New rules on the sharing of digital evidence

New rules on the sharing of digital evidence

Nowadays, it appears that more evidence of criminal offences exists in digital form than in the form of, for example, fingerprints or CCTV footage. Examples include

• email messages,
• chat messages,
• login details, or
• cloud files.

From 18 August 2026, new rules will apply to the sharing of digital evidence with judicial authorities in other EU countries. These rules are intended to make it easier to request and transfer digital evidence for criminal cases within the European Union (EU). The aim is to enable investigative authorities to work more effectively, whilst also ensuring that privacy and security provisions are upheld. These new rules are also known as the e-Evidence package.

 

The e-Evidence package

The e-Evidence package consists of:

• Regulation (EU) 2023/1543; and
• Directive (EU) 2023/1544.

 

European Production Order (EPOC)

At the heart of the Regulation is the European Production Order Certificate (EPOC). This is a court order enabling a public prosecutor or judge in, for example, the Netherlands to request digital data directly from a service provider in another EU country, without the involvement of local authorities.

 

Digital service providers

The e-Evidence Directive requires digital service providers to have a legal representative or designated establishment within the EU, so that it is clear to whom such an order should be addressed and to ensure there is always a clear point of contact.

 

Direct requests to service providers

Together, these provisions enable judicial authorities in an EU Member State to request electronic evidence directly from service providers operating in the EU, regardless of where the data is stored.

 Two new legal instruments can be used for this purpose:

• European Production Orders:
  • a service provider is obliged to provide specific electronic data; (CEV)
• European Preservation Orders:
  • a service provider is obliged to preserve specific data pending a subsequent request for disclosure. (CEB)

 

e-Evidence portal

To enable the secure and standardised exchange of this data, the EU is developing a digital system: the e-Evidence portal. Each Member State will have a national connection point that communicates with other Member States via the portal.

 

In the Netherlands

In the Netherlands, three parties are involved in this process:

1. the Public Prosecution Service (OM) or a comparable judicial authority in another EU Member State,
2. the Netherlands Authority for Consumers and Markets (ACM), and
3. the European Commission (for the registration of the service provider).

 The new rules apply to data stored in connection with:

1. Electronic communications services, such as telephone or internet access.
2. Services relating to internet domains and IP addresses, such as the registration of domain names, the allocation of IP addresses and privacy services for domain owners.
3. Other online services, such as platforms where users can communicate with one another. Examples include social media, hosting platforms, marketplaces, online trading platforms (such as those for searching for and booking hotels or apartments), and online gaming services. Or services where users can store data or have it processed (such as cloud storage), provided that such storage is a key part of the service.

 

Obligation to register with the European Court Database (CDB)

Providers of these types of services – that is, electronic communications services, online platforms, cloud storage or services relating to internet domains – must register with the European Court Database (CDB). This is mandatory under the European e-Evidence rules. Service providers must all register with the European Court Database (CDB), so that judicial authorities know whom to contact in order to issue a European Production Order (CEV) or a European Preservation Order (CEB).

Registration will only be possible once the ACM is authorised to supervise the registration requirement. This is expected to be the case in early 2027.

Companies are only required to register if they:

• are established in the Netherlands and offer services in one or more EU Member States; or
• offer services in the Netherlands and are established outside the EU.

 If a provider is established in the Netherlands and only offers services in the Netherlands, the company does not need to register.

 

Step-by-step guide

1. Are you a provider of this type of service and are you obliged to register with the European Court Database (CDB) as soon as possible? If so, your organisation has further obligations, which you can start preparing for now. Here is a brief step-by-step guide:
2. Your organisation must appoint a legal representative in the EU to be able to receive orders. Service providers based outside the EU but offering services within the EU must appoint a legal representative in a Member State. The designated establishment or legal representative must be registered with the European Court Database (CDB) as soon as possible.
3. A digital system is being developed: the e-Evidence portal. Your organisation must connect to this portal. For service providers, there will be both a web interface and an API, so that both manual processing and automated integrations are possible. The technical specifications are likely to be finalised in the first quarter of 2027.
4. Your organisation, its processes and systems must be set up in such a way that you can provide the requested information within the specified time limits. The standard time limit for European Production Orders (CEV) is ten days. However, this time limit can be reduced to 8 hours! This applies in emergency situations where there is an immediate threat to life, physical integrity or critical infrastructure. In addition, your organisation must continue to comply with data protection regulations when sharing data.

It is therefore advisable to start adapting your processes accordingly now, so that you will be able to meet the new requirements in due course.

The ACM will play a supervisory role in all of this. For example, the ACM will monitor whether companies falling under these regulations register themselves (on time) as service providers the European Commission’s Court Database (CDB). If a company fails to do so, the ACM may apply administrative law to enforce compliance. This also applies to ensuring the accuracy of the information provided after registration.

The ACM will also monitor whether companies organise their operations in such a way as to be able to comply with the requested orders within the specified time limits.

 

Advice

Would you like to make use of our ready expertise and contact us on a regular basis? Take out a subscription to the Virtual Legal Department. Please email me directly and you will receive the terms and conditions, with no obligation.

Want to know more? Feel free to call or email:

1. +31(0)70-3819281 
2. info@wisemen.nl 

For the latest updates, sign up now for the

WiseMen Newsflash!