Documents considered by the Committee on 6 March 2019 Contents

8Cross-border access to electronic evidence in criminal proceedings

Committee’s assessment

Legally and politically important

Committee’s decision

Not cleared from scrutiny; further information requested; drawn to the attention of the Home Affairs Committee and the Justice Committee

Document details

(a) Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185)

(b) Recommendation for a Council Decision authorising the opening of negotiations in view of an agreement between the European Union and the United States of America on cross-border access to electronic evidence for judicial cooperation in criminal matters

Legal base

(a) and (b) Article 218(3) and (4) TFEU, QMV

Department

Home Office

Document Numbers

(a) (40362), 6110/19 + ADD 1, COM(19) 71

(b) (40363), 6102/19 + ADD 1, COM(19) 70

Summary and Committee’s conclusions

8.1The proliferation of electronic means of communication (such as emails and text messages) in the digital age presents a challenge for law enforcement authorities. Electronic evidence needed for criminal investigations (“e-evidence”) must often be obtained from online service providers who are based in a different jurisdiction. The European Commission considers that current procedures for obtaining e-evidence are too slow. They usually require the involvement of judicial and law enforcement authorities in the investigating Member State and in the country in which the online service provider is based and so take longer to execute. Under new rules proposed in April 2018, the law enforcement authorities of one Member State would be able to secure and obtain e-evidence by serving an order directly on an online service provider based in a different jurisdiction but offering services within the EU. Whilst recognising the importance of cross-border law enforcement access to e-evidence, the Government decided not to opt into the proposed new Regulation, stating:

“[….] it is not clear that new EU legislation will be a practical and effective way to address the global issue of providing lawful access to data held anywhere in the world.”42

8.2The Government indicated that its priority was to sign and ratify a bilateral Data Access Agreement with the United States of America, the jurisdiction in which the largest online service providers are based. If the UK had opted into the proposed EU Regulation on law enforcement access to e-evidence, the Minister for Policing and the Fire Service (Rt Hon Nick Hurd MP) considered that the Court of Justice “would likely have concluded that it was unlawful as a matter of EU law for the UK to conclude the agreement” with the USA as it would encroach on an area of exclusive EU competence.43 Where it is established that the EU has acquired exclusive external competence through the adoption of common EU rules, only the EU, not Member States acting individually, are able to negotiate and conclude international agreements. The Council agreed a general approach on the proposed Regulation in December 2018 with a view to concluding trilogue negotiations with the European Parliament before its current term ends in May 2019.

8.3The extent to which the EU has acquired exclusive external competence through the adoption of common EU rules is the principal issue in the latest set of Recommendations made by the European Commission for two new Council Decisions. The first proposal, document (a), would authorise the European Commission to negotiate a Second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185) on behalf of the EU. The purpose of the Protocol is to enhance the capacity of national judicial and law enforcement authorities to access e-evidence when carrying out a criminal investigation by improving mutual legal assistance, enabling direct cooperation with service providers based in a foreign jurisdiction, and establishing a clear legal framework and stronger safeguards. The second proposal, document (b), would authorise the European Commission, on behalf of the EU, to negotiate an agreement with the United States on cross-border law enforcement access to e-evidence. It would complement an existing EU/US agreement on mutual legal assistance (“MLA”), in force since February 2010, which is the principal mechanism for ensuring effective transatlantic criminal justice and law enforcement cooperation but can be slow and costly. The UK does not participate in the EU/US MLA agreement but has its own bilateral treaty with the USA.44 The proposal would also complement the EU/US Data Protection and Privacy Agreement (the so-called “Umbrella Agreement”) which ensures that there are adequate safeguards in place to protect cross-border transfers of personal data.

8.4The European Commission considers that the EU, rather than individual Member States, must conduct both sets of negotiations. Whilst anticipating that “the two processes will progress at a different pace”, it says that they address “inter-linked issues and commitments taken in one negotiation may have a direct impact on other strands of negotiations”.45 Turning first to document (a), the European Commission asserts that the EU has exclusive external competence because the Second Additional Protocol to the Council of Europe Convention on Cybercrime would “overlap to a large extent” with a range of EU instruments setting out common rules on:

8.5This overlap would, in the Commission’s view, “affect common Union rules or alter their scope” and therefore give rise to exclusive EU competence under Article 3(2) of the Treaty on the Functioning of the European Union (TFEU). It makes clear that its 2018 proposal on cross-border access to electronic evidence, though not yet agreed, must also be taken into account as a “foreseeable future development” of relevant common EU rules. The Commission concludes that the EU is required to act “to protect the integrity of Union law and to ensure that the rules of international law and Union law remain consistent”.46 An Annex (ADD 1) to the proposed Council Decision sets out the detailed objectives which should guide the Commission in conducting the negotiations.

8.6The purpose of the proposed EU/US agreement, document (b), is to speed up the evidence-gathering process by enabling judicial authorities to secure and obtain e-evidence directly from service providers for use in criminal proceedings. Currently, direct cooperation with US-based service providers only takes place on a voluntary basis and is limited to non-content data (such as subscriber data and traffic data).47 This fragmented approach creates legal uncertainty and, the Commission suggests, lacks transparency and accountability.48 Under the CLOUD Act (Clarifying Lawful Overseas Use of Data), adopted by the US Congress in March 2018, the US Government can conclude executive agreements with foreign governments setting out the terms on which online service providers based in the US can provide electronic evidence directly to judicial authorities in other countries. The proposed EU/US Agreement would establish common rules to allow the reciprocal transfer of content and non-content data directly by a service provider to a requesting authority in another jurisdiction, as well as rules to prevent conflicts of law. The European Commission bases its claim to exclusive external competence to negotiate the proposed EU/US agreement on the need to ensure that the outcome is compatible with the EU’s (yet to be adopted) internal rules on e-evidence.

8.7Whilst both proposed Council Decisions concern areas of EU law and policy which fall mainly within the scope of Article 82 TFEU on judicial cooperation in criminal matters, neither cites a Title V (justice and home affairs) legal base. They are based solely on the procedural legal bases set out in Article 218(3) and (4) TFEU which set out how the mandate for negotiations should be agreed and who should conduct them.

8.8The Government considers that the UK’s Title V (justice and home affairs) opt-in Protocol applies to both proposed Council Decisions. In his Explanatory Memorandum of 20 February 2019 on document (a), the proposed Council Decision authorising the European Commission to participate in the negotiation of the Second Additional Protocol to the Cybercrime Convention on behalf of the EU, the Minister for Security and Economic Crime (Rt Hon. Ben Wallace MP) says that the Government will press for the inclusion of a substantive justice and home affairs (“JHA”) legal base, adding:

[…] the usual practice is for the Council to add a substantive legal base to the Commission proposal (in relation to Council Decisions authorising negotiating mandates) during the course of Council considerations. The addition of a JHA legal base would clarify that the UK’s opt-in applies.

8.9Under the UK’s Title V opt-in Protocol, the UK has three months in which to decide whether to opt in to an EU justice and home affairs proposal.49 This three-month period will extend beyond 29 March 2019, the date on which the UK is expected to leave the European Union. The draft EU/UK Withdrawal Agreement envisages that the UK would still be able to opt into EU justice and home affairs proposals negotiated and agreed during a post-exit transition/implementation period if they “amend, build upon or replace” an existing measure which applied to the UK before exit day.50 As the proposed Council Decision is a new justice and home affairs measure, the UK will not be able to opt in once it has left the EU. The Minister indicates that the Government therefore intends to reach a decision (and notify the Council and European Commission) before 29 March 2019. This decision will be informed by:

8.10On the wider policy implications, the Minister recognises that Council of Europe and other international Conventions establishing practical mechanisms for cross-border cooperation “will become more important as we exit from the EU”. He underlines the need for negotiations on the Second Additional Protocol to the Cybercrime Convention to “be mindful of the requirement to accommodate the different systems and processes of a wide range of states (beyond just EU Member State participants)”.

8.11In a separate Explanatory Memorandum of 21 February 2019 on document (b), the proposed Council Decision authorising the EU to negotiate an agreement with the US on cross-border law enforcement access to e-evidence, the Minister for Policing and the Fire Service (Rt Hon. Nick Hurd MP) similarly states that the Government will press for the addition of a substantive justice and home affairs legal base. As the proposed Council Decision is a new measure (and so does not amend, repeal and replace, or build on an existing measure in which the UK participates), he indicates that the Government intends to reach an opt-in decision before exit day—29 March 2019—taking account of the following considerations:

8.12The Minister notes that bilateral negotiations between the UK and the USA on a reciprocal Data Access Agreement are already underway. The UK/US Agreement would allow “US companies to comply with lawful orders from UK authorities for the production of electronic communications without any conflict of law” and would “fulfil many of the objectives sought by the EU-US negotiating mandate, but through solely bilateral mechanisms, such as those established in the Crime (Overseas Production Order) Act which recently received Royal Assent”.

8.13The Government anticipates that both proposed Council Decisions will be brought to the Justice and Home Affairs Council for formal adoption in June 2019.

Our Conclusions

8.14We share the Government’s view that both proposed Council Decisions should cite a Title V (justice and home affairs) legal base, not least to remove any doubt that the UK’s Title V opt-in Protocol applies. We ask the Government to inform us of the progress it makes in securing additional Title V legal bases and recitals which indicate clearly whether (or not) the UK is bound by the proposed Council Decisions.

8.15We ask the Government to share with us the outcome of its competence analysis of document (a) and to explain, in relation to both proposed Council Decisions, whether it accepts the case made by the European Commission for exclusive EU external competence.

8.16We note that the Government intends to accelerate the process for reaching an opt-in decision so that the EU institutions can be notified before 29 March 2019, the date on which the UK is expected to leave the EU. We would welcome further information on the implications of a decision to opt into either or both proposed Council Decisions, should the post-exit transition/implementation period envisaged in the draft EU/UK Withdrawal Agreement take effect. In particular, we ask the Government:

8.17Pending further information, the proposed Council Decisions remain under scrutiny. We ask the Government to inform us of its opt-in decisions before 29 March 2019. We draw this chapter to the attention of the Home Affairs Committee and the Justice Committee.

Full details of the documents

(a) Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185): (40362), 6110/19 + ADD 1, COM(19) 71.

(b) Recommendation for a Council Decision authorising the opening of negotiations in view of an agreement between the European Union and the United States of America on cross-border access to electronic evidence for judicial cooperation in criminal matters: (40363), 6102/19 + ADD 1, COM(19) 70.

Previous Committee Reports

None, but see our earlier Reports on the proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters: Twenty-eighth Report HC 301–xxvii (2017–19), chapter 3 (16 May 2018), Thirty-seventh Report HC 301–xxxvi (2017–19), chapter 16 (5 September 2018) and Fortieth Report HC 301–xxxix (2017–19), chapter 14 (17 October 2018).


42 See the Written Ministerial Statement issued by the Minister for Policing and the Fire Service (Mr Nick Hurd) on 22 October 2018, HCWS 1024

43 See the Minister’s letter of 28 September 2018 to the Chair of the European Scrutiny Committee. The European Commission and the Council Legal Service both consider that the EU has exclusive competence to negotiate a data access agreement with the United States and have urged Member States to refrain from bilateral negotiations—see the Presidency note of 28 May 2018 (Council document 9418/18).

44 Council Decision 2009/820/CFSP on the conclusion of the EU/US Mutual Legal Assistance Agreement is one of the pre-Lisbon EU police and criminal justice measures which ceased to apply to the UK from 1 December 2014—see OJ C 430, 1 December 2014.

45 See p.5 of the Commission’s explanatory memorandum accompanying document (a).

46 See recital (6) of the proposed Council Decision—document (a).

47 Content data include the content of an electronic exchange of information. Non-content data encompass subscriber data and traffic data identifying the individuals sending and receiving electronic messages, as well as metadata revealing the timing, frequency and duration of exchanges.

48 According to the European Commission, fewer than half of the requests made to service providers are fulfilled—see p.2 of the explanatory memorandum accompanying document (b).

49 The three-month period starts to run from the date on which the last language version of the proposal is published.

50 See Article 127(5) of the draft EU/UK Withdrawal Agreement.




Published: 12 March 2019