BETA

Activities of Cornelia ERNST related to 2018/0108(COD)

Plenary speeches (1)

2023/06/12
Dossiers: 2018/0108(COD)

Shadow reports (1)

2020/12/11
Committee: LIBE
Dossiers: 2018/0108(COD)
Documents: PDF(336 KB) DOC(119 KB)
Authors: [{'name': 'Birgit SIPPEL', 'mepid': 96932}]

Amendments (149)

Proposal for a regulation
Recital 8

(8) Due to this lack of connection, judicial cooperation requests are often addressed to states which are hosts to a large number of service providers, but which have no other relation to the case at hand. Furthermore, the number of requests has multiplied in view of increasingly used networked services that are borderless by nature. As a result, obtaining electronic evidence using judicial cooperation channels often takes a long time ~~— longer than subsequent leads may be available~~. Furthermore, there is no clear framework for cooperation with service providers, while certain third-country providers accept direct requests for non-content data as permitted by their applicable domestic law. As a consequence, all Member States rely on the cooperation channel with service providers where available, using different national tools, conditions and procedures. In addition, for content data, some Member States have taken unilateral action, while others continue to rely on judicial cooperation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 9

(9) The fragmented legal framework creates challenges for service providers seeking to comply with law enforcement requests. Therefore there is a need to put forward a clearer European legal framework for electronic evidence to impose an obligation on service providers covered by the scope of the instrument to respond directly to authorities without the involvement of a judicial authority in the Member State of the service providerpreserving and gathering electronic evidence.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 10

(10) Orders under this Regulation should be addressed to the main establishment of the service providers or to legal representatives of service providers designated for that purpose If a service provider established in the Union has not designated a legal representative, the Orders can be addressed to any establishment of this service provider in the Union. This fall-back option serves to ensure the effectiveness of the system in case the service provider has not (yet) nominated a dedicated representative.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 12

(12) This Regulation respects fundamental rights as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms and as they result from the constitutional traditions common to the Member States, and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union. These include the right to liberty and security, the respect for private and family life, the protection of personal data, the freedom to conduct a business, the right to property, the right to an effective remedy and to a fair trial, the presumption of innocence and right of defence, the principles of the legality and proportionality, as well as the right not to be tried or punished twice in criminal proceedings for the same criminal offence. In case the issuing Member State has indications that parallel criminal proceedings may be ongoing in another Member State, it shall consult the authorities of this Member State in accordance with Council Framework Decision 2009/948/JHA29 . _________________ 29Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings (OJ L 328, 15.12.2009, p. 42).

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 15

(15) This instrument lays down the rules under which a competent judicial authority in the European Union may order a service provider offering services in the Union to produce or preserve electronic evidence through a European Production or Preservation Order. This Regulation is applicable in all cases where the service provider is established or represented in another Member State. For domestic situations where the instruments set out by this Regulation cannot be used, the Regulation should not limit the powers of the national competent authorities already set out by national law to compel service providers established or represented on their territory.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 17

(17) In many cases, data is no longer stored or processed on a user's device but made available on cloud-based infrastructure for access from anywhere. To run those services, service providers do not need to be established or to have servers in a specific jurisdiction. ~~Thus, the application of this Regulation should not depend on the actual location of the provider`s establishment or of the data processing or storage facility.~~

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 18

(18) Providers of internet infrastructure services related to the assignment of names and numbers, such as domain name registrars and registries ~~and privacy and proxy service providers~~, or regional internet registries for internet protocol (‘IP’) addresses, are of particular relevance when it comes to the identification of actors behind malicious or compromised web sites. They hold data that is of particular relevance for criminal proceedings as it can allow for the identification of an individual or entity behind a web site used in criminal activity, or the victim of criminal activity in the case of a compromised web site that has been hijacked by criminals.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 19

(19) This Regulation regulates gathering of stored data only, that is, the data held by a service provider at the time of receipt of a European Production or Preservation Order Certificate. It does not stipulate a general data retention obligation, nor does it authorise interception of data or obtaining to data stored at a future point in time from the receipt of a production or preservation order certificate. ~~Data should be provided regardless of whether it is encrypted or not.~~

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 20

(20) The categories of data this Regulation covers include subscriber data, access data, transactional data (these three categories being referred to as ‘non- content data’) and content data. This distinction, apart from the access data, exists in the legal laws of many Member States and also in the current US legal framework that allows service providers to share non-content data with foreign law enforcement authorities on a voluntary basistraffic data and content data.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 21

(21) It is appropriate to single out access data as a specific data category used in this Regulation. Access data is pursued for the same objective as subscriber data, in other words to identify the underlying user, and the level of interference with fundamental rights is similar to that of subscriber data. Access data is typically recorded as part of a record of events (in other words a server log) to indicate the commencement and termination of a user access session to a service. It is often an individual IP address (static or dynamic) or other identifier that singles out the network interface used during the access session. If the user is unknown, it often needs to be obtained before subscriber data related to that identifier can be ordered from the service provider.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 22

(22) Tra~~nsactional data, on the other hand,~~ffic data is generally pursued to obtain information about the contacts and whereabouts of the user and may be served to establish a profile of an individual concerned. That said, access data cannot by itself serve to establish a similar purpose, for example it does not reveal any information on interlocutors related to the user. Hence this proposal introduces a new category of data, which is to be treated like subscriber data if the aim of obtaining this data is similar.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 23

(23) All data categories contain personal data, and are thus covered by the safeguards under the Union data protection acquis, but the intensity of the impact on fundamental rights varies, in particular between subscriber data ~~and access data~~ on the one hand and tra~~nsactional~~ffic data and content data on the other hand. While subscriber data ~~and access data~~ are useful to obtain first leads in an investigation about the identity of a suspect, tra~~nsactional~~ffic and content data are the most relevant as probative material. It is therefore essential that all these data categories are covered by the instrument. Because of the different degree of interference with fundamental rights, different conditions are imposed for obtaining subscriber ~~and access~~ data on the one hand, and tra~~nsactional~~ffic and content data on the other.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 26

(26) This Regulation should apply to service providers offering services in the Union, and the Orders provided for by this Regulation may be issued only for data pertaining to services offered in the Union. Services offered exclusively outside the Union are not in the scope of this Regulation~~, even if the service provider is established in the Union~~.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 27

(27) The determination whether a service provider offers services in the Union requires an assessment whether the service provider intentionally enables legal or natural persons in one or more Member States to use its services. However, the mere accessibility of an online interface as for instance the accessibility of the service provider’s or an intermediary’s website or of an email address and of other contact details in one or more Member States taken in isolation, or the use of a language generally used in the third country where the controller is established, should not be a sufficient condition for the application of this Regulation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 28

(28) A substantial connection to the Union should also be relevant to determine the ambit of application of the present Regulation. Such a substantial connection to the Union should be considered to exist where the service provider has an establishment in the Union. In the absence of such an establishment, the criterion of a substantial connection should be assessed on the basis of the existence of a significant number of users in one or more Member States, or the targeting of activities towards one or more Member States. The targeting of activities towards one or more Member States can be determined on the basis of all relevant circumstances, including factors such as the use of a language or a currency generally used in that Member State, or the possibility of ordering goods or services. The targeting of activities towards a Member State could also be derived ~~from the availability of an application (‘app’) in the relevant national app store,~~ from providing local advertising or advertising in the language used in that Member State, or from the handling of customer relations such as by providing customer service in the language generally used in that Member State. A substantial connection is also to be assumed where a service provider directs its activities towards one or more Member States as set out in Article 17(1)(c) of Regulation 1215/2012 on jurisdiction and the recognition and enforcement of judgements in civil and commercial matters.36 On the other hand, provision of the service in view of mere compliance with the prohibition to discriminate laid down in Regulation (EU) 2018/30237 cannot be, on that ground alone, be considered as directing or targeting activities towards a given territory within the Union. _________________ 36 Regulation (EU) 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (OJ L 351, 20.12.2012, p. 1). 37 Regulation (EU) 2018/302 of the European Parliament and of the Council of 28 February 2018 on addressing unjustified geo-blocking and other forms of discrimination based on customers' nationality, place of residence or place of establishment within the internal market and amending Regulations (EC) No 2006/2004 and (EU) 2017/2394 and Directive 2009/22/EC (OJ L 601, 2.3.2018, p. 1).

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 29

(29) A European Production Order should only be issued if it is necessary and proportionate taking into account the rights of the suspected and accused persons and the seriousness of the offence. The assessment should take into account whether the Order is limited to what is necessary to achieve the legitimate aim of obtaining the relevant and necessary data to serve as evidence in the individual case only.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 30

(30) When a European Production or Preservation Order is issued, there should always be a judicial authority involved either in the process of issuing or validating the Order. In view of the more sensitive character of tra~~nsactional and content~~ffic data, the issuing or validation of European Production Orders for production of these categories requires review by a judge. As subscriber ~~and access data~~ are less sensitive, European Production Orders for their disclosure can in addition be issued or validated by competent prosecutors.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 31

(31) For the same reason, a distinction has to be made regarding the material scope of this Regulation: Orders to produce subscriber data ~~and access data~~ can be issued for any criminal offence, whereas access to tra~~nsactional~~ffic and content data should be subject to stricter requirements to reflect the more sensitive nature of such data. A threshold allows for a more proportionate approach, together with a number of other ex ante and ex post conditions and safeguards provided for in the proposal to ensure respect for proportionality and the rights of the persons affected. At the same time, a threshold should not limit the effectiveness of the instrument and its use by practitioners. Allowing the issuing of Orders for investigations that carry at least a ~~thre~~five-year maximum sentence limits the scope of the instrument to more serious crimes, without excessively affecting the possibilities of its use by practitioners. It excludes from the scope a significant number of crimes which are considered less serious by Member States, as expressed in a lower maximum penalty. It also has the advantage of being easily applicable in practice.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 32

(32) There are specific offences where evidence will typically be available exclusively in electronic form~~, which is particularly fleeting in nature~~. This is the case for c~~yber-relat~~omputer-enabled crimes, even those which might not be considered serious in and of themselves but which may cause extensive or considerable damage, in particular including cases of low individual impact but high volume and overall damage. For most cases where the offence has been committed by means of an information system, applying the same threshold as for other types of offences would predominantly lead to impunity. This justifies the application of the Regulation also for those offences where the penalty frame is less than 35 years of imprisonment. ~~Additional terrorism related offences as described in the Directive 2017/541/EU do not require the minimum maximum threshold of 3 years.~~

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 34

(34) In cases where the data sought is stored or processed as part of an infrastructure provided by a service provider to a company or another entity other than natural persons, typically in case of hosting services, the European Production Order should only be used when other investigative measures addressed to the company or the entity are not appropriate, especially if this would create a risk to jeopardise the investigation. This is of relevance in particular when it comes to larger entities, such as corporations or government entities, that avail themselves of the services of service providers to provide their corporate IT infrastructure or services or both. The first addressee of a European Production Order, in such situations, should be the company or other entity. This company or other entity may not be a service provider covered by the scope of this Regulation. However, for cases where addressing that entity is not opportune, for example because it is suspected of involvement in the case concerned or there are indications for collusion with the target of the investigation, competent authorities should be able to address the service provider providing the infrastructure in question to provide the requested data. This provision does not affect the right to order the service provider to preserve the data.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 35

(35) Immunities and privileges, which may refer to categories of persons (such as diplomats) or specifically protected relationships (such as lawyer-client privilege), are referred to in other mutual recognition instruments such as the European Investigation Order. Their range and impact differ according to the applicable national law that should be taken into account at the time of issuing the Order, as the issuing authority may only issue the Order if a similar order would be available in a comparable domestic situation. In addition to this basic principle, immunities and privileges which protect access, transactional or content data in the Member State of the service provider should be taken into account as far as possible in the issuing State in the same way as if they were provided for under the national law of the issuing State. This is relevant in particular should the law of the Member State where the service provider or its legal representative is addressed provide for a higher protection than the law of the issuing State. The provision also ensures respect for cases where the disclosure of the data may impact fundamental interests of that Member State such as national security and defence. As an additional safeguard, these aspects should be taken into account not only when the Order is issued, but also later, when assessing the relevance and admissibility of the data concerned at the relevant stage of the criminal proceedings, and if an enforcement procedure takes place, by the enforcing authority.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 36

(36) The European Preservation Order may be issued for any offence. Its aim is to prevent the removal, deletion or alteration of relevant data in situations where it may take more time to obtain the production of this data~~, for example because judicial cooperation channels will be used~~.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 37

(37) European Production and Preservation Orders should be addressed to the legal representative designated by the service provider. In the absence of a designated legal representative, Orders can be addressed to an establishment of the service provider in the Union. This can be the case where there is no legal obligation for the service provider to nominate a legal representative. In case of non-compliance by the legal representative in emergency situations, the European Production or Preservation Order may also be addressed to the service provider alongside or instead of pursuing enforcement of the original Order according to Article 14. In case of non- compliance by the legal representative in non-emergency situations, but where there are clear risks of loss of data, a European Production or Preservation Order may also be addressed to any establishment ofmain establishment of the service provider or, if established outside the EU, to the legal representative designated by the service provider ~~in the Union~~. Because of these various possible scenarios, the general term ‘addressee’ is used in the provisions. Where an obligation, such as on confidentiality, applies not only to the addressee, but also to the service provider if it is not the addressee, this is specified in the respective provision.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 38

(38) The European Production and European Preservation Orders should be transmitted to the service provider through a European Production Order Certificate (EPOC) or a European Preservation Order Certificate (EPOC-PR), which should be translated. The Certificates should contain the same mandatory information as the Orders~~, except for the grounds for the necessity and proportionality of the measure or further details about the case to avoid jeopardising the investigations~~. But as they are part of the Order itself, they allow the suspect to challenge it later during the criminal proceedings. Where necessary, a Certificate needs to be translated into (one of) the official language(s) of the Member State of the addressee, or into another official language that the service provider has declared it will accept.

2019/12/11
Committee: LIBE

(41) In order to allow service providers to address formal problems, it is necessary to set out a procedure for the communication between the service provider and the issuing judicial authority in cases where the EPOC might be incomplete or contains manifest errors or not enough information to execute the Order. Moreover, should the service provider not provide the information in an exhaustive or timely manner for any other reason, for example because it thinks there is a conflict with an obligation under the law of a third country, or because it thinks the European Production Order has not been issued in accordance with the conditions set out by this Regulation, it should go back to the issuing authorities and provide the opportune justifications. The communication procedure thus should broadly allow for the correction or reconsideration of the EPOC by the issuing authority at an early stage. To guarantee the availabilty of the data, the service provider should preserve the data if they can identify the data sought.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 42

(42) Upon receipt of a European Preservation Order Certificate (‘EPOC- PR’), the service provider should preserve requested data for a maximum of 630 days unless the issuing authority informs the service provider that it has launched the procedure for issuing a subsequent request for production, in which case the preservation should be continued. The 630 day period is calculated to allow for the launch of an official request. This requires that at least some formal steps have been taken, for example by sending a mutual legal assistance request to translation. Following receipt of that information, the data should be preserved as long as necessary until the data is produced in the framework of a subsequent request for production.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 43

(43) Service providers and their legal representatives should ensure confidentiality and when requested by the issuing authority refrain from informing the person whose data is being sought in order to safeguard the investigation of criminal offences, in compliance with Article 23 of Regulation (EU) 2016/67938 . However, uUser information is an essential element in enabling review and judicial redress and should be provided by the authority ifor the service provider ~~was asked not to inform the user, where~~unless there is noa risk of jeopardising ongoing investigations, in accordance with ~~the national measure implementing~~ Article 13 of Directive (EU) 2016/68039 . _________________ 38Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protectionand Article 23 of Regulation) (~~OJ L 119, 4.5.2016, p. 1).~~EU) 2016/679. _________________ 39 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 44

(44) ~~In case of non-compliance by the addressee, t~~The issuing authority ~~may~~shall transfer the full Order including the reasoning on necessity and proportionality, accompanied by the Certificate, to the competent authority in the Member State where the addressee of the Certificate resides or is established. This Member State should ~~enforc~~recognize and execute it in accordance with its national law. Member States should provide for the imposition of effective, proportionate and deterrent pecuniary sanctions in case of infringements of the obligations set up by this Regulation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 45

(45) The enforcement procedure is a procedure where the addressee can oppose the enforcement based on certain restricted grounds. The enforcing authority can refuse to recognise and enforce the Order based on the same grounds, or if immunities and privileges under its national law apply or the disclosure may impact its fundamental interests such as national security and defence. The enforcing authority should consult the issuing authority before refusing to recognise or enforce the order, based on these grounds. In case of non- compliance, authorities can impose sanctions. These sanctions should be proportionate also in view of specific circumstances such as repeated or systemic non-compliance.deleted

2019/12/11
Committee: LIBE

(48) ~~To this end, whenever the addressee considers that the European Produc~~Judicial cooperation based on international agreements is the most appropriate way to request electronic evidence when conflicts of law with third countries arise. If that is not available, this Regulation provides for a procedure that involves executing authority, issuing authority, and the competent authority in the third country. To this end, whenever the executing authority considers that the European Production Order or the European Preservation Order in the specific case would entail the violation of a legal obligation stemming from the law of a third country, it should inform the issuing authority by way of a reasoned objection, using the forms provided. The issuing authority should then review the European Production Order in light of the reasoned objection, taking into account the same criteria that the competent court would have to follow. Where the authority decides to uphold the Order, the procedure should be referred to the ~~competent court, as notified by the relevant Member State~~executing authority, which then reviews the Order.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 49

(49) In determining the existence of a conflicting obligation in the specific circumstances of the case under examination, the competent court should rely on appropriate external expertise where needed, for example if the review raises questions on the interpretation of the law of the third country concerned. This cshould include consulting the competent~~ral~~ authorities of that country.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 51

(51) Where conflicting obligations exist, the court should determine whether the conflicting provisions of the third country prohibit disclosure of the data concerned on the grounds that this is necessary to either protect the fundamental rights of the individuals concerned or the fundamental interests of the third country related to national security or defence. In carrying out this assessment, the court should take into account whether the third country law, rather than being intended to protect fundamental rights or fundamental interests of the third country related to national security or defence, manifestly seeks to protect other interests or is being aimed to shield illegal activities from law enforcement requests in the context of criminal investigations. Where the court concludes that conflicting provisions of the third country prohibit disclosure of the data concerned on the grounds that this is necessary to either protect the fundamental rights of the individuals concerned or the fundamental interests of the third country related to national security or defence, it should consult the third country via its central authorities, which are already in place for mutual legal assistance purposes in most parts of the world. It should set a deadline for the third country to raise objections to the execution of the European Production Order; in case the third country authorities do not respond within the (extended) deadline despite a reminder informing them of the consequences of not providing a response, the court upholds the Order. If the third country authorities object to disclosure, the court should lift the Order.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 52

(52) In all other cases of conflicting obligations, unrelated to fundamental rights of the individual or fundamental interests of the third country related to national security or defence, the court should take its decision on whether to uphold the European Production Order by weighing a number of elements which are designed to ascertain the strength of the connection to either of the two jurisdictions involved, the respective interests in obtaining or instead preventing disclosure of the data, and the possible consequences for the service provider of having to comply with the Order. Importantly for cyber-related offences, the place where the crime was committed covers both the place(s) where the action was taken and the place(s) where the effects of the offence materialised.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 54

(54) It is essential that all persons whose data are requested in criminal investigations or proceedings have access to an effective legal remedy, in line with Article 47 of the Charter of Fundamental Rights of the European Union. For suspects and accused persons, the right to an effective remedy should be exercised during the criminal proceedings. This may affect the admissibility~~, or as the case may be, the weight in the proceedings,~~ of the evidence obtained by such means. In addition, they benefit from all procedural guarantees applicable to them, such as the right to information. Other persons, who are not suspects or accused persons, should also have a right to an effective remedy. Therefore, as a minimum, the possibility to challenge the legality of a European Production Order, including the necessity and the proportionality of the Order, should be provided. This Regulation should not limit the possible grounds to challenge the legality of the Order. These remedies should be exercised in the issuing State as well as in the executing State in accordance with national law. Rules on interim relief should be governed by national law.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 55

(55) ~~In addition, during the enforcement procedure and subsequent legal remedy, the addressee may~~This Regulation provides for a limited list of grounds for non-recognition that the executing authority can apply when deciding on the recognition of an Order. In addition, the service provider could oppose the enforcement of a European Production or Preservation Order on a number of limited grounds, including it not being issued or validated by a competent authority or i~~t being apparent that it manifestly violates the Charter of Fundamental Rights of the European Union~~f there are substantial grounds to believe that it violates Fundamental Rights or is manifestly abusive. For example, an Order requesting the production of content data pertaining to an undefined class of people in a geographical area or with no link to concrete criminal proceedings would ignore in a manifest way the conditions for issuing a European Production Order or an European Preservation Order.

2019/12/11
Committee: LIBE

Proposal for a regulation
Recital 60

(60) In order to effectively address a possible need for improvement regarding the content of the EPOCs and EPOC-PRs and of the Form to be used to provide information on the impossibility to execute the EPOC or EPOC-PR, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission to amend Annexes I, II and III to this Regulation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making40 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. _________________ 40deleted OJ L 123, 12.5.2016, p. 1.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 1 – paragraph 1

1. This Regulation lays down the rules under which an authority of a Member State may order a service provider offering services in the Union, to ~~produce or~~ preserve electronic evidence~~, regardless of the location of data. This Regulation is without prejudice to the powers of national authorities~~ and to order an authority of another Member State to compel a service providers established or represented on their territory to ~~comply with similar national measures~~produce electronic evidence, regardless of the location of data.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 1 – paragraph 1 a (new)

1 a. The issuing of a European Production or Preservation Order may also be requested by a suspected or accused person, or by a lawyer on that person’s behalf, within the framework of applicable defence rights in conformity with national criminal procedures.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 1

(1) ‘European Production Order’ means a ~~binding~~judicial decision ~~by an issuing authority of a Member State compelling~~which has been issued or validated by a judicial authority of a Member State to have electronic evidence produced by a service provider offering services in the Union and established or represented in another Member State~~, to produce electronic evidence~~;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 2

(2) ‘European Preservation Order' means a ~~binding~~judicial decision ~~by an issuing~~which has been issued or validated by a judicial authority of a Member State compelling a service provider offering services in the Union and established or represented in another Member State, to preserve electronic evidence in view of a subsequent request for production;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 3 – introductory part

(3) ‘service provider’ means any natural or legal person that provides one or more of the following categories of services and acts as a data controller within the meaning of Regulation (EU) 2016/679:

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 3 – point b

(b) information society services as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council44 for which the storage of data is a defining component of the service provided to the user~~, including social networks, online marketplaces facilitating transactions between their users, and other hosting service providers~~; _________________ 44Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1).

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 3 – point c

(c) internet domain name and IP numbering services such as IP address providers, domain name registries, and domain name registrars ~~and related privacy and proxy services~~;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 4 – introductory part

(4) ‘offering services in the Union’ means: intentionally enabling legal or natural persons in one or more Member State(s) to use the services referred to in point (3).

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 4 – point a

~~(a) enabling legal or natural persons in one or more Member State(s) to use the services listed under (3) above; an~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 4 – point b

~~(b) having a substantial connection to the Member State(s) referred to in point (a);~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 6

(6) ‘electronic evidence’ means ~~evidence~~information stored in electronic form by or on behalf of a service provider at the time of receipt of a production or preservation order certificate, consisting in stored subscriber data, ~~access data, transactional~~traffic data and content data;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 7 – introductory part

(7) ‘subscriber data’ means any data collected in the normal course of business pertaining to:

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 7 – point b

(b) the type of service and its duration including technical data and data identifying related technical measures or interfaces used by or provided to the subscriber or customer, and data related to the validation of the use of service, excluding passwords or other authentication means used in lieu of a password that are provided by a user, or created at the request of a user;deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 7 – point b

(b) the type of service and its duration including technical data and data identifying related technical measures or interfaces used by or provided to the subscriber or customer, and data related to the validation of the use of service, excluding passwords or other authentication means used in lieu of a password that are provided by a user, or created at the request of a userprovided;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 8

(8) ‘~~access~~traffic data’ means data related to the commencement and termination of a user access session to a service, which is strictly necessary for the sole purpose of identifying the user of the service, such as the date and time of use, or the log-in to and log-off from the service, together with the IP address allocated by the internet access service provider to the ucollected in the normal courser of a service, data identifying the interface used and the user ID. This includes electronic communications metadata as defined in point (g) of Article 4(3) of [Regulation concerning the respect for private life and the protection of personal data in electronic communications];business related to:

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 8 a (new)

(8 a) the commencement and termination of a user access session to a service, which is strictly necessary for the sole purpose of identifying the user of the service, such as the date and time of use, or the log-in to and log-off from the service, as well as the IP address used;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 8 b (new)

(8 b) electronic communications metadata as processed in an electronic communications network for the purposes of transmitting, distributing or exchanging electronic communications content;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 9

(9) ‘transactional data’ means data related to the provision of a service offered by a service provider that serves to provide context or additional information about such service and is generated or processed by an information system of the service provider, such as the source and destination of a message or another type of interaction, data on the location of the device, date, time, duration, size, route, format, the protocol used and the type of compression, unless such data constitues access data. This includes electronic communications metadata as defined in point (g) of Article 4(3) of [Regulation concerning the respect for private life and the protection of personal data in electronic communications];deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 10

(10) ‘content data’ means any data stored ~~data in a digital format such as text, voice, videos, images, and sound other than subscriber, access or transactional data~~, transmitted or distributed in a digital format by the service provider on behalf of the client or subscriber other than subscriber or traffic data; where metadata of other electronic communication services or protocols are stored, transmitted or distributed by the service provider on behalf of the client or subscriber, they are to be considered content data for the respective service;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 13

~~(13) ‘enforc~~‘executing State’ means the ~~(13)~~ Member State in which the addressee of the European Production Order or the European Preservation Order resides or is established and to which the European Production Order and the European Production Order Certificate or the European Preservation Order and the European Preservation Order Certificate are transmitted for ~~enforcement~~recognition and execution;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 2 – paragraph 1 – point 14

(14) ‘e~~nforc~~xecuting authority’ means the competent authority in the e~~nforc~~xecuting State to which the European Production Order and the European Production Order Certificate or the European Preservation Order and the European Preservation Order Certificate are transmitted by the issuing authority for recognition and enforcement;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 3 – paragraph 2

2. The European Production Orders and European Pr~~oduc~~eservation Orders may only be issued ~~for criminal proceedings, both during the pre-trial and trial phase~~in the framework and for the purposes of criminal proceedings. The Orders may also be issued in proceedings relating to a criminal offence for which a legal person may be held liable or punished in the issuing State.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 4 – paragraph 1 – introductory part

1. A European Production Order for subscriber data ~~and access data~~ may be issued by:

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 4 – paragraph 1 – subparagraph 1 (new)

Where provided for by national law, the execution of the order may require the procedural involvement of a court in the executing State.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 4 – paragraph 2 – introductory part

2. A European Production Order for tra~~nsactional~~ffic and content data may be issued only by:

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 4 – paragraph 3 – subparagraph 1 (new)

Where provided by national law, the execution of the order may require the procedural involvement of a court in the executing state.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 2

2. ~~The~~An issuing authority may issue an European Production Order ~~shall be~~only when it is necessary and proportionate for the purpose of the proceedings referred to in Article 3 (2) ~~and may only be issued if a similar measure would be available for the same criminal offence in a comparable domestic situation in the issuing State~~, taking into account the rights of the suspected or accused person and the seriousness of the offence. It may only be issued if it could have been issued under the same conditions in a similar domestic situation in the issuing State, where there are sufficient reasons to believe that a crime has been committed and that the requested information is relevant for that investigation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 3

3. Without prejudice to paragraph 2, European Production Orders to produce subscriber data ~~or access data~~ may be issued for all criminal offences.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 4 – introductory part

4. Without prejudice to paragraph 2, European Production Orders to produce tra~~nsactional~~ffic data or content data may only be issued

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 4 – point a

(a) for criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least 35 years, or

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 4 – point c

(c) for criminal offences as defined in Article 3 to 12 and 14 of Directive (EU) 2017/541 of the European Parliament and of the Council49 . _________________ 49Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 5 – point d

(d) the requested data category (subscriber data, ~~access data, transactional~~traffic data or content data);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 5 – point d

(d) the requested data category (subscriber data, ~~access data, transactional~~traffic data or content data);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 5 – point g

(g) in case of emergency or request for earlier ~~disclosure, the~~transmission, the duly justified reasons for it;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 5 – point h

(h) in cases where the data sought is stored or processed as part of an infrastructure provided by a service provider to a company or another entity other than natural persons, a confirmation that the Order is made in accordance with paragraph 6;deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 5 – point i

(i) the grounds for the necessity and proportionality of the measure, taking into account the rights of the suspected or accused person and the seriousness of the offence.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 6

6. In cases where the data sought is stored or processed as part of an infrastructure provided by a service provider to a company or another entity other than natural persons, the European Production Order may only be addressed to the service provider where investigatory measures addressed to the company or the entity are not a~~ppropriate, in particular because they might jeopardise the investigation~~vailable.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 5 – paragraph 7

7. If the issuing authority has reasons to believe that, transactional or content data requested is protected by immunities and privileges granted under the law of the Member State where the service provider is addressed, or its disclosure may impact fundamental interests of that Member State such as national security and defence, the issuing authority has to seek clarification before issuing the European Production Order, including by consulting the competent authorities of the Member State concerned, either directly or via Eurojust or the European Judicial Network. If the issuing authority finds that the requested access, transactional or content data is protected by such immunities and privileges or its disclosure would impact fundamental interests of the other Member State, it shall not issue the European Production Order.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 6 – paragraph 3 – point d

(d) the data category to be preserved (subscriber data, ~~access data, transactional~~traffic data or content data);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 6 – paragraph 3 – point g

(g) the grounds for the necessity and proportionality of the measure, taking into account the rights of the suspected or accused person and the seriousness of the offence.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 6 a (new)

Article 6 a Legal representative 1. Where a service provider offering services in the Member States bound by this Regulation is not established in the Union, such service providers shall designate one legal representative in one of the Member States bound by this Regulation where the service provider offers its services, for receipt of, compliance with and enforcement of European Production Orders and European Preservation Orders issued by the competent authorities of the Member States, for the purpose of gathering electronic evidence in criminal proceedings. 2. Where a service provider offering services in the Member States bound by this Regulation is established in a Member State not bound by this Regulation, such service provider shall designate one legal representative in one of the Member States bound by this Regulation where the service provider offers its services, for receipt of, compliance with and enforcement of European Production Orders and European Preservation Orders issued by the competent authorities of the Member States for the purpose of gathering electronic evidence in criminal proceedings. 3. Upon designation of the legal representative, the service provider shall notify in writing that Member State where its legal representative is established. The notification shall contain the designation and contact details of its legal representative as well as any changes thereof. 4. The notification shall specify the official language(s) of the Union, as referred to in Regulation 1/58, in which the legal representative can be addressed. This shall include, at least, one of the languages accepted by the Member State where the legal representative is established. 5. Information notified to Member States in accordance with this Article shall be made publicly available on a dedicated internet page of the European Judicial Network. Such information shall be regularly updated. 6. Member States shall lay down rules on sanctions applicable to infringements pursuant to this Article and shall take all measures necessary to ensure that they are implemented. The sanctions provided for shall be effective, proportionate and dissuasive.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 1

1. The European ~~Production Order and the European~~ Preservation Order shall be addressed directly to the main establishment of the service provider where the data controller is or, where applicable, a legal representative designated by the service provider for the purpose of gathering evidence in criminal proceedings. A copy of the European Preservation Order shall be simultaneously addressed to the executing authority.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 1 a (new)

1 a. The European Production Order shall be addressed to the executing authority. A copy of the European Production Order for subscriber data shall be addressed to the main establishment of the service provider where the data controller is or, where applicable, a legal representative designated by the service provider for the purpose of gathering evidence in criminal proceedings.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 1 b (new)

1 b. Member States shall ensure that any service provider established on their territory notifies that Member State in writing of where its data controller is established. The notification shall contain the contact details of the main establishment of the service provider where the data controller is, as well as any changes thereof.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 1 c (new)

1 c. Information notified to Member States in accordance with paragraph 1a shall be made publicly available on a dedicated internet page of the European Judicial Network. Such information shall be regularly updated.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 2

2. If no dedicated legal representative has been appointed, the European Production Order and the European Preservation Order may be addressed to any establishment of the service provider in the Union.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 3

~~3. Where the legal representative does not comply with an EPOC in an emergency case pursuant to Article 9(2), the EPOC may be addressed to any establishment of the service provider in the Union.~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 7 – paragraph 4

4. Where the legal representative does not comply with its obligations under Articles 9 or 10 and the issuing authority considers that there is a serious risk of loss of data, the European Production Order or the European Preservation Order may be addressed to any establishment of the service provider in the Union.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 8 – paragraph 3

3. The EPOC shall contain the information listed in Article 5(5) (a) to (hi), including sufficient information to allow the addressee to identify and contact the issuing authority. ~~The grounds for the necessity and proportionality of the measure or further details about the investigations shall not be included.~~

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 8 – paragraph 4

4. The EPOC-PR shall contain the information listed in Article 6(3) (a) to (fg), including sufficient information to allow the addressee to identify and contact the issuing authority. ~~The grounds for the necessity and proportionality of the measure or further details about the investigations shall not be included.~~

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 8 – paragraph 5

5. Where needed, the EPOC orshall be translated into an official language of the executing State or any other language indicated by the executing State in accordance with paragraph 5a. Where needed, the EPOC-PR shall be translated into an official language of the Union accepted by the addressee. Where no language has been specified, the EPOC ~~or the EPOC~~- PR shall be translated into one of the official languages of the executing Member State ~~where the legal representative resides or is established~~.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 8 – paragraph 5 a (new)

5 a. Any Member State may, at any time, state in a declaration submitted to the Commission that it will accept translations of EPOCs and EPOC-PRs in one or more official languages of the Union other than the official language or languages of that Member States. The Commission shall make the declarations available to all Member States and to the EJN.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 1

1. Upon receipt of the EPOC, the ~~addressee shall ensure that the requested data is transmitted directly to the issuing authority or the law enforcement authorities as indicated in the EPOC~~executing authority shall recognise the EPOC transmitted in accordance with this Regulation, and ensure its execution in the same way and under the same modalities as if the production order concerned had been ordered by an authority of the executing State, unless that authority decides to invoke one of the grounds for non-recognition or non- execution provided by Article 10a. The executing authority shall recognise the EPOC as soon as possible and at the latest within 10 days upon receipt of the EPOC, unless the issuing authority indicates reasons for earlier ~~disclosure~~transmission.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 2

2. In emergency cases the ~~addressee shall transmit the requested data without undue delay,~~executing authority shall recognise the EPOC at the latest within 648 hours upon receipt of the EPOC.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 2 a (new)

2 a. When the executing authority has recognised the EPOC for traffic and content data, it shall immediately transmit the EPOC to the service provider and shall ensure that the request data is transmitted directly to the issuing authority or the law enforcement authorities as indicated in the EPOC. If it is not practicable in a specific case for the executing authority to meet the time limit set out in paragraph 1 or 2, it shall, without delay, inform the issuing authority by any means, giving the reasons for the delay and the estimated time necessary for the decision to be taken.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 2 b (new)

2 b. If the executing authority has not invoked any of the grounds listed in Article 10a concerning the EPOC for subscriber data within the time limits provided by paragraph 1 or 2, the service provider shall ensure that the requested subscriber data is immediately transmitted directly to the issuing authority or the law enforcement authorities as indicated in the EPOC.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 2 c (new)

2 c. In the absence of a valid EPOC or of a European Investigation Order issued in accordance with Directive 2014/41/EU, the addresses shall not transmit the requested data to the requesting authority.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 3

3. If the ~~addressee cannot comply with its obligation because the~~ EPOC is incomplete, contains manifest errors or does not contain sufficient information to execute the EPOC, the ~~addressee~~executing authority shall inform the issuing authority referred to in the EPOC without undue delay and ask for clarification, using the Form set out in Annex III. ~~It shall inform the issuing authority whether an identification and preservation was possible as set out in paragraph 6.~~ The issuing authority shall react expeditiously and within 5 days at the latest. The deadlines set out in paragraphs 1 and 2 shall not apply until the clarification is provided.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 4

4. If the ~~addressee~~service provider cannot comply with ~~its obligation~~the order because of force majeure or of de facto impossibility ~~not attributable to the addressee or, if different, the service provider~~, notably because the person whose data is sought is not their customer, or the data has been deleted before receiving the EPOC, the ~~addressee~~executing authority shall inform the issuing authority referred to in the EPOC without undue delay explaining the reasons, using the Form set out in Annex III. If the relevant conditions are fulfilled, the issuing authority shall withdraw the EPOC.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 5 – subparagraph 1

In all cases where the addressee does not provide the requested information, does not provide it exhaustively or does not provide it within the deadline, for other reasons, it shall inform the issuing authority without undue delay and at the latest within the deadlines set out in paragraphs 1 and 2 of the reasons for this using the Form in Annex III. The issuing authority shall review the order in light of the information provided by the service provider and if necessary, set a new deadline for the service provider to produce the data.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 9 – paragraph 5 – subparagraph 2

~~In case the addressee considers that the EPOC cannot be executed because based on the sole information contained in the EPOC it is apparent that it manifestly violates~~The service provider may oppose the transmission of data to the issuing authority where it considers that the EPOC cannot be executed because there are substantial grounds to believe that it violates Article 6 TEU and the Charter of Fundamental Rights of the European Union, or ~~that~~where it is manifestly abusive~~, the addressee shall also send the Form in Annex III to the competent enforcement authority in the Member State of the addressee. In such cases the competent enforcement authority may seek clarific~~. In that case, the executing authority may request additional informations from the issuing authority on the European Production Order, either directly or via Eurojust or the European Judicial Network. The issuing authority shall reply to any such request within 5 working days.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 1

1. Upon receipt of the EPOC-PR, the addressee shall, without undue delay, preserve the data requested. The preservation shall cease after 630 days, unless the issuing authority confirms that the subsequent request for production has been launched.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 2

2. If the issuing authority confirms within the time period set out in paragraph 1 that the subsequent request for production has been launched, the addressee shall preserve the data ~~as long as necessary to produce the data once the subsequent request for production is served~~for a period of 30 days, renewable once.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 5

5. If the addressee cannot comply with its obligation because of force majeure, or of de facto impossibility ~~not attributable to the addressee or, if different, the service provider~~, notably because the person whose data is sought is not their customer, or the data has been deleted before receiving the Order, it shall contact the issuing authority set out in the EPOC- PR without undue delay explaining the reasons, using the Form set out in Annex III. If these conditions are fulfilled, the issuing authority shall withdraw the EPOC- PR.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6

6. In all cases where the addressee does not preserve the requested information, for other reasons listed in the Form of Annex III, the addressee shall inform the issuing authority without undue delay of the reasons for this in the Form set out in Annex III. The issuing authority shall review the Order in light of the justification provided by the service provider.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 a (new)

6 a. The addressee may oppose the European Preservation Order on the basis of the following grounds: (a) the European Preservation Order has not been issued or validated by an issuing authority as specified in Article 4; (b) the service provider could not comply with the EPOC-PR because of de facto impossibility or force majeure, or because the EPOC-PR contains manifest errors; (c) the European Preservation Order does not concern data stored by or on behalf of the service provider at the time of the EPOC-PR; (d) the service is not covered by the scope of this Regulation; (e) there are substantial grounds to believe that the European Preservation Order violates Article 6 TEU or the Charter of Fundamental Rights; (f) the European Preservation Order is manifestly abusive.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 b (new)

6 b. At any moment, the executing authority may consider that one of the grounds provided for in Article 10a applies. In that case, it shall order the service provider to cease the preservation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 c (new)

6 c. If the addressee does not comply with an EPOC-PR without providing reasons, the issuing authority may transfer to the executing authority the European Preservation Order with the EPOC-PR as well as the Form set out in Annex III filled out by the addressee and any other relevant document with a view to its enforcement by any means capable of producing a written record under conditions allowing the enforcing authority to establish authenticity. To this end, where necessary, the issuing authority shall translate the Order, the Form and any other accompanying documents into one of the official languages of this Member State and shall inform the addressee of the transfer.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 d (new)

6 d. Upon receipt, the executing authority shall, without further formalities, recognise a European Preservation Order and shall take the necessary measures for its enforcement, unless the executing authority considers that one of the grounds provided for in Article 10a applies. The executing authority shall take the decision to recognise the Order without undue delay and no later than 5 working days after the receipt of the Order.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 e (new)

6 e. Where the executing authority recognises the Order, it shall formally require the addressee to comply with the relevant obligation, informing the addressee of the possibility to oppose the enforcement by invoking the grounds listed in paragraph 6a, as well as the applicable sanctions in the event of non- compliance, and set a deadline for compliance or opposition.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 f (new)

6 f. In the event of an objection by the addressee, the executing authority shall decide whether to enforce the Order on the basis of the information provided by the addressee and, if necessary, of supplementary information obtained from the issuing authority in accordance with paragraph 6g.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 g (new)

6 g. Before deciding not to recognise or enforce the Order in accordance with paragraphs 6d and 6f, the executing authority shall consult the issuing authority by any appropriate means. Where appropriate, it shall request further information from the issuing authority. The issuing authority shall reply to any such request within 5 working days. In the absence of a reaction from the issuing authority, the order shall be considered null and void.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 h (new)

6 h. All decisions shall be notified immediately to the issuing authority and to the addressee by any means capable of producing a written record.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 – paragraph 6 i (new)

6 i. Where the addressee does not comply with its obligations under an Order recognised by the executing authority, that authority shall impose a pecuniary sanction in accordance with its national law. An effective judicial remedy shall be available against the decision to impose a fine.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 10 a (new)

Article 10 a Grounds for non-recognition or non- execution 1. Without prejudice to Article 1(2), recognition or execution of the EPOC or EPOC-PR shall be refused by the executing authority where: (a) the execution of the European Production Order or European Preservation Order would be contrary to the principle of ne bis in idem; (b) there are substantial grounds to believe that the execution of the European Production Order or European Preservation Order would be incompatible with Member State's obligations in accordance with Article 6 TEU and the Charter; (c) there is an immunity or a privilege under the law of the executing State; 2. In addition to paragraph 1, recognition or execution of the EPOC or EPOC-PR may be refused by the executing authority, where: (a) the conditions for issuing a European Production Order or European Preservation Order, as laid down in Articles 5 and 6 of this Regulation are not fulfilled; (b) the EPOC or the EPOC-PR is incomplete or manifestly incorrect, in form or content, and has not been completed or corrected following the consultations referred to in Article 9 (3) and (4) and Article 10 (4) and (5) of this Regulation; (c) the execution of the European Production Order or European Preservation Order would harm essential national security interests, jeopardise the source of the information or involve the use of classified information relating to specific intelligence activities; (d) the European Production Order or European Preservation Order relates to a criminal offence which is alleged to have been committed outside the territory of the issuing State and the law of the executing State does not allow prosecution for the same offences when committed outside its territory; where the EPOC or the EPOC- PR relates to a criminal offence which is alleged to have been committed wholly or partially on the territory of the executing State; (e) the conduct for which the EPOC or the EPOC-PR has been issued does not constitute an offence under the law of the executing State, unless it concerns an offence listed within the categories of offences set out in Annex IIIa, as indicated by the issuing authority in the EPOC or the EPOC-PR, if it is punishable in the issuing State by a custodial sentence or a detention order for a maximum period of at least three years; (f) the execution of the European Production Order or European Preservation Order is restricted under the law of the executing State to a list or category of offences or to offences punishable by a higher threshold; or (g) compliance with the European Production Order or the European Preservation Order would conflict with applicable laws of a third country that prohibits disclosure of the data concerned in accordance with national law of the executing state. 3. Points (e) and (f) of paragraph 2 shall not apply to subscriber data and IP addresses. 4. Point (g) of paragraph 1 shall be applied in accordance with to the procedure set out in Article 15. 5. Where the European Production Order or European Preservation Order concerns an offence in connection with taxes or duties, customs and exchange, the executing authority shall not refuse recognition or execution on the ground that the law of the executing State does not impose the same kind of tax or duty or does not contain a tax, duty, customs and exchange regulation of the same kind as the law of the issuing State. 6. In the cases referred to in paragraphs 1 and 2 of this Article, before deciding not to recognise or not to execute a European Production Order or European Preservation Order, either in whole or in part , the executing authority shall consult the issuing authority, by any appropriate means, and shall, where appropriate, request the issuing authority to supply any necessary information without delay. 7. In the case referred to in point (c) of paragraph 1 and where the power to waive the privilege or immunity lies with an authority of the executing State, the executing authority shall request it to exercise that power forthwith. Where power to waive the privilege or immunity lies with an authority of another State or international organisation, it shall be for the issuing authority to request the authority concerned to exercise that power. 8. The executing authority shall inform the issuing authority about the use of any of the grounds for non-recognition or non-execution as listed in paragraphs 1 and 2 of this Article, by using the form set out in Annex III.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 11 – title

~~Confidentiality and user information~~Information to be provided to users

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 11 – paragraph 1

1. ~~Addressees and, if different, service providers shall take the necessary measures to ensure the confidentiality of~~The addressees shall inform the person whose data is being sought about the EPOC or ~~the~~ EPOC-PR and of the data produced or preserved and where requested by the issuing authority, shall refrain from informing the person whose data is being sought in order not to obstruct the relevant criminal proceedingswithout undue delay. When informing the person, the addressees shall include information about any available remedies as referred to in Article 17.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 11 – paragraph 1 a (new)

1 a. Upon a duly justified request by the issuing authority, based on a court order, the addressees shall refrain from informing the person whose data is being sought in order not to obstruct relevant criminal proceedings, and shall take the necessary measures to ensure the confidentiality of the EPOC or the EPOC- PR and of the data produced or preserved. Such an order shall specify the duration of the obligation of confidentiality and shall be subject to periodic review.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 11 – paragraph 2

2. Where the issuing authority requested the addressee to refrain from informing the person whose data is being sought, the issuing authority shall inform the person whose data is being sought by the EPOC without undue delay abThe information referred to in paragraph 1 may be delayed only as long as necessary and proportionate to avoid obstructing the relevant criminal proceedings, taking into account the ~~data production. This information may be delayed as long as necessary and proportionate to avoid obstructing the relevant criminal proce~~rights of the suspected and accused person and without prejudice to defence rights and effective legal remedinges.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 11 – paragraph 3

~~3. When informing the person, the issuing authority shall include information about any available remedies as referred to in Article 17.~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 13 – paragraph 1 a (new)

Member States shall ensure that sanctions applied in accordance with paragraph 1 are annulled if a European Production Orders or European Preservation Orders is successfully challenged in accordance with Article 17.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 14

~~[...]~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 15

~~[...]~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 15 a (new)

Article 15 a Review procedure in case of conflicting obligations with third country law 1. Where the executing authority, either on its own or at the request of the service provider or, where applicable, based on a justified opinion from the affected authority, considers that compliance with the European Production Order or the European Preservation Order would conflict with applicable laws of a third country prohibiting disclosure of the data concerned, it shall inform the issuing authority within 10 days from the receipt of the order. 2. Such notice shall include all relevant details on the law of the third country, its applicability to the case at hand and the nature of the conflicting obligation. 3. The issuing authority shall review the European Production Order or the European Preservation Order and inform the addressees, within 10 days after receiving the notice, on the basis of the following criteria: (a) the interests protected by the relevant law of the third country, including fundamental rights as well as other interests preventing disclosure of the data, in particular national security interests of the third country; (b) the degree of connection of the criminal case for which the Order was issued to the jurisdiction of the issuing State and the third country, as indicated inter alia by: (i) the location, nationality and residence of the person whose data is being sought and/or of the victim(s); (ii) the place where the criminal offence in question was committed; (c) the degree of connection between the service provider and the third country in question; the data storage location by itself shall not suffice in establishing a substantial degree of connection; (d) the interests of the issuing State in obtaining the electronic evidence concerned, based on the seriousness of the offence and the importance of obtaining the electronic evidence in an expeditious manner; (e) the possible consequences for the addressees of complying with the European Production Order or the European Preservation Order, including the sanctions that may be imposed against the service providers. 4. Within 10 days after receiving the notice, the issuing authority may withdraw, uphold or adapt the Order where necessary, to give effect to these criteria. To this end, the issuing authority shall request clarifications on the applicable law from the competent authority of the third country, in compliance with Directive (EU) 2016/680, to the extent that this does not obstruct the deadlines provided for in this Regulation. In the event of withdrawal, the issuing authority shall immediately inform the addressees of the withdrawal. 5. Where the issuing authority decides to uphold the Order, it shall inform the addressees of its decision. After consulting the competent authority of the third country, the executing authority shall take a final decision based on the criteria listed in paragraph 3, within 10 days after receiving the decision of the issuing authority, and inform the issuing authority and the service provider of its final decision. 6. For the duration of the procedure referred to in Article 14a, the service provider shall preserve the data requested.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 16

~~[...]~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 1

1. ~~Suspects and accused~~Without prejudice to remedies available under Directive (EU) 2016/680 and Regulation (EU) 2016/679, persons whose data was ~~obtained~~sought via a European Production Order or a European Preservation Order shall have the right to effective remedies against ~~the European Production Order dur~~such orders ing the ~~criminal proceedings for which the Order was issued, without prejudice to remedies available under Directive (EU) 2016/680 and Regulation (EU) 2016/679~~issuing and executing State in accordance with national law.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 2

2. Where the person whose data was obtained is not a suspect or accused person in criminal proceedings for which the Order was issued, this person shall have the right to effective remedies against a European Production Order in the issuing State, without prejudice to remedies available under Directive (EU) 2016/680 and Regulation (EU) 2016/679.deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 3

3. Such right to an effective remedy shall ~~be exercised before a court in the issuing State in accordance with its national law and shall~~ include the possibility to challenge the legality of the measure, including its necessity and proportionality.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 3 a (new)

3 a. The substantive reasons for issuing the European Production Order or the European Preservation Order may be challenged in the issuing State, without prejudice to the guarantees of fundamental rights in the executing State.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 4

4. Without prejudice to Article 11, the issuing authority and the executing authority shall take the appropriate measures to ensure that information is provided in due time about the possibilities under national law for seeking remedies and ensure that they can be exercised effectively.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 6 a (new)

6 a. Electronic information that has been gathered in breach of this Regulation shall not be admissible before a court and shall immediately be erased.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 6 b (new)

6 b. Electronic information that is no longer necessary for the investigation or prosecution for which it was produced or preserved, shall immediately be erased. For this, Member States shall provide for appropriate time limits to be established for the erasure of electronic information produced or preserved or for a periodic review of the need of the storage of the electronic information. Procedural measures shall ensure that those time limits are observed.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 17 – paragraph 6 c (new)

6 c. The affected person shall be informed about the erasure.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 18

Ensuring privileges and immunities under If transactional or content data obtained by the European Production Order is protected by immunities or privileges granted under the law of the Member State of the addressee, or it impacts fundamental interests of that Member State such as national security and defence, the court in the issuing State shall ensure during the criminal proceedings for which the Order was issued that these grounds are taken into account in the same way as if they were provided for under their national law when assessing the relevance and admissibility of the evidence concerned. The court may consult the authorities of the relevant Member State, the European Judicial Network in criminal matters or Eurojust.Article 18 deleted the law of the enforcing State

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point a

(a) the number of EPOCs and EPOC- PRs issued by type of data requested, addressees, service providers a~~ddress~~ffected and situation (emergency case or not);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point b

(b) the number of fulfilled and non- fulfilled EPOCs by type of data requested, addressees, service providers a~~ddress~~ffected and situation (emergency case or not);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point b a (new)

(b a) the number of EPOCs and EPOC- PRs that have been opposed or non- recognised by type of data requested, addressees, service providers affected, situation (emergency case or not), and the ground for non-recognition or non- execution applied;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point c

(c) for fulfilled EPOCs, the average duration for obtaining the requested data from the moment the EPOC is issued to the moment it is obtained, by type of data requested, addressees, service providers a~~ddress~~ffected and situation (emergency case or not);

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point d

(d) the number of European Production Orders transmitted and received for enforcement to an enforcing State by type of data requested, service providers addressed and situation (emergency case or not) and the number thereof fulfilled;deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point d a (new)

(d a) the sanctions imposed in accordance with Article 13, by data requested, addressees, situation (emergency case or not) and amount of sanctions;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 19 – paragraph 2 – point e

(e) the number of legal remedies against European Production Orders and European Preservation Orders in the issuing State and in the e~~nforc~~xecuting State by type of data requested.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 20

Amendments to the Certificates and the The Commission shall adopt delegated acts in accordance with Article 21 to amend Annexes I, II and III in order to effectively address a possible need for improvements regarding the content of EPOC and EPOC-PR forms and of forms to be used to provide information on the impossibility to execute the EPOC or EPOC-PR.rticle 20 deleted Forms

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 20 – title

~~Amendments to the Certificates and the Forms~~Common secure digital infrastructure

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 20 – paragraph 1

The Commission shall adopt delegated acts in accordance with Article 21 to ~~amend Annexes I, II and III in order to effectively address a possible need for improvements regarding the content of EPOC and EPOC-PR forms and of forms to be used to provide informat~~establish authentication and transmission mechanisms, a common Union digital infrastructure for secure cross-border communication, authentication and transmission in the field of justice. When exercising that power, the Commission shall ensure that the system guarantees an effective, reliable and smooth exchange of the relevant information, as well as a high level of security in the transmission onand the ~~impossibility to execute the EPOC or EPOC-PR~~protection of privacy and personal data in line with Regulation (EU) 2016/679, Directive (EU) 2016/680, and Directive (EC) 2002/58.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 22 – paragraph 1 – point b

(b) the e~~nforc~~xecuting authority or authorities to which ~~are competent to enforce~~ the European Production Orders and European Preservation Orders ~~on behalf of another Member State~~are addressed;

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 22 – paragraph 1 – point c

~~(c) the courts competent to deal with reasoned objections by addressees in accordance with Articles 15 and 16.~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 23 – title

Relationship to European Investigation Orders and domestic orders

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 23 – paragraph 1 – subparagraph 1 (new)

Member States’ authorities shall not issue domestic orders with extraterritorial effects for the gathering of electronic evidence that falls within the scope of this Regulation.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 24 – paragraph 1

By [53 years from the date of application of this Regulation] at the latest, the Commission shall carry out an evaluation of the Regulation and present a report to the European Parliament and to the Council on the functioning of this Regulation~~, which shall include an assessment of the need to enlarge its scope~~. If necessary, the report shall be accompanied by legislative proposals. The evaluation shall be conducted according to the Commission's better regulation guidelines. Member States shall provide the Commission with the information necessary for the preparation of that Report.

2019/12/11
Committee: LIBE

Proposal for a regulation
Article 25 – paragraph 2

It shall apply from [~~6 month~~2 years after its entry into force].

2019/12/11
Committee: LIBE

Proposal for a regulation
Annex I – paragraph 1

Under Regulation (EU)….52 the addressee of the European Production Order Certificate (EPOC) must execute the EPOC and must transmit the requested data to the authority indicated under point (i) of Section G of the EPOC. If the data is not produced, the addressee must, upon receipt of the EPOC, preserve the data requested, unless the information in the EPOC does not allow it to identify this data. Preservation shall be upheld until the data is produced or until the issuing authority or where applicable the enforcing authority,indicates that it is no longer neccessary to preserve and produce data. _________________ 52Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters (OJ L …)deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Annex I – part D – point v – paragraph 2 – subparagraph 3

~~[ ] offences as defined in Article 3 to 12 and 14 of Directive (EU) 2017/541 of the European Parliament and of the Council.~~deleted

2019/12/11
Committee: LIBE

Proposal for a regulation
Annex III – part D – point i – paragraph 4

[ ] force majeure or de facto impossibility ~~not attributable to the addressee or the service provider~~

2019/12/11
Committee: LIBE