E-Evidence Regulation in force: efficiency vs privatisation of law enforcement

Since 18 August 2026, Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence (the "Regulation") allows competent authorities, under certain conditions, to approach service providers in other Member States directly. Besides raising ideological questions regarding a potential privatisation of law enforcement, an in-depth analysis of the Regulation brings to light a multitude of complex aspects to be dealt with for the companies concerned and potential addressees of the respective orders:

From judicial cooperation directly to the service provider

The E-Evidence Regulation complements the existing instruments of judicial cooperation with a mechanism specifically designed for electronic evidence. Electronic data can be deleted or altered quickly, while obtaining them through traditional judicial cooperation channels takes time. Subject to the requirements of the Regulation, the competent authority can address the order directly to the relevant addressee of the service provider. The Regulation therefore goes beyond merely accelerating existing judicial cooperation instruments. Private service providers are directly involved in the cross-border gathering of electronic evidence.

Who is affected?

Under art 2 (1), the Regulation applies to service providers offering services in the European Union. Its scope is broader than one might initially expect. Under art 3 (3), "service provider" includes providers of electronic communications services, internet domain name and IP numbering services, as well as certain information society services that enable users to communicate with each other or to store or process data. Examples include messaging and videoconferencing services, online marketplaces, online forum operators, cloud and hosting services or gaming platforms. The Regulation is therefore by no means limited to large international technology companies. However, financial services within the meaning of art 2 (2) (b) of Directive 2006/123/EC are excluded.

Preserve or produce?

The Regulation provides two different instruments: (i) the European Preservation Order under art 6 and (ii) the European Production Order under art 5:

i)    A European Preservation Order is transmitted through a European Preservation Order Certificate (EPOC-PR) (art 9). Its primary purpose is to prevent the loss of relevant data. It may generally be issued for all criminal offences, provided that a corresponding measure could also have been issued under the same conditions in a similar domestic case (art 6 (3)). Upon receipt, the addressee must preserve the requested data without undue delay. This obligation generally lasts for 60 days and may be extended by a further 30 days. If a subsequent request for production is confirmed within this period, the data must be preserved for as long as necessary (art 11 (1) and (2)).

ii)    A European Production Order is transmitted to the addressee through a European Production Order Certificate (EPOC). As the name suggests, it requires the actual transmission of already stored electronic evidence. Given the higher level of interference involved, more differentiated rules apply depending on the type of data requested. A European Production Order must also be necessary and proportionate (art 5 (2)).

The E-Evidence Regulation concerns electronic evidence already stored. Thus, it does not provide a basis for the ongoing monitoring of future communications.

Not all data are equal

Art 3 distinguishes between subscriber data, data requested for the sole purpose of identifying the user, traffic data and content data. Subscriber data include, for example, a user's name, address or certain registration details. Traffic data provide contextual information about a communication, such as connection or location data. Content data include, for example, emails, chat messages, images or other communication content.

European Production Orders for subscriber data and data requested for the sole purpose of identifying the user may generally be issued for all criminal offences (art 5 (3)). Stricter requirements apply to traffic and content data. A European Production Order for such data may generally only be issued for offences punishable in the issuing State by a maximum custodial sentence of at least three years, as well as for certain specifically listed offences (art 5 (4)).

The Regulation also differentiates according to the competent issuing authority. A European Production Order for subscriber data or data requested for the sole purpose of identifying the user may, in particular, also be issued by a competent public prosecutor (art 4 (1)). For traffic and content data, however, stronger judicial involvement is required. The order must be issued by, or validated by, a judge, court or investigating judge (art 4 (2)).

Notification and deadlines

Whether the enforcing authority in another Member State must also be involved depends on the type of data requested. Where a European Production Order concerns traffic or content data, the issuing authority must generally notify the enforcing authority at the same time as it transmits the EPOC to the service provider (art 8 (1)). No notification is required for subscriber data, identification-only data or European Preservation Orders. Even for traffic or content data, notification may exceptionally be dispensed with if there are reasonable grounds to believe that the offence has been or is being committed in the issuing State and that the person whose data are requested resides there (art 8 (2)).

This distinction has a direct impact on the further procedure:

• Where no notification is required, the service provider must transmit the requested data to the issuing authority or the law enforcement authorities indicated in the EPOC at the latest within ten days following receipt of the EPOC (art 10 (3)).
• Where the enforcing authority is notified, it generally has ten days to raise a ground for refusal under art 12. These include immunities and privileges, the protection of press freedom and freedom of expression, a manifest breach of a relevant fundamental right, a violation of the ne bis in idem principle and, under certain conditions, the absence of dual criminality. If no ground for refusal is raised within that period, the data must be transmitted by the end of the ten-day period. If the enforcing authority does raise a ground for refusal, the service provider must not transmit the data, and the issuing authority must withdraw the order (art 12 (2)).

Significantly shorter deadlines apply in emergency cases. The requested data must be transmitted without undue delay and at the latest within eight hours of receiving the EPOC (art 10 (4)). Under art 3 (18), an emergency case includes, in particular, an imminent threat to the life, physical integrity or safety of a person. Where the enforcing authority must also be notified, it may still raise a ground for refusal within 96 hours. If the data have already been transmitted, they may have to be deleted or their use restricted.

What options do service providers have?

Service providers are not limited to executing an incoming order without further review. Where an EPOC is incomplete, contains manifest errors or lacks sufficient information for its execution, the addressee may seek clarification. The obligations to produce the data then generally apply only once the necessary clarification has been provided (art 10 (6)). Where production is de facto impossible, the service provider may inform the issuing authority and explain the reasons (art 10 (7)). Further consultation mechanisms apply where immunities, privileges or rules protecting press freedom or freedom of expression may be affected (art 10 (5)).

Art 17 provides for a separate review procedure in the event of conflicts with third-country law. Where the addressee considers that compliance with a European Production Order would conflict with an obligation under applicable third-country law, it may file a reasoned objection within ten days. If the issuing authority nevertheless intends to uphold the order, the matter must be subject to judicial review.

The Regulation does not, however, provide service providers with a general independent remedy against the European Production Order as such. This must be distinguished from the rights of the person whose data are requested. Under art 18, that person has a right to effective remedies against the European Production Order before a court in the issuing State.

Penalties

The new obligations are backed by significant potential penalties. Under art 15 (1), Member States must provide for effective, proportionate and dissuasive pecuniary penalties. They must ensure that pecuniary penalties of up to 2 % of the service provider's total worldwide annual turnover in the preceding financial year can be imposed.

Conclusion

At its core, the implications of the Regulation are straightforward: competent authorities will no longer have to rely on traditional judicial cooperation channels through the authorities of another Member State in every case but may, subject to the requirements of the Regulation, approach service providers in other Member States directly. What promises greater speed for investigating authorities also brings new responsibilities for service providers.

However, the practical implementation of the Regulation is far from simple. The differentiated rules on data categories, notification requirements, deadlines and grounds for refusal create a complex compliance framework. With the Regulation applying since 18 August 2026, service providers should assess their exposure without delay, establish internal processes for handling incoming orders and ensure that their teams are prepared to respond within the tight timeframes prescribed by the Regulation. Pecuniary penalties of up to 2 % of worldwide annual turnover underscore that non-compliance is not an option.