Initially planned for 24 January, the European Commission is finally expected to present a legislative proposal at the end of March or beginning of April on cross-border access to electronic evidence. But recent developments coming from the other side of the Atlantic, notably the new draft US Cloud (Clarifying Lawful Overseas Use of Data) Act, could have an influence on the European Commission's ongoing reflection.
In a note dated 26 February, which has been seen by EUROPE, the Bulgarian Presidency of the EU Council expresses its concern about these developments and underlines "the urgent need to act at EU level".
The Commission's legislative proposal is expected to require electronic service providers to supply any electronic evidence requested by judicial authorities in cases of suspicion of crime (see EUROPE 11929). This measure could be requested by a judicial authority for data stored outside its jurisdiction and, potentially, outside the EU.
"The speed of these developments can substantially change the setting in which the EU action was prepared so far, and slow down the process by having to consider an evolving regulatory situation", the Bulgarian Presidency states in this document.
More specifically, its concerns target the new draft Cloud Act that was presented to the US Congress on 6 February and that is supported by Republicans and Democrats.
The Cloud Act, which also enjoys the support of the industry (Apple, Facebook, Google, Microsoft and Oath), would amend the Stored Communications Act of 1986 by stipulating that US service providers will be obliged to conform with US orders on disclosing data, whatever the place of storage of this data. It also provides for the possibility for the US administration to conclude executive agreements, which would permit US service providers to supply data to a foreign 'partner' country, without requiring an application for mutual judicial assistance.
On the EU side, the problem now arises that Article 48 of the General Data Protection Regulation (GDPR) on foreign investigations bans the transfer or disclosure of data of a personal nature, except under a treaty of mutual judicial assistance or another international agreement.
The draft legislation nevertheless includes a 'comity clause' that would allow service providers to ask a US court to annul or amend a mandate for data stored abroad, if the data concern a non-American national and when the respect of the mandate would lead them to breach the laws of a partner country with which the US has concluded an executive agreement.
On Tuesday 27 February, the US Supreme Court furthermore heard the Microsoft Ireland Warrant Case, in which it must determine whether Microsoft should conform with a judicial mandate requiring the disclosure to the US of emails held in Ireland (see EUROPE 11922). The court apparently referred to the Cloud Act, asking if its adoption should not be awaited before taking a decision, initially expected for June 2018.
These subjects are due to be addressed at the EU-US ministerial discussions taking place in Sofia on 22 and 23 May. As regards the purely European issue of electronic evidence, this will be debated by European justice ministers when they meet in Council on 9 March. (Original version in French by Marion Fontana)