EU Bookmark and Share  
Commission to present legal proposal on police access to cloud data; data retention discussion continues
Follow us: | | Tweet

The European Commission is planning to present a legal proposal on easing police access to data hosted in the cloud "by the end of this year or early 2018", according to a Commission spokesperson, acting on a "sense of urgency" raised by justice and interior ministers at the JHA Council in Luxembourg yesterday.

See: Justice and Home Affairs Council, 08-09/06/2017 (Council of the EU, link, emphasis added):

"A large majority of them supported the need to consider EU legislative action regarding direct cooperation with service providers and setting EU common conditions and minimum safeguards for direct access to data by authorities from a computer system. Many underlined that in developing such a framework due account must given to the issues of data protection as well as the need to take into account and ensure synergies as appropriate with current discussions taking place at international level. Taking into account the sense of urgency raised by a number of ministers, the Commission announced its intention to present a legislative proposal early next year."

Discussions were based on three proposals put forward by the Commission in mid-May:

"Of the three EC proposals, the least intrusive option involves allowing law enforcement agencies in one member state to ask an IT provider in another member state to turn over electronic evidence, without having to ask that member state first.

The second option would see the companies obliged to turn over data if requested by law enforcement agencies in other member countries.

The most intrusive option, allowing law enforcement agencies direct access to information in the cloud, is being suggested for situations where authorities do not know the location of the server hosting the data or there is a risk of the data being lost."

See: EU could give police direct access to cloud data in wake of terror attacks (The Guardian, link)

The options in question are contained in a document prepared by the Commission in mid-May: Improving cross-border access to electronic evidence: Findings from the expert process and suggested way forward (9543/17, 22 May 2017, pdf):

"The current legal frameworks reflecting traditional concepts of territoriality are challenged by the cross-jurisdictional nature of electronic services and data flows. A number of Member States and third countries have developed or are developing national solutions that might result in conflicting obligations and fragmentation and create legal uncertainty for both authorities and service providers.

Consequently, the Council identified all three current channels as being in need of improvement. In response, the Commission launched an expert process with a wide range of stakeholders, including Member States' Ministries, judiciary and law enforcement, industry, civil society, academia, EU agencies and others. This paper suggests ways forward on the basis of findings of the expert process."

Large technology companies have already expressed concerns over the foreseen proposals: EU seeks to expedite police requests for data from tech firms (Reuters, link):

"...many in the tech community have voiced concern about allowing governments to force companies to turn over data stored in another country, fearing it could erode customers' privacy and make them less likely to use cloud services if they thought the data could be seized."

See also a Council follow-up to the earlier Commission document: Improving cross-border access to electronic evidence - findings from the expert process and suggested way forward (9677/17, 29 May 2017, pdf).

The official report from the JHA Council meeting notes a number of other steps that will be taken to improve access to "e-evidence" (emphasis added):

"Ministers of Justice and Home Affairs discussed the way forward on e-evidence on the basis of the practical solutions identified as a result of the Commission's expert process.. They supported the swift implementation of a number of practical measures to improve cooperation among judicial authorities and with service providers. These include the creation of an electronic user-friendly version of the European Investigation Order (EIO), the creation of single points of contacts within the authorities of member states and service providers to facilitate cooperation, the streamlining of service providers' policies on procedures and conditions to request access, the standardisation of forms used by member states to request access to e-evidence, amongst others. To improve cooperation with US authorities, a key partner when it comes to e-evidence, the exchange of best practices and training of practitioners should also be further enhanced."

Data retention and encryption also under discussion

The Council also discussed a LIMITE document on data retention that Statewatch is making available: Common reflection process on data retention = Progress report (9802/17, 31 May 2017, pdf):

"The objective of the group is to pull various working strands and expertise together to allow for a comprehensive overview on retention of communication data from a multidisciplinary perspective. Three meetings of the working party took place thus far - on 10 April, 15 May and 29 May 2017. They allowed for dedicated discussions on the specific requirements of the CJEU judgments and served as a forum for exchanging national experiences."

See also: Justice and Home Affairs Council, 8-9 June 2017: agendas and other documentation including draft conclusions heading for approval (8 June 2017) and: Council in a twist over data retention judgment (13 May 2017)

The Commission also "briefed ministers on the work carried out in the expert process on encryption, which is foreseen to continue during the coming months," although no further detail has so far come to light on what this briefing entailed.

Did you find this article useful?

Support our work by making a one-off or regular donation to help us continue to monitor the state and civil liberties in Europe.

Search our database for more articles and information or subscribe to our mailing list for regular updates from Statewatch News Online.

We welcome contributions to News Online and comments on this website. E-mail us or send post to Statewatch c/o May Day Rooms, 88 Fleet Street, London EC4Y 1DH, UK.

Home | News Online | Journal | Observatories | Analyses | Database | SEMDOC | About Statewatch

© Statewatch ISSN 1756-851X. Personal usage as private individuals/"fair dealing" is allowed. We also welcome links to material on our site. Usage by those working for organisations is allowed only if the organisation holds an appropriate licence from the relevant reprographic rights organisation (eg: Copyright Licensing Agency in the UK) with such usage being subject to the terms and conditions of that licence and to local copyright law.