Another major piece of European digital regulation will come into force this week on August 18th. The European Union’s e-Evidence Regulation will significantly change how police and judicial authorities access electronic evidence across the EU.
For the first time, authorities in one member state will be able to request data directly from service providers in another, under a harmonised framework with strict response deadlines.
While providers are already experiencing growing demand for electronic evidence, many may not yet appreciate the operational impact of this new regime.
The challenge is significant. According to the European Commission, about 85 per cent of criminal investigations now involve electronic evidence, and in about 65 per cent of cases that evidence is held in another EU member state. Yet while crime has become increasingly digital and borderless, the mechanisms used to obtain electronic evidence have remained largely rooted in the pre-digital era.
READ MORE
The new regulation seeks to change that situation. Rather than relying on lengthy mutual legal assistance procedures, judicial authorities will be able to issue European production orders and European preservation orders directly to service providers in another EU country.
In emergencies involving an imminent threat to life, physical safety or critical infrastructure, providers may have as little as eight hours to respond.
For Ireland, the implications are even bigger as we are home to many of the world’s largest technology companies and a substantial share of Europe’s cloud infrastructure.
Ireland stores and processes vast quantities of data that may be relevant to criminal investigations across the EU, placing it at the centre of the new e-evidence framework.
Speaking at a recent e-evidence symposium in Dublin, Minister for Justice Jim O’Callaghan noted that more than 600 service providers could designate their addressee in Ireland under the new framework, with production orders potentially numbering in the hundreds of thousands each year. Those figures underline why Ireland is becoming one of the regime’s principal operational hubs.
While many multinational providers are well advanced in their preparations, a considerable number of smaller and medium-sized organisations may not yet appreciate the scale of the governance, operational and resourcing challenges the regulation will bring.
This is not simply another compliance exercise. It is about striking the right balance between effective law enforcement and the protection of privacy, due process and fundamental rights in the digital age
Having worked in lawful disclosure and communications data compliance over more than two decades, and having given evidence in some of the biggest criminal trials in the history of the State, I have seen first-hand how critical timely access to electronic evidence is to criminal investigations. The principle of lawful disclosure has existed for decades.
What is changing is the speed, scale and operational complexity with which service providers will be expected to support lawful access to electronic evidence.
Importantly, the e-evidence regulation does not create an unrestricted access regime. While it enables direct cross-border requests, it remains subject to judicial oversight, necessity and proportionality tests, fundamental rights protections and legal review mechanisms designed to safeguard privacy and due process.
The new access regime is often discussed through the lens of compliance, but at its heart lies a much more human issue. Timely access to electronic evidence increasingly determines whether serious crimes are investigated and prosecuted successfully.
Delays in obtaining information can mean missed opportunities to identify offenders, prevent harm, protect vulnerable people and secure convictions. As the Minister has noted, timely access to evidence can mean the difference between justice served and justice denied.
For service providers in Ireland, the challenge is substantial. The regulation applies to telecommunications operators, cloud providers, messaging platforms, online marketplaces, gaming companies and many other organisations that store or process user data.
With response deadlines of 10 days for standard orders and as little as eight hours in emergencies, providers must be capable of receiving and processing requests, preserving and retrieving data, managing legal conflicts and demonstrating compliance at an unprecedented pace and scale.
The consequences of getting this wrong extend beyond missed deadlines. Member states’ enforcing authorities can impose penalties of up to 2 per cent of worldwide annual turnover for noncompliance. Yet the greater risk may be the loss of trust that follows either a failure to respond appropriately to a lawful request or a failure to protect privacy and fundamental rights.
This is not simply another compliance exercise. It is about striking the right balance between effective law enforcement and the protection of privacy, due process and fundamental rights in the digital age.
Recent work by the European Commission’s high-level group on access to data for effective law enforcement suggests this debate is only beginning. The e-evidence regulation is likely to be just one step in a broader evolution of EU policy on issues such as encryption, data retention and cross-border access to digital evidence.
Ireland’s success as a digital gateway has always depended on trust, and the e-evidence regulation raises the bar once again. Ireland assumed the EU council presidency in July, just weeks before the regulation becomes fully operational.
As part of its security priorities, the presidency will seek to strengthen co-operation between member states in tackling serious and organised crime.
Few countries are better placed to help shape how Europe balances public safety, fundamental rights and the effective administration of justice in the digital age.
As Europe implements one of the most significant reforms to digital evidence and criminal justice in a generation, Ireland has an opportunity not only to comply with the new framework but also to help shape its delivery.
Ireland is no longer just a hub for Europe’s data, it is becoming a key part of Europe’s justice infrastructure.
Maureen King is founder and chief executive of iTrust6A, an Irish legal tech company
