“Data! Data! Data!”
A European Production Order requires a service provider offering services in the Union to produce stored data for the purposes of criminal proceedings. It is always issued or validated by a judicial authority. The order is not addressed to just any department within the company, but to a specific addressee: the designated establishment or the legal representative of the service provider. It is transmitted by means of a European Production Order Certificate, or EPOC for short.
The EPOC contains the information required for further processing. This includes, in particular, details of the issuing authority, the addressee, the category of data requested, where applicable the relevant time period, the applicable provisions of criminal law and, in emergency cases, the reasons for the emergency.
A production order may relate to different types of electronic evidence. The Regulation distinguishes between subscriber data, identification data, traffic data and content data. These may include, for example, a user’s name and contact details, IP addresses, connection and location information, or the content of emails, chats and stored files.
This distinction is not merely a matter of terminology. The more sensitive the requested data, the stricter the requirements the Regulation imposes on issuing the order. A production order must always be necessary and proportionate. It may only be issued if a similar order could have been issued under the same conditions in a similar domestic case. Subscriber data and identification data may be requested for all criminal offences and for the execution of a custodial sentence or detention order of at least four months. Traffic data and content data, by contrast, may only be requested for offences punishable by a custodial sentence of a maximum of at least three years or for certain listed offences such as cybercrime or terrorism.
The clock starts ticking upon receipt of the EPOC. The data covered by the production order must first be preserved without delay. The addressee must then examine the EPOC and determine how to proceed. The standard deadline for producing the requested data is ten days. In emergency cases, the deadline is as short as eight hours.
However, receipt of an EPOC does not mean that every request must be complied with without scrutiny. If, for example, an order is incomplete, contains manifest errors or lacks necessary information, the Regulation provides for a clarification procedure. De facto impossibility, immunities, privileges, freedom of the press or other grounds may also affect how the process continues.
For service providers, the European Production Order is therefore far more than an ordinary request from the authorities. From receipt of the EPOC through the preservation and examination of the data to timely production, several legal assessments and internal processes must interlock within a short period of time.
With EviGate, you have full control over EPOC form management. All forms provided for by law are automatically completed and made ready for dispatch. An automatic plausibility check alerts you at an early stage to formal errors, deviations from the list of offences and potential conflicts with other legal provisions. On request, an incoming production order can be subjected to a case-by-case legal review by a lawyer – for maximum legal certainty, even with complex production orders.