Growing pressure on technology companies to disclose customer data quickly

Digital evidence is required in many cases – around 85% of EU criminal investigations, according to the EU Commission, and, in two-thirds of those cases, the evidence is held by an overseas service provider, causing the rate of EU investigators requesting data from those providers to raise by 84% from 2013 – 2018.

Large technology companies are already being targeted by investigators to access their data in order to assist with criminal investigations involving third parties. There has recently been a huge growth in mutual legal assistance requests to access online records (such as subscriber details, email content, metadata and social media) from these companies, but the process is very slow. The new proposals are aimed at making it much quicker for investigators to access data held abroad.

The U.S. implemented the CLOUD Act (Clarifying Lawful Overseas Use of Data) in March 2018. The CLOUD Act allows the U.S. government to enter into bilateral executive agreements with other countries to expedite cross-border requests by one government for data stored in the other country. There are already plans afoot for such an agreement between the U.S. and the EU – the EU Commission announced on 5 February 2019 its intention to negotiate an EU-wide agreement with the U.S. that would require service providers on both sides of the Atlantic to supply requested electronic data in criminal cases within 10 days.

In the UK the Crime (Overseas Production Orders) Act 2019, enacted on 12 February 2019 will allow UK law enforcement agencies to apply to an English court for an overseas production order to obtain electronic data directly from service providers based outside the UK, for the purposes of criminal investigations and prosecutions for serious crime, without the involvement of the authorities in the country where the evidence is stored. There must first be a “designated international co-operation arrangement” in place between the UK and the jurisdiction from where the data is sought. For this reason, the UK government is working hard to agree a U.S./UK Data Access Agreement as soon as possible.

Note that although the existing UK Investigatory Powers Act 2016 allows for the acquisition of data held overseas for investigation purposes, it does not apply to the use of such data on an evidential basis. On inter-EU Member State collaboration, a regulation on European Production and Preservation Orders for electronic evidence in criminal matters is being passed at EU level which will allow Member State authorities to obtain data directly from companies in other Member States. The UK has decided not to opt into this.¹

1 Hansard HC Deb, 22 October 2018, cWS