It’s no secret that laws often lag behind the pace of technology. As criminals increasingly adopt the use of technology in their campaigns to harm others, the volume of law enforcement requests for data from private companies has increased exponentially.
Meta’s most recent transparency report (for the year 2022) shows the company received nearly 500K requests regarding 800K+ accounts in 2022! Most companies don’t receive nearly this many requests, but each request, whether it be dozens or several thousand each year, must be carefully vetted and managed according to applicable laws. So both legal and technical advancements can help ease the burden on companies.
On August 18, 2023 the European Council adopted a new law for cross-border access to electronic evidence (e-evidence). Originally proposed by the European Commission back in 2018, the regulation aims to ‘simplify’ access by law enforcement authorities to personal data held by private online service providers established in other Member States, by allowing such authorities to send requests directly to companies. There is a 3 year deadline for the law to be implemented.
According to the Council, e-evidence refers to digital data, such as emails, text messages and traffic data, that is used to investigate and prosecute criminal offenses. Until now, the framework of judicial cooperation required law enforcement authorities to work through their counterparts in the EU country where the company is established in order to request access to the data. The council reports that cross-border requests are made in over 50% of all criminal investigations in the EU.
The new directive also requires all service providers based outside the EU but that offer services within the Union to designate a legal representative within a member state. This legislation also establishes high standards for government access to personal data and creates a pathway towards greater alignment between the US and EU with regards to data sharing for government access.
We built Kodex to assist companies in responding to data requests from global law enforcement, so customers don’t need to recreate the wheel with every new regulation. Our secure, configurable, intuitive platform makes it easier for law enforcement to send legal requests with the appropriate level of specificity, and for companies to respond based on their policies and relevant data protection laws.
Ultimately, this new legislation improves agencies' access to electronic evidence via legal process and is an important step forward for public safety in the EU.
The e-evidence regulation requires service providers to respond to law enforcement requests within 10 days for non-emergency cases and within 8 hours for emergencies including subscriber and identification data. Service providers then have up to 96 hours to provide any additional information requested for an emergency case.
These tight deadlines are meant to significantly speed up investigation procedures and the law supports hefty financial consequences if companies don’t comply. As a result, many companies, with existing LERT teams, now find themselves under increased pressure to act quickly, while companies that do not have a dedicated LERT or legal compliance team face an even steeper path to adopt appropriate procedures and tools that enable them to comply with these new requirements.
In recent years law enforcement has become increasingly dependent on electronic evidence to investigate and prosecute criminal offenses. Today, nearly every crime involves some kind of e-evidence and it’s often very time consuming for authorities trying to access that data. Some friction is necessary, including legal process to ensure the requests are lawful. In some cases, local data protection and privacy laws may instruct companies to deny certain requests.
But the communication process among agencies and with companies should be easy – and the new EU law is catching up to technical realities. With Kodex it’s easy for law enforcement to prove legal process to private companies and for those companies to receive all the information they need upfront to respond quickly to valid requests. Once verified, agencies can submit requests to multiple companies using our platform, track responses, and securely download the provided data.
Emerging laws, like the new e-evidence regulation often introduce new challenges and compliance risks for service providers. Kodex helps companies meet those requirements by providing a way to verify, process, and safely respond to information requests from law enforcement agencies and governments around the world.
If you’re interested in learning more about the Kodex platform, let us know at kodexglobal.com/contact/ or follow us on LinkedIn at Kodex.