New laws in the EU and US aim to address how and when technology companies must turn user data over to law enforcement as digital evidence.
Technology companies are increasingly finding themselves torn between protecting user data privacy and cooperating with law enforcement. The political pressure is mounting. Internationally, the issue is still more complex, as questions arise around crossing national borders to access data residing in cloud networks run by big tech companies like Google, Microsoft and Facebook.
The United States recently passed a law allowing U.S. judges to issue warrants for data held abroad, with the caveat that the company can refuse if the request conflicts with foreign law. When prosecutors and police request electronic evidence of a particularly sensitive nature, such as the content of messages, emails, pictures and videos, they must first obtain approval from a judge.
In the EU, a proposed law would require technology companies to relinquish user data to European law enforcement, regardless of whether it is stored on servers inside or outside the bloc, within a specified timeframe. This is needed, said a European Union executive, because current procedures for obtaining digital evidence between countries can take months. “Electronic evidence is increasingly important in criminal proceedings”, said European Commission Vice-President Frans Timmermans. “We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.”
The issue of inconsistent and sometimes conflicting laws between countries is highly problematic. In the U.S., certain companies cannot disclose information to foreign governments. In Europe, consumer data privacy is strictly protected, particularly with regards to transferring data outside the bloc. Opponents of the EU proposal advocate keeping such restrictions in place. “The Commission is proposing dangerous shortcuts to allow national authorities to obtain people’s data directly from companies, basically turning them into judicial authorities”, said Maryant Fernandez Perez of campaign group European Digital Rights.
The Computer & Communications Industry Association (CCIA), of which Google and Facebook are a part, is not against the EU’s proposed measures. “We welcome today’s proposals, which can help authorities obtain digital evidence more effectively and with more transparency and legal clarity”, said Alexandre Roure, CCIA Europe’s senior manager. However, the group is concerned that the proposal offers only a limited mechanism for addressing the risk to which companies are exposed when caught between conflicting national laws.
Initial steps may soon be taken towards international cooperation, at least between the EU and U.S. The European Commission plans to confer with the U.S. on a deal to help law enforcement authorities seize evidence held on each other’s territories, Reuters reports. “We always think it’s useful to have an EU-U.S. coordinated approach instead of a French-U.S. approach, a Belgian-U.S. approach because that leads to fragmentation”, a Commission official said.