Ian Whitehurst considers the European Commission’s latest proposals to tackle e-crime
May 25, 2018
Corporate Crime analysis: The European Commission recently set out new proposals designed to ‘curtail the space in which terrorists and criminals operate’. Exchange Chambers’ Ian Whitehurst, a specialist criminal and regulatory barrister, considers the proposed measures.
This article was first published on Lexis®PSL Corporate Crime on 3 May 2018. Click for a free trial of Lexis®PSL.
Original news
European Commission proposes strict rules to reduce crime, LNB News 18/04/2018 73
The European Commission has proposed stringent measures to clamp down on criminal activities in the EU, targeting the planning, financing and performance of crime. The suggested rules cover identity card security and fraud, access to explosives, security of electronic evidence, and firearm trafficking. The proposals aim to increase the effectiveness of the Security Union.
What is the background to these developments?
In 2015, the EU Security Commission undertook a review of obstacles to criminal investigations which took place on a cross border basis. This review was expedited after the terrorist attacks that subsequently took place in Brussels as the EU Ministers for Justice prioritised the need to implement measures to ensure digital evidence was obtained more efficiently.
The procedures then in place were deemed to be too slow to obtain e-evidence when compared to the speed that electronic data can be changed or deleted.
The new regulations are intended to ensure a more expedient and focused approach to the gathering of e-evidence which is demonstrated by the fact that Member States will be required to respond to requests within ten days, and within six hours in emergencies, as opposed to the existing maximum period of 120 days.
The legislative steer is quite clear that there should be easier access to data for prosecuting authorities targeting the most serious criminal activity—terrorism, sexual offences, large scale drug trafficking and multinational fraud offences.
Why is it necessary to take these measures on a pan-European level?
The differing approaches across Member States regarding the obligations on service providers is creating legal and procedural uncertainty and the policy behind the new measures is to create a unified and expedited approach across the EU.
The new system allows EU judicial authorities to go directly to the legal representative of the service provider who holds or controls the relevant data in order to obtain the material that is required by the investigators. It thus replaces the situation under the old system where judicial authorities in both countries were involved.
The need for a streamlined system as far as e-crime is concerned is self-evident when one considers that e-evidence is now relevant in around 85% of criminal investigations and in 65% of those investigations a request to service providers based in a separate jurisdiction to the
investigators is required.
The proposed new rules would provide the means to obtain electronic evidence faster regardless of where the data is stored.
How do these measures fit in with the overall detection and enforcement policies of the EU and the UK government?
From an EU perspective, the new system of the European Production Order (EPO) will work alongside the current system for obtaining non-content information which is based upon the European Investigation Order and the Mutual Legal Assistance Provisions.
The principles inherent in current EU policies, such as proportionality, fairness and transparency, will be applied to the new system and thus the EPO will be limited to use in connection with serious organised crime and individuals will be notified that their data was requested and they will be informed of their legal and procedural rights.
If there is non-compliance with the order, the state of the service provider will ensure enforcement. If a service provider has its headquarters located in a third country, they are required to appoint a legal representative in the EU to ensure receipt of compliance and enforcement of decisions and orders by Member States for the purpose of gathering evidence in criminal proceedings.
From the UK perspective, although the government opted into the European Investigation Order in its original form, implementation of the order was delayed and then missed due to the 2017 general election.
However, the UK already has individual schemes in place with some providers and major tech companies have established dedicated enforcement teams to deal with requests already.
The impact of these measures is going to have to be considered alongside developing issues surrounding the Data Retention and Investigatory Powers Act (DRIPA) and the Investigatory Powers Act 2016. Of course, there is also the small issue of Brexit to be resolved first as well.
How is Brexit likely to affect the implementation of these initiatives in the UK?
Going forward, it’s dependent upon the terms of the exit agreement reached between the UK and the EU.
The UK may develop a regime akin to the United States model of mutual assistance and direct cooperation with each member state of the EU.
However, as with the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) and its implementation post-Brexit, the UK may well see that it’s in its own best interests to adopt and implement the EU measures in whole or in part into primary UK legislation in order to facilitate the detection, investigation and prosecution of serious organised criminal activity.
Are there any other developments within this sphere that practitioners ought to be aware of?
The introduction of these new rules will inevitably raise issues surrounding privacy, data protection, the use and storage of data, the proportionality of the approach taken to requesting data by investigative authorities and the impact on a procedural level for any defendant’s right to a fair trial.
In the coming months, the principles espoused by the EU in the GDPR may well come into conflict with the new regime launched to facilitate the quicker retention of data generated in alleged criminal activity. Interesting times await practitioners in this ever challenging and expanding area of practice.
Interviewed by Alex Heshmaty.
The views expressed by LexisNexis’ Legal Analysis interviewees are not necessarily those of the proprietor.
