New obligation for digital service providers – EU makes it easier to obtain electronic evidence in criminal matters

Electronic evidence means data in electronic form that authorities may need when investigating a criminal case. The data may be held by a service provider operating in another EU Member State.

“The EU’s new common procedure will allow authorities to request electronic evidence directly from a service provider in another Member State. The aim is to make it easier to obtain data in situations where information related to a criminal case is held in another Member State,” says Head of Unit Mari Österberg at Traficom.

At the same time, many organisations providing digital services will have a new obligation. They must designate an addressee for the receipt of orders concerning the production and preservation of electronic evidence.

Obligation may apply to telecommunications operators, cloud services and online platforms

The new obligation to designate an addressee for orders concerning electronic evidence may apply to providers of communications services, cloud services, online platforms, domain name services and certain online games, for example.

The obligation applies to organisations offering the following services in the EU:

• messaging, video, voice call or broadband services
• services related to domain names or IP addresses, such as DNS and proxy services
• technical internet infrastructure services
• communication, storage or data processing services, such as online platforms, cloud services and web hosting services
• online games that allow users to communicate with each other or store data.

The notification obligation does not apply to financial services.

It also does not apply to a service provider that is established in only one Member State and offers services exclusively in that Member State

Service provider must designate an establishment or appoint a legal representative

If an organisation is established in the EU, it must notify at least one designated establishment.

If an organisation is established outside the EU, it must notify a legal representative.

The designated establishment or legal representative receives orders concerning the production and preservation of electronic evidence.

Traficom receives notifications in Finland

Notifications are submitted using the European Commission’s Notification Form for Service Providers. Submitting a notification requires a personal EU Login account.

“Traficom cannot yet be selected as the recipient of a notification in the service. We will start receiving notifications concerning Finland once the system has been introduced. We will provide more detailed information on the schedule during the autumn,” says Österberg.

Traficom acts as the central authority in Finland. “We will review the notification if the designated establishment or legal representative is located in Finland. If information is missing from the notification, we will contact the person who submitted it,” Österberg explains.

Once a notification has been approved, the service provider joins the common system

Once Traficom has approved a notification, the information in it is stored in the European Union’s common database. Traficom will then contact the organisation and provide instructions on how to connect to the common IT system.

The service provider can use the system through a web-based user interface or via a system interface.

Once the organisation has connected to the system, it can receive orders concerning electronic evidence from authorities in other EU Member States. The organisation also uses the same system to provide the requested data.