Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings

• CELEX: Regulation (EU) 2023/1543
• Articles: 40

Article 1 Subject matter

1.   This Regulation lays down the rules under which an authority of a Member State, in criminal proceedings, may issue a European Production Order or a European Preservation Order and thereby order a service provider offering services in the Union and established in another Member State, or, if not established, represented by a legal representative in another Member State, to produce or to preserve electronic evidence regardless of the location of the data.

This Regulation is without prejudice to the powers of national authorities to address service providers established or represented on their territory for the purpose of ensuring that they comply with national measures similar to those referred to in the first subparagraph.

2.   The issuing of a European Production Order or of a European Preservation Order may also be requested by a suspect or an accused person, or by a lawyer on that person’s behalf within the framework of applicable defence rights in accordance with national criminal procedural law.

3.   This Regulation shall not have the effect of modifying the obligation to respect the fundamental rights and legal principles as enshrined in the Charter and in Article 6 TEU, and any obligations applicable to law enforcement authorities or judicial authorities in this respect shall remain unaffected. This Regulation applies without prejudice to fundamental principles, in particular the freedom of expression and information, including the freedom and pluralism of the media, respect for private and family life, the protection of personal data, as well as the right to effective judicial protection.

Article 2 Scope

1.   This Regulation applies to service providers which offer services in the Union.

2.   European Production Orders and European Preservation Orders may be issued only in the framework and for the purposes of criminal proceedings, and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice. Such orders may also be issued in proceedings relating to a criminal offence for which a legal person could be held liable or punished in the issuing State.

3.   European Production Orders and European Preservation Orders may be issued only for data pertaining to the services referred to in Article 3, point (3), offered in the Union.

4.   This Regulation does not apply to proceedings initiated for the purpose of providing mutual legal assistance to another Member State or a third country.

Article 3 Definitions

For the purpose of this Regulation, the following definitions apply:

(1)

‘European Production Order’ means a decision ordering the production of electronic evidence, issued or validated by a judicial authority of a Member State in accordance with Article 4(1), (2), (4) and (5), and addressed to a designated establishment or to a legal representative of a service provider offering services in the Union, where that designated establishment or legal representative is located in another Member State bound by this Regulation;

(2)

‘European Preservation Order’ means a decision which orders the preservation of electronic evidence for the purposes of a subsequent request for production, and which is issued or validated by a judicial authority of a Member State in accordance with Article 4(3), (4) and (5), and addressed to a designated establishment or to a legal representative of a service provider offering services in the Union, where that designated establishment or legal representative is located in another Member State bound by this Regulation;

(3)

‘service provider’ means any natural or legal person that provides one or more of the following categories of services, with the exception of financial services as referred to in Article 2(2), point (b), of Directive 2006/123/EC of the European Parliament and of the Council  ( 30 ) :

(a)

electronic communications services as defined in Article 2, point (4), of Directive (EU) 2018/1972;

(b)

internet domain name and IP numbering services, such as IP address assignment, domain name registry, domain name registrar and domain name-related privacy and proxy services;

(c)

other information society services as referred to in Article 1(1), point (b), of Directive (EU) 2015/1535 that:

(i)

enable their users to communicate with each other; or

(ii)

make it possible to store or otherwise process data on behalf of the users to whom the service is provided, provided that the storage of data is a defining component of the service provided to the user;

(4)

‘offering services in the Union’ means:

(a)

enabling natural or legal persons in a Member State to use the services listed in point (3); and

(b)

having a substantial connection, based on specific factual criteria, to the Member State referred to in point (a); such a substantial connection is to be considered to exist where the service provider has an establishment in a Member State, or, in the absence of such an establishment, where there is a significant number of users in one or more Member States, or where there is targeting of activities towards one or more Member States;

(5)

‘establishment’ means an entity that actually pursues an economic activity for an indefinite period through a stable infrastructure from where the business of providing services is carried out or the business is managed;

(6)

‘designated establishment’ means an establishment with legal personality designated in writing by a service provider established in a Member State taking part in a legal instrument referred to in Article 1(2) of Directive (EU) 2023/1544, for the purposes referred to in Article 1(1) and Article 3(1) of that Directive;

(7)

‘legal representative’ means a natural or legal person appointed in writing by a service provider not established in a Member State taking part in a legal instrument referred to in Article 1(2) of Directive (EU) 2023/1544, for the purposes referred to in Article 1(1) and Article 3(1) of that Directive;

(8)

‘electronic evidence’ means subscriber data, traffic data or content data stored by or on behalf of a service provider, in an electronic form, at the time of the receipt of a European Production Order Certificate (EPOC) or of a European Preservation Order Certificate (EPOC-PR);

(9)

‘subscriber data’ means any data held by a service provider relating to the subscription to its services, pertaining to:

(a)

the identity of a subscriber or customer, such as the provided name, date of birth, postal or geographic address, billing and payment data, telephone number, or email address;

(b)

the type of service and its duration, including technical data and data identifying related technical measures or interfaces used by or provided to the subscriber or customer at the moment of initial registration or activation, and data related to the validation of the use of the service, excluding passwords or other authentication means used instead of a password that are provided by a user, or created at the request of a user;

(10)

‘data requested for the sole purpose of identifying the user’ means IP addresses and, where necessary, the relevant source ports and time stamp, namely the date and time, or technical equivalents of those identifiers and related information, where requested by law enforcement authorities or by judicial authorities for the sole purpose of identifying the user in a specific criminal investigation;

(11)

‘traffic data’ means data related to the provision of a service offered by a service provider which serve to provide context or additional information about such service and are generated or processed by an information system of the service provider, such as the source and destination of a message or another type of interaction, the location of the device, date, time, duration, size, route, format, the protocol used and the type of compression, and other electronic communications metadata and data, other than subscriber data, relating to the commencement and termination of a user access session to a service, such as the date and time of use, the log-in to and log-off from the service;

(12)

‘content data’ means any data in a digital format, such as text, voice, videos, images and sound, other than subscriber data or traffic data;

(13)

‘information system’ means an information system as defined in Article 2, point (a), of Directive 2013/40/EU of the European Parliament and of the Council  ( 31 ) ;

(14)

‘issuing State’ means the Member State in which the European Production Order or the European Preservation Order is issued;

(15)

‘issuing authority’ means the competent authority in the issuing State, which, in accordance with Article 4, can issue a European Production Order or a European Preservation Order;

(16)

‘enforcing State’ means the Member State in which the designated establishment is established or the legal representative resides and to which a European Production Order and an EPOC or a European Preservation Order and an EPOC-PR are transmitted by the issuing authority for notification or for enforcement in accordance with this Regulation;

(17)

‘enforcing authority’ means the authority in the enforcing State, which, in accordance with the national law of that State, is competent to receive a European Production Order and an EPOC or a European Preservation Order and an EPOC-PR transmitted by the issuing authority for notification or for enforcement in accordance with this Regulation;

(18)

‘emergency case’ means a situation in which there is an imminent threat to the life, physical integrity or safety of a person, or to a critical infrastructure, as defined in Article 2, point (a), of Directive 2008/114/EC, where the disruption or destruction of such critical infrastructure would result in an imminent threat to the life, physical integrity or safety of a person, including through serious harm to the provision of basic supplies to the population or to the exercise of the core functions of the State;

(19)

‘controller’ means controller as defined in Article 4, point (7), of Regulation (EU) 2016/679;

(20)

‘processor’ means processor as defined in Article 4, point (8), of Regulation (EU) 2016/679;

(21)

‘decentralised IT system’ means a network of IT systems and interoperable access points, operating under the individual responsibility and management of each Member State, Union agency or body, which enables the cross-border exchange of information to take place in a secure and reliable manner.

Article 4 Issuing authority

1.   A European Production Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user, as defined in Article 3, point (10), may be issued only by:

(a)

a judge, a court, an investigating judge or a public prosecutor competent in the case concerned; or

(b)

any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Production Order shall be validated, after examination of its conformity with the conditions for issuing a European Production Order under this Regulation, by a judge, a court, an investigating judge or a public prosecutor in the issuing State.

2.   A European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data may be issued only by:

(a)

a judge, a court or an investigating judge competent in the case concerned; or

(b)

any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Production Order shall be validated, after examination of its conformity with the conditions for issuing a European Production Order under this Regulation, by a judge, a court or an investigating judge in the issuing State.

3.   A European Preservation Order for data of any category may be issued only by:

(a)

a judge, a court, an investigating judge or a public prosecutor competent in the case concerned; or

(b)

any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Preservation Order shall be validated, after examination of its conformity with the conditions for issuing a European Preservation Order under this Regulation, by a judge, a court, an investigating judge or a public prosecutor in the issuing State.

4.   Where a European Production Order or a European Preservation Order has been validated by a judicial authority pursuant to paragraph 1, point (b), paragraph 2, point (b), or paragraph 3, point (b), that authority may also be regarded as an issuing authority for the purposes of transmission of the EPOC and the EPOC-PR.

5.   In a validly established emergency case, as defined in Article 3, point (18), the competent authorities referred to in paragraph 1, point (b), and in paragraph 3, point (b), of this Article may exceptionally issue a European Production Order for subscriber data or for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or a European Preservation Order, without prior validation of the order concerned, where validation cannot be obtained in time and where those authorities could issue an order in a similar domestic case without prior validation. The issuing authority shall seek ex post validation of the order concerned without undue delay, at the latest within 48 hours. Where such ex post validation of the order concerned is not granted, the issuing authority shall withdraw the order immediately and shall delete or otherwise restrict the use of any data that were obtained.

6.   Each Member State may designate one or more central authorities to be responsible for the administrative transmission of EPOCs and EPOC-PRs, of European Production Orders and European Preservation Orders and of notifications, and for the receipt of data and notifications as well as for the transmission of other official correspondence relating to such certificates or orders.

Article 5 Conditions for issuing a European Production Order

1.   An issuing authority may only issue a European Production Order where the conditions set out in this Article are fulfilled.

2.   A European Production Order shall be necessary for and proportionate to the purpose of the proceedings referred to in Article 2(3), taking into account the rights of the suspect or the accused person, and may only be issued if a similar order could have been issued under the same conditions in a similar domestic case.

3.   A European Production Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user as defined in Article 3, point (10), may be issued for all criminal offences and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

4.   A European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), of this Regulation or to obtain content data shall only be issued:

(a)

for criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least three years; or

(b)

for the following offences, if they are wholly or partly committed by means of an information system:

(i)

offences as defined in Articles 3 to 8 of Directive (EU) 2019/713 of the European Parliament and of the Council  ( 32 ) ;

(ii)

offences as defined in Articles 3 to 7 of Directive 2011/93/EU;

(iii)

offences as defined in Articles 3 to 8 of Directive 2013/40/EU;

(c)

for criminal offences as defined in Articles 3 to 12 and 14 of Directive (EU) 2017/541;

(d)

for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice, for criminal offences referred to in points (a), (b) and (c) of this paragraph.

5.   A European Production Order shall include the following information:

(a)

the issuing authority and, where applicable, the validating authority;

(b)

the addressee of the European Production Order as referred to in Article 7;

(c)

the user, except where the sole purpose of the order is to identify the user, or any other unique identifier such as user name, login ID or account name to determine the data that are being requested;

(d)

the requested data category as defined in Article 3, points (9) to (12);

(e)

if applicable, the time range of the data for which production is requested;

(f)

the applicable provisions of the criminal law of the issuing State;

(g)

in emergency cases as defined in Article 3, point (18), the duly justified reasons for the emergency;

(h)

in cases where the European Production Order is directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, a confirmation that the conditions set out in paragraph 6 of this Article are met;

(i)

the grounds for determining that the European Production Order fulfils the conditions of necessity and proportionality under paragraph 2 of this Article;

(j)

a summary description of the case.

6.   A European Production Order shall be addressed to the service provider acting as controller in accordance with Regulation (EU) 2016/679.

By way of exception, the European Production Order may be directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, where:

(a)

the controller cannot be identified despite reasonable efforts on the part of the issuing authority; or

(b)

addressing the controller might be detrimental to the investigation.

7.   In accordance with Regulation (EU) 2016/679, the processor that stores or otherwise processes the data on behalf of the controller shall inform the controller about the production of the data unless the issuing authority has requested the service provider to refrain from informing the controller, for as long as necessary and proportionate, in order not to obstruct the relevant criminal proceedings. In that case, the issuing authority shall indicate in the case file the reasons for the delay in informing the controller. A short justification shall also be added in the EPOC.

8.   Where the data are stored or otherwise processed as part of an infrastructure provided by a service provider to a public authority, a European Production Order may only be issued where the public authority for which the data are stored or otherwise processed is located in the issuing State.

9.   In cases where data protected by professional privilege under the law of the issuing State are stored or otherwise processed by a service provider as part of an infrastructure provided to professionals covered by professional privilege (‘privileged professional’), in their business capacity, a European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data may only be issued:

(a)

where the privileged professional resides in the issuing State;

(b)

where addressing the privileged professional might be detrimental to the investigation; or

(c)

where the privileges were waived in accordance with the applicable law.

10.   If the issuing authority has reasons to believe that the traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data requested by the European Production Order are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press or freedom of expression in other media, the issuing authority may seek clarification before issuing the European Production Order, including by consulting the competent authorities of the enforcing State, either directly or via Eurojust or the European Judicial Network.

The issuing authority shall not issue a European Production Order if it finds that the requested traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press and freedom of expression in other media.

Article 6 Conditions for issuing a European Preservation Order

1.   An issuing authority may only issue a European Preservation Order where the conditions set out in this Article are fulfilled. Article 5(8) shall apply mutatis mutandis .

2.   A European Preservation Order shall be necessary for and proportionate to the purpose of preventing the removal, deletion or alteration of data with a view to issuing a subsequent request for production of those data via mutual legal assistance, a European Investigation Order (EIO) or a European Production Order, taking into account the rights of the suspect or the accused person.

3.   A European Preservation Order may be issued for all criminal offences, if it could have been issued under the same conditions in a similar domestic case, and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

4.   A European Preservation Order shall include the following information:

(a)

the issuing authority and, where applicable, the validating authority;

(b)

the addressee of the European Preservation Order as referred to in Article 7;

(c)

the user, except where the sole purpose of the order is to identify the user, or any other unique identifier such as user name, login ID or account name to determine the data for which preservation is requested;

(d)

the requested data category as defined in Article 3, points (9) to (12);

(e)

if applicable, the time range of the data for which preservation is requested;

(f)

the applicable provisions of the criminal law of the issuing State;

(g)

the grounds for determining that the European Preservation Order fulfils the conditions of necessity and proportionality under paragraph 2 of this Article.

Article 7 Addressees of European Production Orders and European Preservation Orders

1.   European Production Orders and European Preservation Orders shall be addressed directly to a designated establishment or to a legal representative of the service provider concerned.

2.   Exceptionally, in emergency cases as defined in Article 3, point (18), where the designated establishment or the legal representative of a service provider does not react to an EPOC or an EPOC-PR within the deadlines, that EPOC or EPOC-PR may be addressed to any other establishment or legal representative of the service provider in the Union.

Article 8 Notification to the enforcing authority

1.   Where a European Production Order is issued to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data, the issuing authority shall notify the enforcing authority by transmitting the EPOC to that authority at the same time as it transmits the EPOC to the addressee in accordance with Article 9(1) and (2).

2.   Paragraph 1 shall not apply if, at the time of issuing the order, the issuing authority has reasonable grounds to believe that:

(a)

the offence has been committed, is being committed or is likely to be committed in the issuing State; and

(b)

the person whose data are requested resides in the issuing State.

3.   When transmitting the EPOC as referred to in paragraph 1 of this Article to the enforcing authority, the issuing authority shall, where appropriate, include any additional information that could be needed for the evaluation of the possibility of raising a ground for refusal in accordance with Article 12.

4.   The notification to the enforcing authority referred to in paragraph 1 of this Article shall have a suspensive effect on the obligations of the addressee as set out in Article 10(2), except in emergency cases as defined in Article 3, point (18).

Article 9 European Production Order Certificate (EPOC) and European Preservation Order Certificate (EPOC-PR)

1.   A European Production Order or a European Preservation Order shall be transmitted to the addressee as defined in Article 7, through an EPOC or through an EPOC-PR.

The issuing authority or, where applicable, the validating authority shall complete the EPOC set out in Annex I or the EPOC-PR set out in Annex II, shall sign it and shall certify that its content is accurate and correct.

2.   An EPOC shall contain the information listed in Article 5(5), points (a) to (h), including sufficient information to allow the addressee to identify and contact the issuing authority and the enforcing authority, if necessary.

Where a notification to the enforcing authority is required pursuant to Article 8, the EPOC transmitted to that authority shall contain the information listed in Article 5(5), points (a) to (j).

3.   An EPOC-PR shall contain the information listed in Article 6(4), points (a) to (f), including sufficient information to allow the addressee to identify and contact the issuing authority.

4.   Where needed, the EPOC or the EPOC-PR shall be translated into an official language of the Union accepted by the addressee as provided for in Article 4 of Directive (EU) 2023/1544. Where no language has been specified by the service provider, the EPOC or the EPOC-PR shall be translated into an official language of the Member State where the designated establishment or the legal representative of the service provider is located.

Where a notification to the enforcing authority is required pursuant to Article 8, the EPOC to be transmitted to that authority shall be translated into an official language of the enforcing State or into another official language of the Union accepted by that State.

Article 10 Execution of an EPOC

1.   Upon receipt of an EPOC, the addressee shall act expeditiously to preserve the data requested.

2.   Where a notification to the enforcing authority is required pursuant to Article 8 and that authority has not raised any ground for refusal in accordance with Article 12 within 10 days following receipt of the EPOC, the addressee shall ensure that the requested data are transmitted directly to the issuing authority or the law enforcement authorities, as indicated in the EPOC, at the end of that 10-day period. Where the enforcing authority already before the end of that 10-day period confirms to the issuing authority and the addressee that it will not raise any ground for refusal, the addressee shall act as soon as possible upon such confirmation and at the latest at the end of that 10-day period.

3.   Where a notification to the enforcing authority is not required pursuant to Article 8, upon receipt of an EPOC, the addressee shall ensure that the requested data are transmitted directly to the issuing authority or the law enforcement authorities, as indicated in the EPOC, at the latest within 10 days following receipt of the EPOC.

4.   In emergency cases, the addressee shall transmit the requested data without undue delay, at the latest within eight hours following receipt of the EPOC. Where a notification to the enforcing authority is required pursuant to Article 8, the enforcing authority may, if it decides to raise a ground for refusal in accordance with Article 12(1), without delay and at the latest within 96 hours following receipt of the notification, notify the issuing authority and the addressee that it objects to the use of the data or that the data may only be used under conditions which it shall specify. Where a ground for refusal is raised by the enforcing authority, if the data have already been transmitted by the addressee to the issuing authority, the issuing authority shall delete or otherwise restrict the use of the data or, in the event that the enforcing authority has specified conditions, the issuing authority shall comply with those conditions when using the data.

5.   Where the addressee considers, based solely on the information contained in the EPOC, that the execution of the EPOC could interfere with immunities or privileges, or with rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, under the law of the enforcing State, the addressee shall inform the issuing authority and the enforcing authority using the form set out in Annex III.

Where no notification to the enforcing authority took place pursuant to Article 8, the issuing authority shall take the information referred to in the first subparagraph of this paragraph into account, and shall decide, on its own initiative or at the request of the enforcing authority, whether to withdraw, adapt or maintain the European Production Order.

Where a notification to the enforcing authority took place pursuant to Article 8, the issuing authority shall take the information referred to in the first subparagraph of this paragraph into account, and shall decide whether to withdraw, adapt or maintain the European Production Order. The enforcing authority may decide to raise the grounds for refusal set out in Article 12.

6.   Where the addressee cannot comply with its obligation to produce the requested data because the EPOC is incomplete, contains manifest errors or does not contain sufficient information to execute the EPOC, the addressee shall, without undue delay, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, and seek clarification, using the form set out in Annex III. At the same time, the addressee shall inform the issuing authority of whether identification of the data requested and preservation of those data as set out in paragraph 9 of this Article was possible.

The issuing authority shall react expeditiously and at the latest within five days following receipt of the form. The addressee shall ensure that it can receive the necessary clarification or any correction provided by the issuing authority, in order for the addressee to fulfil its obligations set out in paragraphs 1 to 4. The obligations set out in paragraphs 1 to 4 shall not apply until such clarification or correction is provided by the issuing authority or the enforcing authority.

7.   Where the addressee cannot comply with its obligation to produce the requested data because of a de facto impossibility due to circumstances not attributable to the addressee, the addressee shall, without undue delay, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, explaining the reasons for such a de facto impossibility, using the form set out in Annex III. Where the issuing authority concludes that there is such a de facto impossibility, it shall inform the addressee, and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority, that the EPOC no longer needs to be executed.

8.   In all cases where the addressee does not provide the requested data, does not provide the requested data exhaustively or does not provide the requested data within the specified deadline, for reasons other than those referred to in paragraphs 5, 6 and 7 of this Article, the addressee shall, without undue delay and at the latest within the deadlines set out in paragraphs 2, 3 and 4 of this Article, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, of those reasons using the form set out in Annex III. The issuing authority shall review the European Production Order in light of the information provided by the addressee and, if necessary, set a new deadline for the addressee to produce the data.

9.   The data shall be preserved, to the extent possible, until they are produced, irrespective of whether the production is ultimately requested on the basis of a clarified European Production Order and its EPOC or through other channels, such as mutual legal assistance, or until the European Production Order is withdrawn.

Where the production of data and their preservation are no longer necessary, the issuing authority and, where applicable pursuant to Article 16(8), the enforcing authority shall inform the addressee without undue delay.

Article 11 Execution of an EPOC-PR

1.   Upon receipt of an EPOC-PR, the addressee shall, without undue delay, preserve the data requested. The obligation to preserve the data shall cease after 60 days, unless the issuing authority confirms, using the form set out in Annex V, that a subsequent request for production has been issued. During that 60-day period, the issuing authority may, using the form set out in Annex VI, extend the duration of the obligation to preserve the data by an additional 30-day period, where necessary to allow for the issuing of a subsequent request for production.

2.   Where, during the period of preservation set out in paragraph 1, the issuing authority confirms that a subsequent request for production has been issued, the addressee shall preserve the data as long as necessary to produce the data once the subsequent request for production is received.

3.   Where the preservation is no longer necessary, the issuing authority shall inform the addressee without undue delay and the obligation to preserve on the basis of the relevant European Preservation Order shall cease.

4.   Where the addressee considers, based solely on the information contained in the EPOC-PR, that the execution of the EPOC-PR could interfere with immunities or privileges, or with rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, under the law of the enforcing State, the addressee shall inform the issuing authority and the enforcing authority using the form set out in Annex III.

The issuing authority shall take the information referred to in the first subparagraph into account, and shall decide, on its own initiative or at the request of the enforcing authority, whether to withdraw, adapt or maintain the European Preservation Order.

5.   Where the addressee cannot comply with its obligation to preserve the requested data because the EPOC-PR is incomplete, contains manifest errors or does not contain sufficient information to execute the EPOC-PR, the addressee shall, without undue delay, inform the issuing authority referred to in the EPOC-PR and seek clarification, using the form set out in Annex III.

The issuing authority shall react expeditiously and at the latest within five days of the receipt of the form. The addressee shall ensure that it can receive the necessary clarification or any correction provided by the issuing authority in order for the addressee to fulfil its obligations set out in paragraphs 1, 2 and 3. In the absence of a reaction from the issuing authority within the five-day period, the service provider shall be exempt from the obligations set out in paragraphs 1 and 2.

6.   Where the addressee cannot comply with its obligation to preserve the requested data because of a de facto impossibility due to circumstances not attributable to the addressee, the addressee shall, without undue delay, inform the issuing authority referred to in the EPOC-PR explaining the reasons for such de facto impossibility, using the form set out in Annex III. Where the issuing authority concludes that such impossibility does exist, it shall inform the addressee that the EPOC-PR no longer needs to be executed.

7.   In all cases where the addressee does not preserve the requested data, for reasons other than those referred to in paragraphs 4, 5 and 6, the addressee shall, without undue delay, inform the issuing authority of those reasons, using the form set out in Annex III. The issuing authority shall review the European Preservation Order in light of the justification provided by the addressee.

Article 12 Grounds for refusal of European Production Orders

1.   Where the issuing authority has notified the enforcing authority pursuant to Article 8, and without prejudice to Article 1(3), the enforcing authority shall, as soon as possible but at the latest within 10 days following receipt of the notification, or, in emergency cases, at the latest within 96 hours following such receipt, assess the information set out in the order and, where appropriate, raise one or more of the following grounds for refusal:

(a)

the data requested are protected by immunities or privileges granted under the law of the enforcing State which prevent the execution or enforcement of the order, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent the execution or enforcement of the order;

(b)

in exceptional situations, there are substantial grounds to believe, on the basis of specific and objective evidence, that the execution of the order would, in the particular circumstances of the case, entail a manifest breach of a relevant fundamental right as set out in Article 6 TEU and in the Charter;

(c)

the execution of the order would be contrary to the principle of ne bis in idem ;

(d)

the conduct for which the order has been issued does not constitute an offence under the law of the enforcing State, unless it concerns an offence listed within the categories of offences set out in Annex IV, as indicated by the issuing authority in the EPOC, if it is punishable in the issuing State by a custodial sentence or a detention order for a maximum period of at least three years.

2.   Where the enforcing authority raises a ground for refusal pursuant to paragraph 1, it shall inform the addressee and the issuing authority. The addressee shall stop the execution of the European Production Order and not transfer the data, and the issuing authority shall withdraw the order.

3.   Before deciding to raise a ground for refusal, the enforcing authority notified pursuant to Article 8 shall contact the issuing authority by any appropriate means, in order to discuss the appropriate measures to take. On that basis, the issuing authority may decide to adapt or to withdraw the European Production Order. Where, following such discussions, no solution is reached, the enforcing authority notified pursuant to Article 8 may decide to raise grounds for refusal of the European Production Order and inform the issuing authority and the addressee accordingly.

4.   Where the enforcing authority decides to raise grounds for refusal pursuant to paragraph 1, it may indicate whether it objects to the transfer of all data requested in the European Production Order or whether the data may only be partly transferred or used under conditions specified by the enforcing authority.

5.   Where the power to waive the immunity or privilege as set out in paragraph 1, point (a), of this Article, lies with an authority of the enforcing State, the issuing authority may request the enforcing authority notified pursuant to Article 8 to contact that authority of the enforcing State to request it to exercise that power without delay. Where the power to waive the immunity or privilege lies with an authority of another Member State or a third country or with an international organisation, the issuing authority may request the authority concerned to exercise that power.

Article 13 User information and confidentiality

1.   The issuing authority shall, without undue delay, inform the person whose data are being requested about the production of data on the basis of a European Production Order.

2.   The issuing authority may, in accordance with the national law of the issuing State, delay or restrict informing, or omit to inform, the person whose data are being requested, to the extent that, and for as long as, the conditions in Article 13(3) of Directive (EU) 2016/680 are met, in which case the issuing authority shall indicate in the case file the reasons for the delay, restriction or omission. A short justification shall also be added in the EPOC.

3.   When informing the person whose data are being requested as referred to in paragraph 1 of this Article, the issuing authority shall include information about available remedies pursuant to Article 18.

4.   The addressees and, if different, the service providers shall take the necessary state-of-the-art operational and technical measures to ensure the confidentiality, secrecy and integrity of the EPOC or the EPOC-PR and of the data produced or preserved.

Article 14 Reimbursement of costs

1.   The service provider may claim reimbursement of its costs from the issuing State, if that possibility is provided for in the national law of the issuing State for domestic orders in similar situations, in accordance with the national law of that State. Member States shall inform the Commission about their national rules for reimbursement, and the Commission shall make them public.

2.   This Article shall not apply to the reimbursement of costs of the decentralised IT system as referred to in Article 25.

Article 15 Penalties

1.   Without prejudice to national laws providing for the imposition of criminal penalties, Member States shall lay down rules on pecuniary penalties applicable to infringements of Articles 10 and 11 and Article 13(4), in accordance with Article 16(10), and shall take all measures necessary to ensure that they are implemented. The pecuniary penalties provided for shall be effective, proportionate and dissuasive. Member States shall ensure that pecuniary penalties of up to 2 % of the total worldwide annual turnover of the service provider’s preceding financial year can be imposed. Member States shall, without delay, notify the Commission of those rules and of those measures, and shall notify it, without delay, of any subsequent amendment affecting them.

2.   Without prejudice to data protection obligations, service providers shall not be held liable in Member States for prejudice caused to their users or third parties that exclusively results from compliance in good faith with an EPOC or an EPOC-PR.

Article 16 Procedure for enforcement

1.   Where the addressee does not comply with an EPOC within the deadline or with an EPOC-PR, without providing reasons accepted by the issuing authority, and, if applicable, where the enforcing authority has not invoked any of the grounds for refusal as provided for in Article 12, the issuing authority may request the enforcing authority to enforce the European Production Order or the European Preservation Order.

For the purpose of enforcement as referred to in the first subparagraph, the issuing authority shall transfer the order concerned, the form set out in Annex III as completed by the addressee, and any relevant document in accordance with Article 19. The issuing authority shall translate the order concerned and any document to be transferred into one of the languages accepted by the enforcing State and shall inform the addressee of the transfer.

2.   Upon receipt, the enforcing authority shall without further formalities recognise and take the necessary measures for enforcement of:

(a)

a European Production Order, unless the enforcing authority considers that one of the grounds provided for in paragraph 4 applies; or

(b)

a European Preservation Order, unless the enforcing authority considers that one of the grounds provided for in paragraph 5 applies.

The enforcing authority shall take the decision on the recognition of the order concerned without undue delay and no later than five working days after the receipt of that order.

3.   The enforcing authority shall formally require the addressee to comply with their relevant obligations, and shall inform the addressee of the following:

(a)

the possibility of objecting to the execution of the order concerned by invoking one or more of the grounds listed in paragraph 4, points (a) to (f), or in paragraph 5, points (a) to (e);

(b)

the applicable penalties in the event of non-compliance; and

(c)

the deadline for compliance or objection.

4.   Enforcement of the European Production Order may only be denied on the basis of one or more of the following grounds:

(a)

the European Production Order has not been issued or validated by an issuing authority as provided for in Article 4;

(b)

the European Production Order has not been issued for an offence provided for in Article 5(4);

(c)

the addressee could not comply with the EPOC because of a de facto impossibility due to circumstances not attributable to the addressee, or because the EPOC contains manifest errors;

(d)

the European Production Order does not concern data stored by or on behalf of the service provider at the time of receipt of the EPOC;

(e)

the service is not covered by this Regulation;

(f)

the data requested are protected by immunities or privileges granted under the law of the enforcing State, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent execution or enforcement of the European Production Order;

(g)

in exceptional situations, based on the sole information contained in the EPOC, it is apparent that there are substantial grounds to believe, on the basis of specific and objective evidence, that the execution of the European Production Order would, in the particular circumstances of the case, entail a manifest breach of a relevant fundamental right as set out in Article 6 TEU and the Charter.

5.   The enforcement of the European Preservation Order may only be denied on the basis of one or more of the following grounds:

(a)

the European Preservation Order has not been issued or validated by an issuing authority as provided for in Article 4;

(b)

the addressee could not comply with the EPOC-PR because of a de facto impossibility due to circumstances not attributable to the addressee, or because the EPOC-PR contains manifest errors;

(c)

the European Preservation Order does not concern data stored by or on behalf of the service provider at the time of receipt of the EPOC-PR;

(d)

the service is not covered by the scope of this Regulation;

(e)

the data requested are protected by immunities or privileges granted under the law of the enforcing State, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent execution or enforcement of the European Preservation Order;

(f)

in exceptional situations, based on the sole information contained in the EPOC-PR, it is apparent that there are substantial grounds to believe, on the basis of specific and objective evidence, that the execution of the European Preservation Order would, in the particular circumstances of the case, entail a manifest breach of a relevant fundamental right as set out in Article 6 TEU and the Charter.

6.   In the event of an objection by the addressee as referred to in paragraph 3, point (a), the enforcing authority shall decide whether or not to enforce the European Production Order or the European Preservation Order on the basis of any information provided by the addressee and, if necessary, supplementary information obtained from the issuing authority in accordance with paragraph 7.

7.   Before deciding not to recognise or not to enforce the European Production Order or the European Preservation Order in accordance with paragraph 2 or 6, respectively, the enforcing authority shall consult the issuing authority by any appropriate means. Where appropriate, it shall request further information from the issuing authority. The issuing authority shall reply to any such request within five working days.

8.   The enforcing authority shall notify all of its decisions immediately to the issuing authority and to the addressee.

9.   If the enforcing authority obtains the data requested by a European Production Order from the addressee, it shall transmit those data to the issuing authority without undue delay.

10.   Where the addressee does not comply with its obligations under a recognised European Production Order or European Preservation Order the enforceability of which has been confirmed by the enforcing authority, that authority shall impose a pecuniary penalty in accordance with Article 15. An effective judicial remedy shall be available against a decision to impose a pecuniary penalty.

Article 17 Review procedure in the event of conflicting obligations

1.   Where an addressee considers that compliance with a European Production Order would conflict with an obligation under the applicable law of a third country, it shall inform the issuing authority and the enforcing authority of its reasons for not executing the European Production Order, in accordance with the procedure set out in Article 10(8) and (9) using the form set out in Annex III (‘the reasoned objection’).

2.   The reasoned objection shall include all relevant details on the law of the third country, its applicability to the case at hand and the nature of the conflicting obligation. The reasoned objection shall not be based on:

(a)

the fact that similar provisions concerning the conditions, formalities and procedures for issuing an order for production do not exist in the applicable law of the third country; or

(b)

the sole fact that the data are stored in a third country.

The reasoned objection shall be filed no later than 10 days after the date on which the addressee received the EPOC.

3.   The issuing authority shall review the European Production Order on the basis of the reasoned objection and any input provided by the enforcing State. Where the issuing authority intends to uphold the European Production Order, it shall request a review by the competent court of the issuing State. The execution of the European Production Order shall be suspended pending completion of the review procedure.

4.   The competent court shall first assess whether a conflict of obligations exists, based on an examination of whether:

(a)

the law of the third country is applicable based on the specific circumstances of the case in question; and

(b)

the law of the third country, if applicable as referred to in point (a), prohibits disclosure of the data concerned when applied to the specific circumstances of the case in question.

5.   Where the competent court finds that no relevant conflict of obligations within the meaning of paragraphs 1 and 4 exists, it shall uphold the European Production Order.

6.   Where the competent court establishes, based on the examination pursuant to paragraph 4, point (b), that the law of the third country prohibits disclosure of the data concerned, the competent court shall determine whether to uphold or lift the European Production Order. That assessment shall in particular be based on the following factors, while giving particular weight to the factors referred to in points (a) and (b):

(a)

the interest protected by the relevant law of the third country, including fundamental rights as well as other fundamental interests preventing disclosure of the data, in particular national security interests of the third country;

(b)

the degree of connection between the criminal case for which the European Production Order was issued and either of the two jurisdictions, as indicated inter alia by:

(i)

the location, nationality and place of residence of the person whose data are being requested or of the victim or victims of the criminal offence in question;

(ii)

the place where the criminal offence in question was committed;

(c)

the degree of connection between the service provider and the third country in question; in this context, the data storage location alone shall not suffice for the purpose of establishing a substantial degree of connection;

(d)

the interests of the investigating State in obtaining the evidence concerned, based on the seriousness of the offence and the importance of obtaining evidence in an expeditious manner;

(e)

the possible consequences for the addressee or for the service provider of complying with the European Production Order, including the potential penalties.

7.   The competent court may request information from the competent authority of the third country, taking into account Directive (EU) 2016/680, in particular Chapter V thereof, and to the extent that such request does not obstruct the relevant criminal proceedings. Information shall, in particular, be requested from the competent authority of the third country by the issuing State where the conflict of obligations concerns fundamental rights or other fundamental interests of the third country related to national security and defence.

8.   If the competent court decides to lift the European Production Order, it shall inform the issuing authority and the addressee. If the competent court determines that the European Production Order is to be upheld, it shall inform the issuing authority and the addressee, and that addressee shall proceed with the execution of the European Production Order.

9.   For the purposes of the procedures under this Article, the time limits shall be calculated in accordance with the national law of the issuing authority.

10.   The issuing authority shall inform the enforcing authority about the outcome of the review procedure.

Article 18 Effective remedies

1.   Without prejudice to further legal remedies available in accordance with national law, any person whose data were requested via a European Production Order shall have the right to effective remedies against that order. Where that person is a suspect or an accused person, such person shall have the right to effective remedies during the criminal proceedings in which the data were being used. The right to effective remedies referred to in this paragraph shall be without prejudice to the right to seek remedies under Regulation (EU) 2016/679 and Directive (EU) 2016/680.

2.   The right to effective remedies shall be exercised before a court in the issuing State in accordance with its national law and shall include the possibility of challenging the legality of the measure, including its necessity and proportionality, without prejudice to the guarantees of fundamental rights in the enforcing State.

3.   For the purposes of Article 13(1), information shall be provided in due time about the possibilities under national law for seeking remedies and it shall be ensured that they can be exercised effectively.

4.   The same time limits or other conditions for seeking remedies in similar domestic cases shall apply for the purposes of this Regulation and in a way that guarantees that the persons concerned can exercise their right to those remedies effectively.

5.   Without prejudice to national procedural rules, the issuing State and any other Member State to which electronic evidence has been transmitted under this Regulation shall ensure that the rights of defence and fairness of the proceedings are respected when assessing evidence obtained through the European Production Order.

Article 19 Secure digital communication and data exchange between competent authorities and service providers and between competent authorities

1.   Written communication between competent authorities and designated establishments or legal representatives under this Regulation, including the exchange of forms provided for in this Regulation and the data requested under a European Production Order or a European Preservation Order, shall be carried out through a secure and reliable decentralised IT system (‘the decentralised IT system’).

2.   Each Member State shall ensure that the designated establishments or legal representatives of service providers located in that Member State are provided with access to the decentralised IT system via their respective national IT system.

3.   Service providers shall ensure that their designated establishments or legal representatives can use the decentralised IT system via the respective national IT system in order to receive EPOCs and EPOC-PRs, send the requested data to the issuing authority and communicate in any other way with the issuing authority and the enforcing authority, as provided for in this Regulation.

4.   Written communication between competent authorities under this Regulation, including the exchange of forms provided for in this Regulation, and of the requested data under the procedure for enforcement as provided for in Article 16, as well as written communication with competent Union agencies or bodies, shall be carried out through the decentralised IT system.

5.   Where communication through the decentralised IT system in accordance with paragraph 1 or 4 is not possible due to, for instance, the disruption of the decentralised IT system, the nature of the transmitted material, technical limitations, such as data size, legal constraints relating to the admissibility as evidence of the requested data or to forensic requirements applicable to the requested data, or exceptional circumstances, the transmission shall be carried out by the most appropriate alternative means, taking into account the need to ensure an exchange of information which is swift, secure and reliable, and allows the recipient to establish authenticity.

6.   Where a transmission is carried out by alternative means as provided for in paragraph 5, the originator of the transmission shall record the transmission, including, as appropriate, the date and time of transmission, the sender and recipient, the file name and its size, in the decentralised IT system, without undue delay.

Article 20 Legal effects of electronic documents

Documents transmitted as part of electronic communication shall not be denied legal effect or be considered inadmissible in the context of cross-border judicial procedures under this Regulation solely on the ground that they are in electronic form.

Article 21 Electronic signatures and seals

1.   The general legal framework for the use of trust services set out in Regulation (EU) No 910/2014 shall apply to electronic communication under this Regulation.

2.   Where a document transmitted as part of the electronic communication under Article 19(1) or (4) of this Regulation requires a seal or a signature in accordance with this Regulation, the document shall feature a qualified electronic seal or qualified electronic signature as defined in Regulation (EU) No 910/2014.

Article 22 Reference implementation software

1.   The Commission shall be responsible for the creation, maintenance and development of reference implementation software which Member States may choose to apply as their back-end system instead of a national IT system. The creation, maintenance and development of the reference implementation software shall be financed from the general budget of the Union.

2.   The Commission shall provide, maintain and support the reference implementation software free of charge.

Article 23 Costs of the decentralised IT system

1.   Each Member State shall bear the costs of the installation, operation and maintenance of the access points of the decentralised IT system for which that Member State is responsible.

2.   Each Member State shall bear the costs of establishing and adjusting its relevant national IT systems to make them interoperable with the access points, and shall bear the costs of administering, operating and maintaining those systems.

3.   Union agencies and bodies shall bear the costs of the installation, operation and maintenance of the components comprising the decentralised IT system under their responsibility.

4.   Union agencies and bodies shall bear the costs of establishing and adjusting their case-management systems to make them interoperable with the access points, and shall bear the costs of administering, operating and maintaining those systems.

5.   Service providers shall bear all costs necessary in order for them to successfully integrate or otherwise interact with the decentralised IT system.

Article 24 Transition period

Before the obligation to carry out written communication through the decentralised IT system referred to in Article 19 becomes applicable (‘transition period’), the written communication between competent authorities and designated establishments or legal representatives under this Regulation shall take place by the most appropriate alternative means, taking into account the need to ensure a swift, secure and reliable exchange of information. Where service providers, Member States or Union agencies or bodies have established dedicated platforms or other secure channels for the handling of requests for data by law enforcement authorities and judicial authorities, issuing authorities may also choose to transmit an EPOC or an EPOC-PR via those channels to designated establishments or legal representatives during the transition period.

Article 25 Implementing acts

1.   The Commission shall adopt implementing acts necessary for the establishment and use of the decentralised IT system for the purposes of this Regulation, setting out the following:

(a)

the technical specifications defining the methods of communication by electronic means for the purposes of the decentralised IT system;

(b)

the technical specifications for communication protocols;

(c)

the information security objectives and relevant technical measures ensuring minimum information security standards and a high level of cybersecurity for the processing and communication of information within the decentralised IT system;

(d)

the minimum availability objectives and possible related technical requirements for the services provided by the decentralised IT system.

2.   The implementing acts referred to in paragraph 1 of this Article shall be adopted in accordance with the examination procedure referred to in Article 26.

3.   The implementing acts referred to in paragraph 1 shall be adopted by 18 August 2025.

Article 26 Committee procedure

1.   The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

Article 27 Languages

Each Member State may decide, at any time, that it will accept translations of EPOCs and EPOC-PRs in one or more official languages of the Union in addition to their official language or languages, and shall indicate such a decision in a written declaration submitted to the Commission. The Commission shall make the declarations available to all Member States and to the European Judicial Network.

Article 28 Monitoring and reporting

1.   By 18 August 2026, the Commission shall establish a detailed programme for monitoring the outputs, results and impacts of this Regulation. The monitoring programme shall set out the means by which and the intervals at which the data will be collected. It shall specify the action to be taken by the Commission and by the Member States in collecting and analysing the data.

2.   In any event, from 18 August 2026, Member States shall collect from the relevant authorities comprehensive statistics and keep a record of such statistics. The data collected for the preceding calendar year shall be sent to the Commission each year by 31 March, and shall include:

(a)

the number of EPOCs and EPOC-PRs issued, by the type of data requested, the addressees and the situation (emergency case or not);

(b)

the number of EPOCs issued under emergency case derogations;

(c)

the number of fulfilled and non-fulfilled EPOCs and EPOC-PRs, by the type of data requested, the addressees and the situation (emergency case or not);

(d)

the number of notifications to enforcing authorities pursuant to Article 8, and the number of EPOCs that were refused, by the type of data requested, the addressees, the situation (emergency case or not) and the ground for refusal raised;

(e)

for fulfilled EPOCs, the average period between the moment the EPOC was issued and the moment the data requested were obtained, by the type of data requested, the addressees and the situation (emergency case or not);

(f)

for fulfilled EPOC-PRs, the average period between the moment the EPOC-PR was issued and the moment the subsequent request for production was issued, by the type of data requested and the addressees;

(g)

the number of European Production Orders or European Preservation Orders transmitted to and received by an enforcing State for enforcement, by the type of data requested, the addressees and the situation (emergency case or not) and the number of such orders fulfilled;

(h)

the number of legal remedies used against European Production Orders in the issuing State and in the enforcing State, by the type of data requested;

(i)

the number of cases where ex post validation in accordance with Article 4(5) was not granted;

(j)

an overview of the costs claimed by service providers in relation to the execution of EPOCs or EPOC-PRs and the costs reimbursed by the issuing authorities.

3.   From 18 August 2026, for the data exchanges carried out via the decentralised IT system pursuant to Article 19(1), the statistics referred to in paragraph 2 of this Article may be programmatically collected by national portals. The reference implementation software referred to in Article 22 shall be technically equipped to provide for such functionality.

4.   Service providers may collect, keep a record of and publish statistics in accordance with existing data protection principles. If any such statistics are collected for the preceding calendar year, they may be sent to the Commission by 31 March and may, as far as possible, include:

(a)

the number of EPOCs and EPOC-PRs received, by the type of data requested, the issuing State and situation (emergency case or not);

(b)

the number of fulfilled and non-fulfilled EPOCs and EPOC-PRs, by the type of data requested, the issuing State and the situation (emergency case or not);

(c)

for fulfilled EPOCs, the average period needed to provide the requested data from the moment the EPOC was received to the moment the data were provided, by the type of data requested, the issuing State and the situation (emergency case or not);

(d)

for fulfilled EPOC-PRs, the average period between the moment the EPOC-PR was issued and the moment the subsequent request for production was issued, by the type of data requested and the issuing State.

5.   From 18 August 2027, the Commission shall, by 30 June each year, publish a report containing the data referred to in paragraphs 2 and 3 in a compiled form, subdivided into Member States and type of service provider.

Article 29 Amendments to the certificates and the forms

The Commission shall adopt delegated acts in accordance with Article 30 to amend Annexes I, II, III, V and VI in order to effectively address a possible need for improvements regarding the content of the EPOC and EPOC-PR forms and of the forms to be used for providing information on the impossibility of executing an EPOC or an EPOC-PR, for confirming the issuance of a request for production following a European Preservation Order and for extending the preservation of electronic evidence.

Article 30 Exercise of the delegation

1.   The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.   The power to adopt delegated acts referred to in Article 29 shall be conferred on the Commission for an indeterminate period of time from 18 August 2026.

3.   The delegation of power referred to in Article 29 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.   Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making.

5.   As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

6.   A delegated act adopted pursuant to Article 29 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.

Article 31 Notifications to the Commission

1.   By 18 August 2025 each Member State shall notify the Commission of:

(a)

the authority or authorities which, in accordance with its national law, are competent in accordance with Article 4 to issue, validate or transmit European Production Orders and European Preservation Orders or the notifications thereof;

(b)

the authority or authorities which are competent to receive notifications pursuant to Article 8, and to enforce European Production Orders and European Preservation Orders on behalf of another Member State, in accordance with Article 16;

(c)

the authority or authorities which are competent to deal with reasoned objections by addressees in accordance with Article 17;

(d)

the languages accepted for the notification and the transmission of an EPOC, an EPOC-PR, a European Production Order or a European Preservation Order in the case of enforcement, in accordance with Article 27.

2.   The Commission shall make the information received under this Article publicly available, either on a dedicated website or on the website of the European Judicial Network in criminal matters referred to in Article 9 of Council Decision 2008/976/JHA  ( 33 ) .

Article 32 Relationship to other instruments, agreements and arrangements

1.   This Regulation does not affect Union or other international instruments, agreements and arrangements on the gathering of evidence that falls within the scope of this Regulation.

2.   Member States shall notify the Commission by 18 August 2026 of any existing instruments, agreements and arrangements as referred to in paragraph 1 which they will continue to apply. Member States shall also notify the Commission within three months of the signing of any new agreement or arrangement as referred to in paragraph 1.

Article 33 Evaluation

By 18 August 2029, the Commission shall carry out an evaluation of this Regulation. The Commission shall transmit an evaluation report to the European Parliament, the Council, the European Data Protection Supervisor and the European Union Agency for Fundamental Rights. That evaluation report shall include an assessment of the application of this Regulation and of the results that have been achieved with regard to its objectives, as well as an assessment of this Regulation’s impact on fundamental rights. The evaluation shall be conducted in accordance with the Commission’s better regulation guidelines. Member States shall provide the Commission with the information necessary for the preparation of the evaluation report.

Article 34 Entry into force and application

1.   This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

2.   It shall apply from 18 August 2026.

However, the obligation for competent authorities and service providers to use the decentralised IT system established in Article 19 for written communication under this Regulation shall apply from one year after the adoption of the implementing acts referred to in Article 25.

Schedules & Appendices

ANNEX I

ANNEX I

EUROPEAN PRODUCTION ORDER CERTIFICATE (EPOC) FOR THE PRODUCTION OF ELECTRONIC EVIDENCE

Under Regulation (EU) 2023/1543 of the European Parliament and of the Council  ( 1 ) the addressee of this European Production Order Certificate (EPOC) must execute this EPOC and must transmit the requested data in accordance with the deadline(s) specified in Section C of this EPOC to the competent authority indicated under point (a) of Section L of this EPOC.

In all cases, the addressee must, upon receipt of the EPOC, act expeditiously to preserve the data requested, unless the information in the EPOC does not allow it to identify those data. The data must continue to be preserved until the data are produced or until the issuing authority or, where applicable, the enforcing authority, indicates that it is no longer necessary to preserve and produce the data.

The addressee must take the necessary measures to ensure the confidentiality, secrecy and integrity of the EPOC and of the data produced or preserved.

SECTION A: Issuing/validating authority

Issuing State:…

Issuing authority:…

Validating authority (where applicable):…

NB: details of issuing and validating authority to be provided at the end (Sections I and J)…

File number of the issuing authority:…

File number of the validating authority:…

SECTION B: Addressee

Addressee:…

Designated establishment

Legal representative

This order is issued in an emergency case to the specified addressee because the designated establishment or the legal representative of a service provider did not react to the EPOC within the deadlines set out in Article 10 of Regulation (EU) 2023/1543 or has not been designated or appointed within the deadlines set out in Directive (EU) 2023/1544 of the European Parliament and of the Council  ( 2 )

Address:…

Tel. No/Fax No/email (if known):…

Contact person (if known):…

File number of the addressee (if known):…

Service provider concerned (if different from addressee):…

Any other relevant information:…

SECTION C: Deadlines (tick the appropriate box and complete, if necessary)

Upon receipt of the EPOC, the data requested must be produced:

as soon as possible and at the latest within 10 days (no notification to the enforcing authority)

in the case of notification to the enforcing authority: at the end of the 10 days, where the enforcing authority has not raised a ground for refusal within that time period, or upon confirmation by the enforcing authority before the end of the 10 days that it will not raise a ground for refusal, as soon as possible and at the latest at the end of the 10 days

without undue delay and at the latest within eight hours in an emergency case involving:

an imminent threat to the life, physical integrity or safety of a person

an imminent threat to a critical infrastructure as defined in Article 2, point (a), of Council Directive 2008/114/EC  ( 3 ) , where the disruption or destruction of such critical infrastructure would result in an imminent threat to the life, physical integrity or safety of a person, including through serious harm to the provision of basic supplies to the population or to the exercise of the core functions of the State.

Please indicate whether there are any procedural or other deadlines which should be taken into account for the execution of this EPOC:…

Please provide additional information where relevant:…

SECTION D: Relation to a previous production/preservation request (tick and complete if applicable and available)

The requested data were totally/partially preserved in accordance with an earlier request for preservation

issued by … (indicate the authority and the file number)

on … (indicate the date of issuance of the request)

and transmitted on … (indicate the date of transmission of the request)

to … (indicate the service provider/ legal representative/ designated establishment/competent authority to which the request was transmitted and, if available, the file number given by the addressee).

The requested data are related to an earlier request for production

issued by … (indicate the authority and the file number)

on … (indicate the date of issuance of the request)

and transmitted on … (indicate the date of transmission of the request)

to … (indicate the service provider/ legal representative/ designated establishment/competent authority to which it was transmitted and, if available, the file number given by the addressee).

Any other relevant information:…

SECTION E: Information to support identification of the requested data (complete to the extent this information is known and necessary to identify the data)

IP address(es) and timestamps (incl. date and time zone):…

Tel No:…

Email address(es):…

IMEI number(s):…

MAC address(es):…

The user(s) or other unique identifier(s) such as user name(s), login ID(s) or account name(s):…

Name(s) of the relevant service(s):…

Other:…

If applicable, the time range of the data for which production is requested:

……

Additional information if needed:…

SECTION F: Electronic evidence to be produced

This EPOC concerns (tick the relevant box(es)):

(a)

subscriber data:

name, date of birth, postal or geographic address, contact information (email address, phone number) and other relevant information pertaining to the identity of the user/subscription holder

date and time of initial registration, type of registration, copy of a contract, means of verification of identity at the moment of registration, copies of documents provided by the subscriber

type of service and its duration, including identifier(s) used by or provided to the subscriber at the moment of initial registration or activation (e.g. phone number, SIM-card number, MAC address) and associated device(s)

profile information (e.g. user name, screen name, profile photo)

data on the validation of the use of service, such as an alternative email address provided by the user/subscription holder

debit or credit card information (provided by the user for billing purposes), including other means of payment

PUK-codes

other:…

(b)

data requested for the sole purpose of identifying the user as defined in Article 3, point (10), of Regulation (EU) 2023/1543:

IP connection records such as IP addresses / logs / access numbers together with other technical identifiers, such as source ports and time stamps or equivalent, the user ID and the interface used in the context of the use of the service, please specify, if necessary:…

time range of the data for which production is requested (if different from Section E):…

other:…

(c)

traffic data:

(i)

for (mobile) telephony:

outgoing (A) and incoming (B) identifiers (phone number, IMSI, IMEI)

time and duration of connection(s)

call attempt(s)

base station ID, including geographical information (X/Y coordinates), at the time of initiation and termination of the connection

bearer / teleservice used (e.g. UMTS, GPRS)

other:…

(ii)

for internet:

routing information (source IP address, destination IP address(es), port number(s), browser, email header information, message-ID)

base station ID, including geographical information (X/Y coordinates), at the time of initiation and termination of the connection(s)

volume of data

date and time of connection(s)

duration of connection or access session(s)

other:…

(iii)

for hosting:

logfiles

tickets

other:…

(iv)

other:

purchase history

prepaid balance charging history

other:…

(d)

content data:

(web)mailbox dump

online storage dump (user-generated data)

pagedump

message log/backup

voicemail dump

server contents

device backup

contact list

other:…

Additional information in case necessary to (further) specify or limit the range of the requested data:…

SECTION G: Information on the underlying conditions

(a)

This EPOC concerns (tick the relevant box(es)):

criminal proceedings in respect of a criminal offence(s);

execution of a custodial sentence or a detention order of at least four months following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

(b)

Nature and legal classification of the offence(s) in relation to which the EPOC is issued and the applicable statutory provision  ( 4 ) :

……

(c)

This EPOC is issued for traffic data which are not requested for the sole purpose of identifying the user, or for content data, or both, and concerns (tick the relevant box(es), if applicable):

criminal offence(s) punishable in the issuing State by a custodial sentence of a maximum of at least three years;

one or more of the following offences, if wholly or partly committed by means of an information system:

offence(s) as defined in Articles 3 to 8 of Directive (EU) 2019/713 of the European Parliament and of the Council  ( 5 ) ;

offence(s) as defined in Articles 3 to 7 of Directive 2011/93/EU of the European Parliament and of the Council  ( 6 ) ;

offence(s) as defined in Articles 3 to 8 of Directive 2013/40/EU of the European Parliament and of the Council  ( 7 ) ;

criminal offences as defined in Articles 3 to 12 and 14 of Directive (EU) 2017/541 of the European Parliament and of the Council  ( 8 ) .

(d)

Controller/processor:

European Production Orders shall be addressed to service providers acting as controllers. By way of exception, the European Production Order may be addressed directly to the service provider that processes the data on behalf of the controller.

Tick where appropriate:

This EPOC is addressed to the service provider acting as controller.

This EPOC is addressed to the service provider who is or, in the case of situations where the controller cannot be identified, is possibly processing the data on behalf of the controller, because:

the controller cannot be identified despite reasonable efforts on the part of the issuing authority

addressing the controller might be detrimental to the investigation

If this EPOC is addressed to the service provider processing data on behalf of the controller:

the processor shall inform the controller about the data production

the processor shall not inform the controller about the data production until further notice, as it would be detrimental to the investigation. Please provide a short justification  ( 9 ) :…

(e)

Any other relevant information:…

SECTION H: Information to the user

The addressee shall in any event refrain from informing the person whose data are being requested. It is the responsibility of the issuing authority to inform that person, without undue delay, about the data production.

Please note that (tick where appropriate):

the issuing authority will delay informing the person whose data are being requested, for as long as one or several of the following conditions are met:

it is necessary to avoid obstructing official or legal inquiries, investigations or procedures;

it is necessary to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

it is necessary to protect public security;

it is necessary to protect national security;

it is necessary to protect the rights and freedoms of others.

SECTION I: Details of the issuing authority

The type of issuing authority (tick the relevant box/boxes):

judge, court, or investigating judge

public prosecutor

other competent authority as defined by the issuing State

If validation is necessary, please fill in also Section J.

Please note that (tick if applicable):

This EPOC was issued for subscriber data, or for data requested for the sole purpose of identifying the user, in a validly established emergency case without prior validation, because the validation could not have been obtained in time, or both. The issuing authority confirms that it could issue an order in a similar domestic case without validation, and that ex post validation will be sought without undue delay, at the latest within 48 hours (please note that the addressee will not be informed).

Details of the issuing authority, or its representative, or both, certifying the contents of the EPOC as accurate and correct:

Name of authority:…

Name of its representative:…

Post held (title/grade):…

File number:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Language(s) spoken:…

If different from above, authority/contact point (e.g. central authority) which can be contacted for any question related to the execution of the EPOC:

Name of the authority/name:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Signature of the issuing authority or its representative certifying the content of the EPOC as accurate and correct:

Date:…

Signature  ( 10 ) :…

SECTION J: Details of the validating authority (complete if applicable)

The type of validating authority

judge, court or investigating judge

public prosecutor

Details of the validating authority, or its representative, or both, certifying the contents of the EPOC as accurate and correct:

Name of the authority:…

Name of its representative:…

Post held (title/grade):…

File number:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Language(s) spoken:…

Date:…

Signature  ( 11 ) :…

SECTION K: Notification and details of the notified enforcing authority (if applicable)

This EPOC is notified to the following enforcing authority: …

Please provide contact details of the notified enforcing authority (if available):

Name of the enforcing authority:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

SECTION L: Transfer of data

(a)

Authority to whom the data have to be transferred

issuing authority,

validating authority

other competent authority (e.g. central authority)

Name and contact details:…

(b)

Preferred format in which or means by which the data have to be transferred (if applicable):…

SECTION M: Further information to be included (not to be sent to the addressee ‒ to be provided to the enforcing authority in the event that notification to the enforcing authority is required)

The grounds for determining that the European Preservation Order fulfils the conditions of necessity and proportionality:

……

A summary description of the case:

……

Is the offence for which the European Production Order is being issued punishable in the issuing State by a custodial sentence or a detention order for a maximum period of at least three years and included in the list of offences set out below (tick the relevant box/boxes)?

participation in a criminal organisation;

terrorism;

trafficking in human beings;

sexual exploitation of children and child pornography;

illicit trafficking in narcotic drugs and psychotropic substances;

illicit trafficking in weapons, munitions and explosives;

corruption;

fraud, including fraud and other criminal offences affecting the Union's financial interests as defined in Directive (EU) 2017/1371 of the European Parliament and of the Council  ( 12 ) ;

laundering of the proceeds of crime;

counterfeiting currency, including the euro;

computer-related crime;

environmental crime, including illicit trafficking in endangered animal species and in endangered plant species and varieties;

facilitation of unauthorised entry and residence;

murder or grievous bodily injury;

illicit trade in human organs and tissue;

kidnapping, illegal restraint or hostage-taking;

racism and xenophobia;

organised or armed robbery;

illicit trafficking in cultural goods, including antiques and works of art;

swindling;

racketeering and extortion;

counterfeiting and piracy of products;

forgery of administrative documents and trafficking therein;

forgery of means of payment;

illicit trafficking in hormonal substances and other growth promoters;

illicit trafficking in nuclear or radioactive materials;

trafficking in stolen vehicles;

rape;

arson;

crimes within the jurisdiction of the International Criminal Court;

unlawful seizure of aircraft or ships;

sabotage.

Where appropriate, please add any additional information that the enforcing authority may need to evaluate the possibility of raising grounds for refusal:

……

( 1 )   Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings ( OJ L 191, 28.7.2023, p. 118 ).

( 2 )   Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings ( OJ L 191, 28.7.2023, p. 181 ).

( 3 )   Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection ( OJ L 345, 23.12.2008, p. 75 ).

( 4 )   For execution of a custodial sentence or detention order for traffic data, which is not required for the sole purpose of identifying the user, or content data please indicate in (b) and (c) the offence for which the sentence was imposed.

( 5 )   Directive (EU) 2019/713 of the European Parliament and of the Council of 17 April 2019 on combating fraud and counterfeiting of non-cash means of payment and replacing Council Framework Decision 2001/413/JHA ( OJ L 123, 10.5.2019, p. 18 ).

( 6 )   Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA ( OJ L 335, 17.12.2011, p. 1 ).

( 7 )   Directive 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA ( OJ L 218, 14.8.2013, p. 8 ).

( 8 )   Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA ( OJ L 88, 31.3.2017, p. 6 ).

( 9 )   The issuing authority must indicate the reasons for the delay in the case file, only a short justification must be added in the EPOC.

( 10 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

( 11 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

( 12 )   Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union's financial interests by means of criminal law ( OJ L 198, 28.7.2017, p. 29 ).

ANNEX II

ANNEX II

EUROPEAN PRESERVATION ORDER CERTIFICATE (EPOC-PR) FOR THE PRESERVATION OF ELECTRONIC EVIDENCE

Under Regulation (EU) 2023/1543 of the European Parliament and of the Council  ( 1 ) the addressee of this European Preservation Order Certificate (EPOC-PR) must, without undue delay after receiving the EPOC-PR, preserve the data requested. The preservation must cease after 60 days, unless extended by the issuing authority by an additional 30 days, or the issuing authority confirms that a subsequent request for production has been issued. If the issuing authority confirms within those time periods that a subsequent request for production has been issued, the addressee must preserve the data for as long as necessary to produce the data once the subsequent request for production is received.

The addressee must take necessary measures to ensure the confidentiality, secrecy and integrity of the EPOC-PR and of the data preserved.

SECTION A: Issuing/validating authority:

Issuing State:…

Issuing authority:…

Validating authority (where applicable):…

NB: details of issuing and validating authority to be provided at the end (Sections F and G)

File number of the issuing authority:…

File number of the validating authority:…

SECTION B: Addressee

Addressee:…

Designated establishment

Legal representative

This order is issued in an emergency case to the specified addressee because the designated establishment or the legal representative of a service provider did not react to the EPOC-PR within the deadlines or has not been designated or appointed within the deadlines set out in Directive (EU) 2023/1544 of the European Parliament and of the Council  ( 2 )

Address:…

Tel. No/Fax No/email (if known):…

Contact person (if known):…

File number of the addressee (if known):…

Service provider concerned (if different from addressee):…

Any other relevant information:…

SECTION C: Information to support identification of the data requested to be preserved (complete to the extent this information is known and necessary to identify the data)

IP address(es) and timestamps (incl. date and time zone):…

Tel. No:…

Email address(es):…

IMEI number(s):…

MAC address(es):…

The user(s) of the service or other unique identifier(s) such as user name(s), login ID(s) or account name(s)…

Name(s) of the relevant service(s):…

Other:…

If applicable, the time range of the data for which preservation is requested:…

Additional information if needed:…

SECTION D: Electronic evidence to be preserved

This EPOC-PR concerns (tick the relevant box(es)):

(a)

subscriber data:

name, date of birth, postal or geographic address, contact information (email address, phone number) and other relevant information pertaining to the identity of the user/subscription holder

date and time of initial registration, type of registration, copy of a contract, means of verification of identity at the moment of registration, copies of documents provided by the subscriber

type of service and its duration, including identifier(s) used by or provided to the subscriber at the moment of initial registration or activation (e.g. phone number, SIM-card number, MAC-address) and associated device(s)

profile information (e.g. user name, screen name, profile photo)

data on the validation of the use of service, such as an alternative email address provided by the user/subscription holder

debit or credit card information (provided by the user for billing purposes), including other means of payment

PUK-codes

other:…

(b)

data requested for the sole purpose of identifying the user as defined in Article 3, point (10) of Regulation (EU) 2023/1543:

IP connection records such as IP addresses / logs / access numbers together with other identifiers, such as source ports and time stamps or equivalent, the user ID and the interface used in the context of the use of the service strictly necessary for identification purposes; please specify, if necessary:…

time range of the data for which preservation is requested (if different from Section C):…

other:…

(c)

traffic data:

(i)

for (mobile) telephony:

outgoing (A) and incoming (B) identifiers (phone number, IMSI, IMEI)

time and duration of connection(s)

call attempt(s)

base station ID, including geographical information (X/Y coordinates), at the time of initiation and termination of the connection

bearer / teleservice used (e.g. UMTS, GPRS)

other:…

(ii)

for internet:

routing information (source IP address, destination IP address(es), port number(s), browser, email header information, message-ID)

base station ID, including geographical information (X/Y coordinates), at the time of initiation and termination of the connection(s)

volume of data

date and time of connection(s)

duration of connection or access session(s)

other:…

(iii)

for hosting:

logfiles

tickets

other:…

(iv)

other:

purchase history

prepaid balance charging history

other:…

(d)

content data:

(web)mailbox dump

online storage dump (user-generated data)

pagedump

message log/backup

voicemail dump

server contents

device backup

contact list

other:…

Additional information in case necessary to (further) specify or limit the range of the requested data:…

SECTION E: Information on the underlying conditions

(a)

This EPOC-PR concerns (tick the relevant box(es)):

criminal proceedings in respect of a criminal offence;

execution of a custodial sentence or a detention order of at least four months following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

(b)

Nature and legal classification of the offence(s) for which the EPOC-PR is issued and the applicable statutory provision  ( 3 ) …

SECTION F: Details of the issuing authority

The type of issuing authority (tick the relevant box/boxes):

judge, court, or investigating judge

public prosecutor

other competent authority as defined by the law of the issuing State

If validation is necessary, please fill in also Section G.

Please note that (tick if applicable):

This EPOC-PR was issued for subscriber data, or data requested for the sole purpose of identifying the user in a validly established emergency case without prior validation, because the validation could not have been obtained in time, or both. The issuing authority confirms that it could issue an order in a similar domestic case without validation, and that ex post validation will be sought without undue delay, at the latest within 48 hours (please note that the addressee will not be informed).

This emergency case refers to an imminent threat to the life, physical integrity or safety of a person or an imminent threat to a critical infrastructure as defined in Article 2, point (a), of Council Directive 2008/114/EC  ( 4 ) , where the disruption or destruction of such critical infrastructure would result in an imminent threat to the life, physical integrity or safety of a person, including through serious harm to the provision of basic supplies to the population or to the exercise of the core functions of the State.

Details of the issuing authority and/or its representative certifying the content of the EPOC-PR as accurate and correct:

Name of authority:…

Name of its representative:…

Post held (title/grade):…

File number:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Language(s) spoken:…

If different from above, authority/contact point (e.g. central authority) which can be contacted for any question related to the execution of the EPOC-PR:

Name of authority/name:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Signature of the issuing authority or its representative certifying the content of the EPOC-PR as accurate and correct:

Date:…

Signature  ( 5 ) :…

SECTION G: Details of the validating authority (complete if applicable)

The type of validating authority:

judge, court or investigating judge

public prosecutor

Details of the validating authority or its representative, or both, certifying the contents of the EPOC-PR as accurate and correct:

Name of the authority:…

Name of its representative:…

Post held (title/grade):…

File number:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Language(s) spoken:…

Date:…

Signature  ( 6 ) :…

( 1 )   Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings ( OJ L 191, 28.7.2023, p. 118 ).

( 2 )   Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives for the purpose of gathering electronic evidence in criminal proceedings ( OJ L 191, 28.7.2023, p. 181 ).

( 3 )   For execution of a custodial sentence or detention order, please indicate the offence for which the sentence was imposed.

( 4 )   Council Directive 2008/114/EC of 8 December 2008 on the identification and designation of European critical infrastructures ( OJ L 345, 23.12.2008, p. 75 ).

( 5 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

( 6 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

ANNEX III

ANNEX III

INFORMATION ON THE IMPOSSIBILITY OF EXECUTING AN EPOC / EPOC-PR

Under Regulation (EU) 2023/1543 of the European Parliament and of the Council  ( 1 ) , in cases where the addressee cannot comply with its obligation to preserve the requested data under an EPOC-PR or to produce it under an EPOC, cannot respect the specified deadline or does not provide the data exhaustively, this form should be completed by the addressee and sent back to the issuing authority as well as, where a notification took place and in other cases where applicable, to the enforcing authority referred to in the EPOC, without undue delay.

Where possible, the addressee shall preserve the data requested even where additional information is needed to identify them precisely, unless the information in the EPOC/EPOC-PR is insufficient for that purpose. If clarifications by the issuing authority are needed, the addressee shall seek them, without undue delay, using this form.

SECTION A: Certificate concerned

The following information concerns:

a European Production Order Certificate (EPOC)

a European Preservation Order Certificate (EPOC-PR)

SECTION B: Relevant authority(ies)

Issuing authority:…

File number of the issuing authority:…

If applicable, validating authority:…

If applicable, file number of the validating authority:…

Date of issue of the EPOC/EPOC-PR:…

Date of receipt of the EPOC/EPOC-PR:…

If applicable, enforcing authority:…

If available, file number of the enforcing authority:…

SECTION C: Addressee of the EPOC/EPOC-PR

Addressee of the EPOC/EPOC-PR:…

File number of the addressee:…

SECTION D: Reasons for non-execution

(a)

The EPOC/EPOC-PR cannot be executed or cannot be executed within the specified deadline for the following reason(s):

it is incomplete

it contains manifest errors

it does not contain sufficient information

it does not concern data stored by or on behalf of the service provider at the time of receipt of the EPOC/EPOC-PR

other reasons of de facto impossibility due to circumstances not attributable to the addressee or the service provider at the time the EPOC/EPOC-PR was received

the European Production Order/European Preservation Order has not been issued or validated by an issuing authority as specified in Article 4 of Regulation (EU) 2023/1543.

the European Production Order to obtain traffic data which are not requested for the sole purpose of identifying the user as defined in Article 3, point (10), of Regulation (EU) 2023/1543, or to obtain content data, has been issued for an offence not covered by Article 5(4) of Regulation (EU) 2023/1543.

the service is not covered by Regulation (EU) 2023/1543.

the data requested are protected by immunities or privileges granted under the law of the enforcing State, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent execution of the European Production Order / European Preservation Order.

compliance with the European Production Order would conflict with the applicable law of a third country. Please complete also Section E.

(b)

Please explain further the reasons for non-execution referred to in point (a), and, where necessary, indicate and explain any other reasons not listed under point (a):

……

SECTION E: Conflicting obligations arising from the law of a third country

In the event of conflicting obligations arising from the law of a third country, please include the following information:

—

title of the law(s) of the third country:

……

—

applicable statutory provision(s) and text of the relevant provision(s):

……

—

nature of the conflicting obligation, including the interest protected by the law of the third country:

fundamental rights of individuals (please specify):

……

fundamental interests of the third country related to national security and defence (please specify):

……

other interests (please specify):

……

—

explain why the law is applicable in this case:

……

—

explain why you consider there is a conflict in this case:

……

—

explain the link between the service provider and the third country in question:

……

—

possible consequences for the addressee of complying with the European Production Order, including the penalties that may be incurred:

……

Please add any relevant additional information:…

SECTION F: Request for additional information/clarification (complete, if applicable)

Further information is required from the issuing authority for the EPOC/ EPOC-PR to be executed:

……

SECTION G: Preservation of data

The requested data (tick the relevant box and complete):

are being preserved until the data are produced or until the issuing authority, or where applicable, the enforcing authority, informs that it is no longer necessary to preserve and produce data or until the necessary information is provided by the issuing authority that makes it possible to narrow down the data to be preserved/produced

are not being preserved (this should only be the case exceptionally, e.g. if the service provider does not have the data upon receipt of the request or cannot identify the requested data sufficiently)

SECTION H: Contact details of the designated establishment/ legal representative of the service provider

Name of the designated establishment / legal representative of the service provider: …

Name of the contact person:…

Post held:…

Address:…

Tel. No: (country code) (area/city code)…

Fax No: (country code) (area/city code)…

Email:…

Name of the authorised person:…

Date…

Signature  ( 2 ) :…

( 1 )   Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings ( OJ L 191, 28.7.2023, p. 118 ).

( 2 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

ANNEX IV

ANNEX IV

CATEGORIES OF OFFENCES REFERRED TO IN ARTICLE 12(1), POINT (D)

(1)

participation in a criminal organisation;

(2)

terrorism;

(3)

trafficking in human beings;

(4)

sexual exploitation of children and child pornography;

(5)

illicit trafficking in narcotic drugs and psychotropic substances;

(6)

illicit trafficking in weapons, munitions and explosives;

(7)

corruption;

(8)

fraud, including fraud and other criminal offences affecting the Union's financial interests as defined in Directive (EU) 2017/1371 of the European Parliament and of the Council  ( 1 ) ;

(9)

laundering of the proceeds of crime;

(10)

counterfeiting currency, including the euro;

(11)

computer-related crime;

(12)

environmental crime, including illicit trafficking in endangered animal species and in endangered plant species and varieties;

(13)

facilitation of unauthorised entry and residence;

(14)

murder or grievous bodily injury;

(15)

illicit trade in human organs and tissue;

(16)

kidnapping, illegal restraint or hostage-taking;

(17)

racism and xenophobia;

(18)

organised or armed robbery;

(19)

illicit trafficking in cultural goods, including antiques and works of art;

(20)

swindling;

(21)

racketeering and extortion;

(22)

counterfeiting and piracy of products;

(23)

forgery of administrative documents and trafficking therein;

(24)

forgery of means of payment;

(25)

illicit trafficking in hormonal substances and other growth promoters;

(26)

illicit trafficking in nuclear or radioactive materials;

(27)

trafficking in stolen vehicles;

(28)

rape;

(29)

arson;

(30)

crimes within the jurisdiction of the International Criminal Court;

(31)

unlawful seizure of aircraft or ships;

(32)

sabotage.

( 1 )   Directive (EU) 2017/1371 of the European Parliament and of the Council of 5 July 2017 on the fight against fraud to the Union’s financial interests by means of criminal law ( OJ L 198, 28.7.2017, p. 29 ).

ANNEX V

ANNEX V

CONFIRMATION OF ISSUANCE OF A REQUEST FOR PRODUCTION FOLLOWING A EUROPEAN PRESERVATION ORDER

Under Regulation (EU) 2023/1543 of the European Parliament and of the Council  ( 1 ) , upon receipt of the European Preservation Order Certificate (EPOC-PR) the addressee must, without undue delay, preserve the data requested. The preservation must cease after 60 days, unless extended by the issuing authority by an additional 30 days, or the issuing authority confirms that the subsequent request for production has been issued, using the form set out in this Annex.

Following that confirmation, the addressee must preserve the data for as long as necessary to produce the data once the subsequent request for production is received.

SECTION A: Issuing authority of the EPOC-PR

Issuing State:…

Issuing authority:…

If different from the contact point indicated in the EPOC-PR, authority/contact point (e.g. central authority) which can be contacted for any question related to the execution of the EPOC-PR:

Name and contact details:…

SECTION B: Addressee of the EPOC-PR

Addressee:…

Address:…

Phone/fax/email (if known):…

Contact person (if known):…

File number of the addressee (if known):…

Service provider concerned (if different from addressee):…

Any other relevant information:…

SECTION C: Information about the EPOC-PR

The data are preserved in accordance with the EPOC-PR issued on… (indicate the date of issuance of request) and transmitted on… (indicate the date of transmission of request) with the file number…(indicate file number).

It was extended by 30 days by the issuing authority …, file number … on … (tick the box and indicate, if applicable).

SECTION D: Confirmation

This confirms that the following request for production has been issued (tick the appropriate box and complete, if necessary):

European Production Order Certificate issued by… (indicate the authority) on…(indicate the date of issuance of request) and transmitted on… (indicate the date of transmission of request) with the file number… (indicate file number) and transmitted to…(indicate the service provider/ designated establishment/ legal representative/ competent authority to which it was transmitted and, if available, the file number given by the addressee).

European Investigation Order issued by… (indicate the authority) on… (indicate the date of issuance of request) and transmitted on… (indicate the date of transmission of request) with the file number… (indicate file number) and transmitted to… (indicate the State and competent authority to which it was transmitted and, if available, the file number given by the requested authorities).

Mutual Legal Assistance request issued by… (indicate the authority) on…(indicate the date of issuance of request) and transmitted on… (indicate the date of transmission of request) with the file number… (indicate file number) and transmitted to…(indicate the State and competent authority to which it was transmitted and, if available, the file number given by the requested authorities).

Signature of the issuing authority and/or its representative

Name:…

Date:…

Signature  ( 2 ) :…

( 1 )   Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings ( OJ L 191, 28.7.2023, p. 118 ).

( 2 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.

ANNEX VI

ANNEX VI

EXTENSION OF THE PRESERVATION OF ELECTRONIC EVIDENCE

Under Regulation (EU) 2023/1543 of the European Parliament and of the Council  ( 1 ) , upon receipt of the European Preservation Order Certificate (EPOC-PR) the addressee must, without undue delay, preserve the data requested. The preservation must cease after 60 days, unless the issuing authority confirms that the subsequent request for production has been issued. Within the 60 days, the issuing authority may extend the duration of the preservation by an additional 30 days where necessary, to allow for the issuing of the subsequent request for production, using the form set out in this Annex.

SECTION A: Issuing authority of the EPOC-PR

Issuing State: ……

Issuing authority: ……

File number of the issuing authority: ……

If different from the contact point indicated in the EPOC-PR, authority/contact point (e.g. central authority) which can be contacted for any question related to the execution of the EPOC-PR:

Name and contact details: ……

SECTION B: Addressee of the EPOC-PR

Addressee: ……

Address: ……

Phone/fax/email (if known): ……

Contact person (if known): ……

File number of the addressee (if known): ……

Service provider concerned (if different from addressee): ……

Any other relevant information: ……

SECTION C: Information on prior EPOC-PR

The data are preserved in accordance with the EPOC-PR issued on …… (indicate the date of issuance of request) and transmitted on …… (indicate the date of transmission of request) with the file number ……(indicate file number) and transmitted to ……

SECTION D: Extension of the prior preservation order

The obligation to preserve data under the EPOC-PR as specified in Section C is hereby extended by an additional 30 days.

Signature of the issuing authority and/or its representative

Name: ……

Date: ……

Signature  ( 2 ) : ……

( 1 )   Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings ( OJ L 191, 28.7.2023, p. 118 ).

( 2 )   If the decentralised IT system is not used, please also add an official stamp, electronic seal or equivalent authentication.