, is too protracted for communication data, of which some is only stored for a few weeks.

“The process presented today by the EU Commission is intended to circumvent the current procedure for legal assistance. However, it would be more sensible to optimize this process – often criticized as being too slow, but nonetheless internationally applicable – rather than backing direct cross-border data access, which will ultimately lead to legal uncertainty and liability issues,” according to Oliver Süme, Chairman of the Board at eco – Association of the Internet Industry.

With the proposed procedure, every service provider from all other 27 Member States could in future be contacted and obligated to hand over or store data. “Every company would, in future, need to decide for themselves whether the requesting agency is even authorized to make this request, and whether this information can be provided according to local law. This leads to a disproportionate level of responsibility for companies, especially if this legal process is only available in the country of the requesting agency. The plans to secure data and communication so that it can be on call for access at a later date also pose enormous questions regarding fundamental rights,” Süme continues.

Alongside communications services, social media, cloud services, and domain registries and registrars will be affected by the new regulation.

eco criticizes the proposed measures: “Even though, in the first instance, only serious offences are to be included as grounds, a poorly-conceived regulation can quickly lead to wider application.”

(On Friday, the EU Justice Ministers want to address mutual access to e-evidence in the Justice and Home Affairs Council. Following this, the topic will be negotiated at the EU-USA Ministerial Meeting on 22 and 23 May in Sofia.)

Oliver Süme