“Definitions belong to the definers, not the defined.”
The e-Evidence Regulation distinguishes between subscriber data, traffic data, and content data. Within the category of traffic data, the Regulation additionally treats certain data requested exclusively for the purpose of identifying a user as identification data. These categories differ in terms of the extent of the intrusion they entail and the level of protection they warrant.
This distinction has very practical consequences. Depending on the data category, the conditions for issuing production orders also vary.
The requested data category is already specified in the EPOC. For the provider, however, this should not necessarily mark the end of the review. A closer look is recommended, particularly in cases of obvious inconsistencies in the order. In particular, distinguishing between identification data and other traffic data can be difficult if the information actually requested goes beyond the specific identification of the user. For example, depending on the purpose of the order, an IP address may constitute either identification data or other traffic data.
Subscriber Data
Subscriber data refers to data held by the service provider in connection with the provision of its services. It may pertain to the identity of a subscriber or customer, as well as the type and duration of the service used. Typical examples include name, date of birth, address, payment information, phone number, or email address. Passwords or other means of authentication, however, do not qualify as subscriber data.
Identification Data
Identification data is not a completely separate category of data, but rather a subset of traffic data. It consists of traffic data that is requested solely for the purpose of identifying a user. This may include, in particular, IP addresses—including associated timestamps and source ports—if they are used exclusively for identification purposes. Typically, identification data is first requested in order to subsequently order the disclosure of the corresponding subscriber data. Due to its strictly limited purpose, the same requirements apply to identification data as to subscriber data.
Traffic Data
Traffic data provides context or additional information about the use of a service. This may include, in particular, the source and destination of a message, location data, the date, time, and duration of a connection, the route, the format, session login and logout data, or the protocol used. The level of intrusion involved is significantly higher. A comprehensive analysis of such data can provide deep insights into a user’s private life. For this reason, European Production Orders are subject to stricter requirements than those for subscriber and identification data.
Content Data
Content data constitutes the most sensitive category. This refers to data in digital form that is neither subscriber data nor traffic data. This includes, in particular, email and chat content, photos, videos, audio recordings, and files that users have stored in a cloud service, for example. The analysis of such content can directly reveal a person’s private or even intimate communications. The same stricter requirements for issuing orders apply to content data as to other traffic data.
The data category thus determines far more than just the description of the requested information. The requirements of the order and the subsequent procedural steps may depend on it. This is why it’s worth taking a closer look, especially when there is a discrepancy between the specified data category and the actual scope of data requested. With our structured review process, you always maintain a clear overview of the individual data categories and their requirements. Upon request, a specialized attorney will review the order on a case-by-case basis—providing additional assurance during processing.