E-Evidence Regulation Comes into Force: New Obligations for Service Providers in the EU

Electronic evidence such as emails, chat messages, cloud data and subscriber information is playing an increasingly important role in criminal investigations. To facilitate cross-border access to such data, the European Union has introduced a new framework through the E-Evidence Regulation. Its objective is to streamline what have often been lengthy mutual legal assistance procedures between Member States and to provide law enforcement authorities with faster access to relevant information.

One of the key innovations is that, under certain conditions, authorities may address orders directly to companies located in another EU Member State. The Regulation therefore shifts part of the cross-border cooperation process from public authorities to private service providers. The scope of the Regulation is broad. It covers, in particular, providers of communication, hosting and cloud services, as well as other businesses that enable users to store data or communicate electronically. As a result, the Regulation affects not only large technology companies but also many small and medium-sized enterprises.

The Regulation introduces two principal instruments:

• First, authorities may issue preservation orders requiring companies to preserve specified data temporarily in order to prevent its loss, deletion or alteration.
• Second, production orders may require service providers to disclose certain data to the issuing authority. Given their more intrusive nature, production orders are subject to stricter requirements. Where traffic data or content data is concerned, such orders may generally only be issued in relation to more serious offences punishable in the issuing state by a maximum term of imprisonment of at least three years, or for certain offences expressly listed in the Regulation. Different requirements and safeguards apply depending on the category of data requested.

One of the most challenging aspects for businesses is the short response period. As a general rule, requested data must be provided within ten days. In emergency situations, this period may be reduced to as little as eight hours. Companies should therefore ensure that internal procedures allow for the rapid identification, assessment and processing of such requests. While the Regulation provides for various consultation and review mechanisms allowing service providers to raise certain objections, it does not establish a comprehensive legal remedy against preservation or production orders. This has attracted criticism, particularly because companies may be required to carry out complex legal assessments within very short timeframes.

Failure to comply with the new obligations may result in significant penalties. Under the German implementing legislation, fines for larger companies (total turnover of more than EUR 5 million) may reach up to 2% of the company's worldwide annual turnover. Smaller companies may face fines of up to EUR 500,000. Against this background, affected businesses should review and, where necessary, adapt their internal responsibilities, compliance structures, data management procedures and documentation processes to ensure compliance with the Regulation's strict deadlines.

The E-Evidence Regulation represents a fundamental shift in the cross-border acquisition of electronic evidence within the European Union. By allowing authorities to address orders cross-border to companies, investigations can be conducted more efficiently. At the same time, however, the Regulation significantly increases the operational and legal responsibilities of affected service providers.

Directive (EU) 2023/1544, which complements the Regulation, also requires businesses to appoint representatives or designated recipients to whom orders under the Regulation are to be addressed. This obligation applies both to businesses with several branches within the EU and to businesses that offer their services in the EU without having a branch there.