Since August 18, the EU's E-Evidence Regulation (EEVO) has been in effect. It's meant to speed up cross-border criminal investigations by letting authorities contact service providers in other EU states directly to demand data on suspects or order its preservation. The often lengthy process of state-to-state legal assistance should become unnecessary in many cases as a result. Far more than just the big telecom and internet companies are affected.
Who's covered
Hosting and cloud services, email providers, domain registrars, social networks, and forum operators can now also be approached by law enforcement. They have to register with an EU portal to do so. Even providers based outside the EU have to comply if they offer their services in Europe, and must designate an authorized representative within the EU.
Tight deadlines under heavy pressure
For ordinary data requests, providers have ten days to respond. If there's a danger to life and limb or to critical infrastructure, they must react within eight hours, including at night or on weekends, and preserve data immediately upon request. That effectively requires trained staff, clearly defined responsibilities, and technical access to the relevant systems, as lawyer Thomas Rickert explains on the c't privacy podcast Auslegungssache. Rickert works mainly on data protection and IT topics and is managing director of the legal-tech platform EviGate, which helps companies handle such requests.
Anyone who fails to register or mishandles a request risks steep fines of up to 500,000 euros. For companies with annual revenue above 25 million euros, the penalty can even rise to two percent of global annual turnover. That pressure could tempt providers to hand over data hastily instead of carefully reviewing a request.
A structural risk of abuse
The problem becomes especially clear with urgent requests: providers may have to deliver data within as little as eight hours, while the responsible authority in their own country has up to 96 hours to raise objections. By then, the information has often already been transmitted. That can put journalists, doctors, lawyers, and their contacts at particular risk. Providers may flag possible violations of confidential communication, but they can't simply refuse to hand over the data.
The benefit of faster investigations into terrorism, human trafficking, child abuse, or cybercrime is undisputed. At the same time, the new system shifts a significant share of the legal review onto private providers, who receive neither complete investigation files nor consistently sufficient legal expertise. E-Evidence can therefore speed up law enforcement, but it also creates considerable potential for abuse and puts pressure on the protection of confidential data.