Report on Data Protection in Gathering and Using Electronic Evidence

European legal framework comprehensively addressing data protection issues related to the collection of electronic evidence does not exists; Directive 95/46/EC and 2002/58/EC explicitly exclude application on state activities in criminal investigations, Directive 2006/24/EC was declared invalid by ECJ in 2014 and 2008/97/JHA only covers the exchange, not the collection of electronic evidence.

The European Union has a legal competence to harmonise particular aspects of criminal procedure law (incl. admissibility, which includes rules on means of collecting electronic evidence) according to art. 82, para. 2 TFEU. It can be argued that, given the long tradition of harmonizing data protection law, this competence could be used to set up a minimum standard of privacy safeguards to be established in relation to the use of certain means of collecting electronic evidence.

The Member Stated involved in the study under WP8 ‘Data Protection Issues’ – Belgium, Bulgaria, Germany, Italy, Hungary and the Netherlands – have shown divergent domestic legal frameworks and mostly few and not necessarily sufficient and/or congruent privacy safeguards related to electronic evidence, as already fundamental dogmatic structures differs. This concerns e.g. the dogmatic distinction between preventive and investigative measures, the system of fundamental rights related to privacy and its impact on criminal procedure law, and the rules on exchange of information between SIS and law enforcement agencies.

While several of the Member States subject to the study require explicit codification of all investigative measures, almost none of their legal systems provides for a definition of electronic evidence, or for rules solely applicable to electronic evidence, and amendments related to electronic evidence are sparse.

When assessing the use of digital technologies in criminal proceedings, among the national legal systems taken into consideration the Italia system is outstanding with respect to the existence of specific guidelines for their use and specific project dedicated to the use of digital technologies in criminal proceedings, and the Dutch and the Hungarian systems stand out for widely using digital filling systems. Specialised units or institutions dealing with digital technology for criminal investigation purposes exist in all the countries analysed under WP8.

Legal issues related to cloud-computing appear to be not sufficiently or not at all addressed by law.

Most of the national legal systems subject to the study provide legal procedures applying to electronic evidence (specifically or as well as to other evidence). However, already within this small sample of legal systems it could be observed that several rules apply for both physical and electronic evidence and seem to lack the distinctions, which however can be necessary for the provision of adequate privacy safeguards. Specific rules on how to use and preserve electronic evidence are sparse in the criminal procedure laws of the national legal systems reviewed here, whereas rather abstract normative objectives are reported to be codified at most.

Computer-assisted search for investigative purposes is either not covered by specific legal bases (but by more general provisions only) or not covered at all in the Member States subject to the study. It has a high impact on the fundamental rights of the subject, as it is a covert and remote measure, likely to be accompanied by secret manipulations of the infiltrated systems, and a measure, which will give vast insight into the private life of the suspect. The privacy risks involved are fundamentally different from those related to lawful interception and therefore need explicitly to be addressed by law.

Seizure of data was reported to be based upon a codified legal basis in all reviewed Member States except one, which was data specific however in only two countries, leading to privacy risks not adequately being addressed by law.

Data retention remains legal in half the Member States subject to the study due to the respective provisions transposing the annulled Directive 2006/24/EC still remaining in fore despite the decision of ECJ. It should be considered to conduct a future study to examine whether the remaining national provisions which had been implemented to transpose this directive and which have not yet been removed, are possibly violating European fundamental rights likewise and therefore may need to be annulled, too.

The admissibility of electronic evidence is not regulated explicitly through a law, code of conduct or any other best practice in the Member States subject to this study, which renders (only) the general rules for physical evidence applicable, and few cases were reported in which breaching data protection rules would lead to inadmissibility. To the extent to which admissibility is subject to decision of the judge in charge, privacy related fundamental rights need to be considered. Data security as a pre-condition for admissibility is being addressed, if at all, only rudimentarily by legal systems subject to the study.

Taking into account all these aforementioned issues, Deliverable D8.1 ‘Report on Data Protection in Gathering and Using Electronic Evidence’ provides an in-depth analysis of a large number of issues related to gathering and using electronic evidence and their privacy impact as well as a comparative analysis of the different approaches of the legal systems of Member States subject to the study. On the basis of this analysis, recommendations for a possible future legal framework are elaborated and presented at the end of the document. In particular, a possible future harmonised framework should include a definition of electronic evidence, which could act as a basis to regulate certain investigative measures which were identified to have particular impact on privacy related fundamental rights. Apart from that, it seems to be recommendable to establish technical standards and non-binding guidelines for the usage of electronic technologies, which could be developed by a future high-level expert group being set up by the European Union.