21 Amendments of Ralf SEEKATZ related to 2018/0108(COD)
Amendment 268 #
Proposal for a regulation
Recital 2
Recital 2
(2) Measures to obtain and preserve electronic evidence are increasingly important to enable criminal investigations and prosecutions across the Union as well as to prevent the commission of crimes. Effective mechanisms to obtain electronic evidence are of the essencetial to combat crime, subject to conditions to ensure full accordance with fundamental rights and principles recognised in the Charter of Fundamental Rights of the European Union ('the Charter') as enshrined in the Treaties, in particular the principles of necessity and proportionality, due process, data protection, secrecy of correspondenceconfidentiality of communications and privacy.
Amendment 273 #
Proposal for a regulation
Recital 6
Recital 6
(6) The European Parliament echoed these concerns in its Resolution on the fight against cybercrime of 3 October 201728 , by highlighting the challenges that the currently fragmented legal framework can create for service providers seeking to comply with law enforcement requests and calling on the Commission to put forward a Union legal framework for electronic evidence and to impose an obligation on service providers to respond to law enforcement requests from other Member States, with sufficient safeguards for the rights and freedoms of all concerned. _________________ 28 2017/2068(INI).
Amendment 305 #
Proposal for a regulation
Recital 21
Recital 21
(21) It is appropriate to single out access data as a specific data category used in this Regulation. Access data is pursued for the same objective as subscriber data, in other words to identify the underlying user, and the level of interference with fundamental rights is similar to that of subscriber data. Access data is typically recorded as part of a record of events (in other words a server log) to indicate the commencement and termination of a user access session to a service. It is often an individual IP address (static or dynamic) The specific category of 'access data' is introduced in this Regulation because technical identifiers such as IP addresses constitute a crucial starting point for criminal investigations in which the identity of a suspect is not known. In order to enable a request for subscriber data in a subsequent step, authorities will first have to acquire the server log, i.e. the record of activity on a server, for a specific access request. For each request, the logs include different information, such as the commencement and termination of a user access session, static or dynamic IP adresses of the computer making the request, or the Login ID. Given that certain data covered by the definition of access data could reveal very sensitive and personal information, the request for such data should only be allowed for other identifier th sole purpose of identifying the user. The data singles out the network interface used during the access session. If the user is unknown, it often needs to be obtained befhould not be used for any other purpose, including the request for bulk data that would allow for the profiling of a person. Given the purpose limitation regarding the use of access data in criminal investigations, this data categorey subscriber data related to that identifier can be ordered from the service providerhould not be subject to a threshold. Instead, it should be possible to request such data for all types of offenses.
Amendment 308 #
Proposal for a regulation
Recital 22
Recital 22
(22) Transactional data, on the other hand, is generally pursued to obtain more privacy-intrusive information about, such as the contacts and whereabouts of the user and may be served to establish a profile of an individual concerned. That said, access data cannot by itself serve to establish a similar purpose, for example iAccess data focus exclusively on the user but does not reveal any information on interlocutors related to the user. Hence this proposal introduces a new category of data, which is toactions with other persons. Hence, access data should be treated like subscriber data if the aim of obtaining this data, namely the identification of the suspect, is similar.
Amendment 311 #
Proposal for a regulation
Recital 23
Recital 23
(23) All data categories contain personal data, and are thus covered by the safeguards under the Union data protection acquis, but the intensity of. However, the impact on fundamental rights varies between the categories, in particular between subscriber data and access data on the one hand and transactional data and content data on the other hand. While subscriber data and access data are usefulonly serve to obtain first leads in an investigation about the identity of a suspect, transactional and content data are the most relevant as probative material which could finally lead to a conviction of the suspect. It is therefore essential that all these data categories are covered by the instrument. Because of the different degree of interference with fundamental rights, different safeguards and conditions are imposed for obtaining subscriber and access data on the one hand, and transactional and content data on the other.
Amendment 321 #
Proposal for a regulation
Recital 30
Recital 30
(30) When a European Production or Preservation Order is issued, there should always be a judicial authority involved either in the process of issuing or validating the Order. In view of the more sensitive character of transactional and content data, the issuing or validation of European Production Orders for production of these categories requires review by a judge or court. As subscriber and access data are less sensitive, European Production Orders for their disclosure can in addition be issued or validated by competent prosecutors.
Amendment 324 #
Proposal for a regulation
Recital 31
Recital 31
(31) For the same reason, a distinction has to be made regarding the material scope of this Regulation: Orders to produce subscriber data and access data can be issued for any criminal offence as these data are essential to identify a user, whereas access to transactional and content data should be subject to stricter requirements to reflect the more sensitive nature of such data. A threshold allows for a more proportionate approach, together with a number of other ex ante and ex post conditions and safeguards provided for in the proposal to ensure respect for proportionality and the rights of the persons affected. At the same time, a threshold should not limit the effectiveness of the instrument and its use by practitioners. Allowing the issuing of Orders for investigations that carry at least a threewo-year maximum sentence limits the scope of the instrument to more serious crimes, without excessively affecting the possibilities of its use by practitioners. It excludes from the scope a significant number of crimes which are considered less serious by Member States, as expressed in a lower maximum penalty. It also has the advantage of being easily applicable in practice.
Amendment 330 #
Proposal for a regulation
Recital 34 a (new)
Recital 34 a (new)
(34 a) The confidentiality of the ongoing investigation, including the fact that there has been an Order to obtain relevant data, has to be protected in order not to jeopardize its success and to protect other persons involved, especially victims. For this reason, the addressee of the order and the service provider should refrain from informing the person whose data is being sought where necessary and proportionate to protect the fundamental rights and legitimate interests of another person. If the issuing authority expressly allows it, the addressee or service provider should be able to inform the respective person that his or her data is being sought.
Amendment 341 #
Proposal for a regulation
Recital 38
Recital 38
(38) The European Production and European Preservation Orders should be transmitted to the service provideraddressee through a European Production Order Certificate (EPOC) or a European Preservation Order Certificate (EPOC-PR), which should be translated. The Certificates should contain the same mandatory information as the Orders, except for the grounds for the necessity and proportionality of the measure or further details about the case to avoid jeopardising the investigations. But as they are part of the Order itself, they allow the suspect to challenge it later during the criminal proceedings. Where necessary, a Certificate needs toshould be translated into (one of) the official language(s) of the enforcing Member State of the addressee, or into another official language that the service provider has declared it will accept. in accordance with Article 4 (2) of the [Directive1a]. _________________ 1aProposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings (2018/0107 (COD))
Amendment 350 #
Proposal for a regulation
Recital 41 a (new)
Recital 41 a (new)
(41 a) Although the added value of this Regulation lies in the fact that the issuing authority can address the service provider without having to go through mutual legal assistance, it is reasonable to notify the enforcing authority of a European Production Order where it concerns transactional or content data, given their high level of sensitivity, and the issuing authority has reasonable grounds to believe that the person whose data is sought is not residing on the territory of the issuing Member State. In such case, the issuing authority should submit a copy of the EPOC to the enforcing authority at the same that the EPOC is submitted to the addressee. In order to ensure the efficiency of the European Production Order, the notification should not have a suspensive effect on the obligations of the addressee to produce the requested data and to send them to the issuing authority. However, the notified authority may raise objections in relation to a limited number of grounds which should be raised as soon as possible but no later than 10 days. If necessary to establish whether one of the grounds exists, the authority should be able to request additional information from the issuing authority, which should be given 10 days to provide information or withdraw the Order. As far as the objection raised concerns regarding immunities and privileges under national law of the enforcing Member State, the issuing authority should be able to request the enforcing authority to request the competent authority to waive these immunities or privileges. When raising an objection, the enforcing Member State should also inform the issuing authority whether it may consequentially not use the data or only use it only under specified conditions. The issuing authority should take this information into account. In cases where the enforcing authority informed the issuing authority that it may not use the data, the latter should make no further use of these data but delete them immediately.
Amendment 351 #
Proposal for a regulation
Recital 41 b (new)
Recital 41 b (new)
(41 b) It should be possible to object to an order where its execution in the executing State would involve a breach in the immunity or privilege in that State. There is no common definition of what constitutes an immunity or privilege in Union law. The precise definition of these terms is therefore left to national law, which could include protections which apply to medical and legal professions, but should not be interpreted in a way to counter the obligation to abolish certain grounds for refusal as set out in the Protocol to the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union1a. _________________ 1a Protocol established by the Council in accordance with Article 34 of the Treaty on European Union to the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union (OJ C 326, 21.11.2001, p. 2).
Amendment 356 #
Proposal for a regulation
Recital 42
Recital 42
(42) Upon receipt of a European Preservation Order Certificate (‘EPOC- PR’), the service provider should preserve requested data for a maximum of 60 days unless the issuing authority informs the service provider that it has launched the procedure for issuing a subsequent request for production, in which case the preservation should be continued. The 60 day period is calculated to allow for the launch of an official request. This requires that at least some formal steps have been taken, for example by sending a mutual legal assistance request to translation. Following receipt of that information, the data should be preserved as long as necessary until the data is produced in the framework of a subsequent request for production. Only when necessary to allow further assessment of the relevance of the data in ongoing investigations and prevent the issuing of European Production Order for the sake of making sure that potentially relevant data is not lost, before the referred preservation period ends, the issuing authority could send a request to prolong the preservation of data by up to 60 days.
Amendment 473 #
Proposal for a regulation
Article 4 – paragraph 1 – point a
Article 4 – paragraph 1 – point a
(a) a judge, a court, an investigating judge or prosecutor competent in the case concerned; or, in accordance with national law;
Amendment 480 #
Proposal for a regulation
Article 4 – paragraph 2 – point a
Article 4 – paragraph 2 – point a
(a) a judge, a court or an investigating judge competent in the case concerned; or, in accordance with national law.
Amendment 511 #
Proposal for a regulation
Article 5 – paragraph 5 – point c
Article 5 – paragraph 5 – point c
(c) the persons whose data is being requesteduser, except where the sole purpose of the order is to identify a person;the user, or any other unique identifier such as user name, Login ID to determine the data that are being sought.
Amendment 529 #
Proposal for a regulation
Article 6 – paragraph 3 – point c
Article 6 – paragraph 3 – point c
(c) the persons whose data shall be preserveduser, except where the sole purpose of the order is to identify a person;the user, or any other unique identifier such as user name, Login ID to determine the data that are being sought.
Amendment 558 #
Proposal for a regulation
Article 7 a (new)
Article 7 a (new)
Amendment 641 #
Proposal for a regulation
Article 10 – paragraph 3 – subparagraph 1 (new)
Article 10 – paragraph 3 – subparagraph 1 (new)
Before the preservation period referred to in paragraph 1 has ended, the issuing authority may send a request to prolong the data preservation period by up to 60 days only when necessary to allow further assessment of the relevance of the data.
Amendment 670 #
Proposal for a regulation
Article 11 – paragraph 1
Article 11 – paragraph 1
1. Addressees and, if different, service providers shall take the necessary measures to ensure the confidentiality of the EPOC or the EPOC-PR and of the data produced or preserved and where requested by the issuing authority, shall refrain from informing the person whose data is being sought in order not toto avoid obstructing the relevant criminal proceedings. They shall only inform the person whose data are being sought if explicitly allowed by the issuing authority. In that case, the issuing authority shall also provide information pursuant to paragraph 4 of this Article to the addressee or, if different, to the service provider.
Amendment 726 #
Proposal for a regulation
Article 15 – paragraph 5
Article 15 – paragraph 5
5. If the competent court finds that no relevant conflict within the meaning of paragraphs 1 and 4 exists, it shall uphold the Order. If the competent court establishes that a relevant conflict within the meaning of paragraphs 1 and 4 exists, the competent courexists and that the relevant third country law serves to protect fundamental rights of the individuals concerned or fundamental interests of the third country related to national security or defence, the competent court shall consult the third country concerned. For this purpose, it shall transmit all relevant factual and legal information as regards the case, including its assessment, to the central authorities in the third country concerned, via its national central authority, with. The competent court shall set a 15 day deadline to respond. Upon reasoned request from the third country central authority, the deadline may be extended by up to 30 days. If the third country objects to the execution of the European Production Order, the competent court shall lift the Order and inform the issuing authority and the addressee. If no objection is received within the extended deadline, the competent court shall uphold the Order.
Amendment 728 #
Proposal for a regulation
Article 15 – paragraph 6
Article 15 – paragraph 6
6. If the third country central authority,competent court established that a conflict within the dmeadline, informs the competent court that it objects to the execution of the European Production Order in this case, the competent court shall lift the Order and inform the issuing authority and the addressee. If no objection is received within the (extended) deadline, the competent court shall send a reminder giving the third country central authority 5 more days to respond and informing it of the consequences of not providning of paragraph 1 exists and that the relevant third country law prohibits disclosure of the data concerned on grounds other than those enumerated in paragraph 6, the competent court shall determine whether to uphold or withdraw the Order, in particular on the basis of the following factors: (a) the interest protected by the relevant law of the third country, including the third country's interest in preventing disclosure of the data; (b) the degree of connection of the criminal case for which the Order was issued to either of the two jurisdictions, as indicated inter alia by the location, nationality and residence of the person whose data is being sought and/or of the victim(s). (c) the degree of connection between the service provider and the third country in question;the data storage location by itself does not suffice in establishing a substantial degree of connection; (d) the interests of the investigating Sate in obtaining the evidence concerned, based on the seriousness of the offence and the importance of obtaining evidence ing a response. If no objection is receivedn expeditious manner; (e) the possible consequences for the addressee or the service provider of complying within this additional deadline, the competent court shall uphold the Order. e European Production Order, including the sanctions that may be incurred.