Issuing authority
1. A European Production Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user, as defined in Article 3, point (10), may be issued only by:
(a)
a judge, a court, an investigating judge or a public prosecutor competent in the case concerned; or
(b)
any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Production Order shall be validated, after examination of its conformity with the conditions for issuing a European Production Order under this Regulation, by a judge, a court, an investigating judge or a public prosecutor in the issuing State.
2. A European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data may be issued only by:
(a)
a judge, a court or an investigating judge competent in the case concerned; or
(b)
any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Production Order shall be validated, after examination of its conformity with the conditions for issuing a European Production Order under this Regulation, by a judge, a court or an investigating judge in the issuing State.
3. A European Preservation Order for data of any category may be issued only by:
(a)
a judge, a court, an investigating judge or a public prosecutor competent in the case concerned; or
(b)
any other competent authority as defined by the issuing State which, in the case concerned, is acting in its capacity as an investigating authority in criminal proceedings with competence to order the gathering of evidence in accordance with national law; in such a case, the European Preservation Order shall be validated, after examination of its conformity with the conditions for issuing a European Preservation Order under this Regulation, by a judge, a court, an investigating judge or a public prosecutor in the issuing State.
4. Where a European Production Order or a European Preservation Order has been validated by a judicial authority pursuant to paragraph 1, point (b), paragraph 2, point (b), or paragraph 3, point (b), that authority may also be regarded as an issuing authority for the purposes of transmission of the EPOC and the EPOC-PR.
5. In a validly established emergency case, as defined in Article 3, point (18), the competent authorities referred to in paragraph 1, point (b), and in paragraph 3, point (b), of this Article may exceptionally issue a European Production Order for subscriber data or for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or a European Preservation Order, without prior validation of the order concerned, where validation cannot be obtained in time and where those authorities could issue an order in a similar domestic case without prior validation. The issuing authority shall seek ex post validation of the order concerned without undue delay, at the latest within 48 hours. Where such ex post validation of the order concerned is not granted, the issuing authority shall withdraw the order immediately and shall delete or otherwise restrict the use of any data that were obtained.
6. Each Member State may designate one or more central authorities to be responsible for the administrative transmission of EPOCs and EPOC-PRs, of European Production Orders and European Preservation Orders and of notifications, and for the receipt of data and notifications as well as for the transmission of other official correspondence relating to such certificates or orders.
Conditions for issuing a European Production Order
1. An issuing authority may only issue a European Production Order where the conditions set out in this Article are fulfilled.
2. A European Production Order shall be necessary for and proportionate to the purpose of the proceedings referred to in Article 2(3), taking into account the rights of the suspect or the accused person, and may only be issued if a similar order could have been issued under the same conditions in a similar domestic case.
3. A European Production Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user as defined in Article 3, point (10), may be issued for all criminal offences and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.
4. A European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), of this Regulation or to obtain content data shall only be issued:
(a)
for criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least three years; or
(b)
for the following offences, if they are wholly or partly committed by means of an information system:
(i)
offences as defined in Articles 3 to 8 of Directive (EU) 2019/713 of the European Parliament and of the Council ( 32 ) ;
(ii)
offences as defined in Articles 3 to 7 of Directive 2011/93/EU;
(iii)
offences as defined in Articles 3 to 8 of Directive 2013/40/EU;
(c)
for criminal offences as defined in Articles 3 to 12 and 14 of Directive (EU) 2017/541;
(d)
for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice, for criminal offences referred to in points (a), (b) and (c) of this paragraph.
5. A European Production Order shall include the following information:
(a)
the issuing authority and, where applicable, the validating authority;
(b)
the addressee of the European Production Order as referred to in Article 7;
(c)
the user, except where the sole purpose of the order is to identify the user, or any other unique identifier such as user name, login ID or account name to determine the data that are being requested;
(d)
the requested data category as defined in Article 3, points (9) to (12);
(e)
if applicable, the time range of the data for which production is requested;
(f)
the applicable provisions of the criminal law of the issuing State;
(g)
in emergency cases as defined in Article 3, point (18), the duly justified reasons for the emergency;
(h)
in cases where the European Production Order is directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, a confirmation that the conditions set out in paragraph 6 of this Article are met;
(i)
the grounds for determining that the European Production Order fulfils the conditions of necessity and proportionality under paragraph 2 of this Article;
(j)
a summary description of the case.
6. A European Production Order shall be addressed to the service provider acting as controller in accordance with Regulation (EU) 2016/679.
By way of exception, the European Production Order may be directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, where:
(a)
the controller cannot be identified despite reasonable efforts on the part of the issuing authority; or
(b)
addressing the controller might be detrimental to the investigation.
7. In accordance with Regulation (EU) 2016/679, the processor that stores or otherwise processes the data on behalf of the controller shall inform the controller about the production of the data unless the issuing authority has requested the service provider to refrain from informing the controller, for as long as necessary and proportionate, in order not to obstruct the relevant criminal proceedings. In that case, the issuing authority shall indicate in the case file the reasons for the delay in informing the controller. A short justification shall also be added in the EPOC.
8. Where the data are stored or otherwise processed as part of an infrastructure provided by a service provider to a public authority, a European Production Order may only be issued where the public authority for which the data are stored or otherwise processed is located in the issuing State.
9. In cases where data protected by professional privilege under the law of the issuing State are stored or otherwise processed by a service provider as part of an infrastructure provided to professionals covered by professional privilege (‘privileged professional’), in their business capacity, a European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data may only be issued:
(a)
where the privileged professional resides in the issuing State;
(b)
where addressing the privileged professional might be detrimental to the investigation; or
(c)
where the privileges were waived in accordance with the applicable law.
10. If the issuing authority has reasons to believe that the traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data requested by the European Production Order are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press or freedom of expression in other media, the issuing authority may seek clarification before issuing the European Production Order, including by consulting the competent authorities of the enforcing State, either directly or via Eurojust or the European Judicial Network.
The issuing authority shall not issue a European Production Order if it finds that the requested traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press and freedom of expression in other media.
Conditions for issuing a European Preservation Order
1. An issuing authority may only issue a European Preservation Order where the conditions set out in this Article are fulfilled. Article 5(8) shall apply mutatis mutandis .
2. A European Preservation Order shall be necessary for and proportionate to the purpose of preventing the removal, deletion or alteration of data with a view to issuing a subsequent request for production of those data via mutual legal assistance, a European Investigation Order (EIO) or a European Production Order, taking into account the rights of the suspect or the accused person.
3. A European Preservation Order may be issued for all criminal offences, if it could have been issued under the same conditions in a similar domestic case, and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.
4. A European Preservation Order shall include the following information:
(a)
the issuing authority and, where applicable, the validating authority;
(b)
the addressee of the European Preservation Order as referred to in Article 7;
(c)
the user, except where the sole purpose of the order is to identify the user, or any other unique identifier such as user name, login ID or account name to determine the data for which preservation is requested;
(d)
the requested data category as defined in Article 3, points (9) to (12);
(e)
if applicable, the time range of the data for which preservation is requested;
(f)
the applicable provisions of the criminal law of the issuing State;
(g)
the grounds for determining that the European Preservation Order fulfils the conditions of necessity and proportionality under paragraph 2 of this Article.
Addressees of European Production Orders and European Preservation Orders
1. European Production Orders and European Preservation Orders shall be addressed directly to a designated establishment or to a legal representative of the service provider concerned.
2. Exceptionally, in emergency cases as defined in Article 3, point (18), where the designated establishment or the legal representative of a service provider does not react to an EPOC or an EPOC-PR within the deadlines, that EPOC or EPOC-PR may be addressed to any other establishment or legal representative of the service provider in the Union.
Notification to the enforcing authority
1. Where a European Production Order is issued to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data, the issuing authority shall notify the enforcing authority by transmitting the EPOC to that authority at the same time as it transmits the EPOC to the addressee in accordance with Article 9(1) and (2).
2. Paragraph 1 shall not apply if, at the time of issuing the order, the issuing authority has reasonable grounds to believe that:
(a)
the offence has been committed, is being committed or is likely to be committed in the issuing State; and
(b)
the person whose data are requested resides in the issuing State.
3. When transmitting the EPOC as referred to in paragraph 1 of this Article to the enforcing authority, the issuing authority shall, where appropriate, include any additional information that could be needed for the evaluation of the possibility of raising a ground for refusal in accordance with Article 12.
4. The notification to the enforcing authority referred to in paragraph 1 of this Article shall have a suspensive effect on the obligations of the addressee as set out in Article 10(2), except in emergency cases as defined in Article 3, point (18).
European Production Order Certificate (EPOC) and European Preservation Order Certificate (EPOC-PR)
1. A European Production Order or a European Preservation Order shall be transmitted to the addressee as defined in Article 7, through an EPOC or through an EPOC-PR.
The issuing authority or, where applicable, the validating authority shall complete the EPOC set out in Annex I or the EPOC-PR set out in Annex II, shall sign it and shall certify that its content is accurate and correct.
2. An EPOC shall contain the information listed in Article 5(5), points (a) to (h), including sufficient information to allow the addressee to identify and contact the issuing authority and the enforcing authority, if necessary.
Where a notification to the enforcing authority is required pursuant to Article 8, the EPOC transmitted to that authority shall contain the information listed in Article 5(5), points (a) to (j).
3. An EPOC-PR shall contain the information listed in Article 6(4), points (a) to (f), including sufficient information to allow the addressee to identify and contact the issuing authority.
4. Where needed, the EPOC or the EPOC-PR shall be translated into an official language of the Union accepted by the addressee as provided for in Article 4 of Directive (EU) 2023/1544. Where no language has been specified by the service provider, the EPOC or the EPOC-PR shall be translated into an official language of the Member State where the designated establishment or the legal representative of the service provider is located.
Where a notification to the enforcing authority is required pursuant to Article 8, the EPOC to be transmitted to that authority shall be translated into an official language of the enforcing State or into another official language of the Union accepted by that State.
Execution of an EPOC
1. Upon receipt of an EPOC, the addressee shall act expeditiously to preserve the data requested.
2. Where a notification to the enforcing authority is required pursuant to Article 8 and that authority has not raised any ground for refusal in accordance with Article 12 within 10 days following receipt of the EPOC, the addressee shall ensure that the requested data are transmitted directly to the issuing authority or the law enforcement authorities, as indicated in the EPOC, at the end of that 10-day period. Where the enforcing authority already before the end of that 10-day period confirms to the issuing authority and the addressee that it will not raise any ground for refusal, the addressee shall act as soon as possible upon such confirmation and at the latest at the end of that 10-day period.
3. Where a notification to the enforcing authority is not required pursuant to Article 8, upon receipt of an EPOC, the addressee shall ensure that the requested data are transmitted directly to the issuing authority or the law enforcement authorities, as indicated in the EPOC, at the latest within 10 days following receipt of the EPOC.
4. In emergency cases, the addressee shall transmit the requested data without undue delay, at the latest within eight hours following receipt of the EPOC. Where a notification to the enforcing authority is required pursuant to Article 8, the enforcing authority may, if it decides to raise a ground for refusal in accordance with Article 12(1), without delay and at the latest within 96 hours following receipt of the notification, notify the issuing authority and the addressee that it objects to the use of the data or that the data may only be used under conditions which it shall specify. Where a ground for refusal is raised by the enforcing authority, if the data have already been transmitted by the addressee to the issuing authority, the issuing authority shall delete or otherwise restrict the use of the data or, in the event that the enforcing authority has specified conditions, the issuing authority shall comply with those conditions when using the data.
5. Where the addressee considers, based solely on the information contained in the EPOC, that the execution of the EPOC could interfere with immunities or privileges, or with rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, under the law of the enforcing State, the addressee shall inform the issuing authority and the enforcing authority using the form set out in Annex III.
Where no notification to the enforcing authority took place pursuant to Article 8, the issuing authority shall take the information referred to in the first subparagraph of this paragraph into account, and shall decide, on its own initiative or at the request of the enforcing authority, whether to withdraw, adapt or maintain the European Production Order.
Where a notification to the enforcing authority took place pursuant to Article 8, the issuing authority shall take the information referred to in the first subparagraph of this paragraph into account, and shall decide whether to withdraw, adapt or maintain the European Production Order. The enforcing authority may decide to raise the grounds for refusal set out in Article 12.
6. Where the addressee cannot comply with its obligation to produce the requested data because the EPOC is incomplete, contains manifest errors or does not contain sufficient information to execute the EPOC, the addressee shall, without undue delay, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, and seek clarification, using the form set out in Annex III. At the same time, the addressee shall inform the issuing authority of whether identification of the data requested and preservation of those data as set out in paragraph 9 of this Article was possible.
The issuing authority shall react expeditiously and at the latest within five days following receipt of the form. The addressee shall ensure that it can receive the necessary clarification or any correction provided by the issuing authority, in order for the addressee to fulfil its obligations set out in paragraphs 1 to 4. The obligations set out in paragraphs 1 to 4 shall not apply until such clarification or correction is provided by the issuing authority or the enforcing authority.
7. Where the addressee cannot comply with its obligation to produce the requested data because of a de facto impossibility due to circumstances not attributable to the addressee, the addressee shall, without undue delay, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, explaining the reasons for such a de facto impossibility, using the form set out in Annex III. Where the issuing authority concludes that there is such a de facto impossibility, it shall inform the addressee, and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority, that the EPOC no longer needs to be executed.
8. In all cases where the addressee does not provide the requested data, does not provide the requested data exhaustively or does not provide the requested data within the specified deadline, for reasons other than those referred to in paragraphs 5, 6 and 7 of this Article, the addressee shall, without undue delay and at the latest within the deadlines set out in paragraphs 2, 3 and 4 of this Article, inform the issuing authority and, where a notification to the enforcing authority took place pursuant to Article 8, the enforcing authority referred to in the EPOC, of those reasons using the form set out in Annex III. The issuing authority shall review the European Production Order in light of the information provided by the addressee and, if necessary, set a new deadline for the addressee to produce the data.
9. The data shall be preserved, to the extent possible, until they are produced, irrespective of whether the production is ultimately requested on the basis of a clarified European Production Order and its EPOC or through other channels, such as mutual legal assistance, or until the European Production Order is withdrawn.
Where the production of data and their preservation are no longer necessary, the issuing authority and, where applicable pursuant to Article 16(8), the enforcing authority shall inform the addressee without undue delay.
Execution of an EPOC-PR
1. Upon receipt of an EPOC-PR, the addressee shall, without undue delay, preserve the data requested. The obligation to preserve the data shall cease after 60 days, unless the issuing authority confirms, using the form set out in Annex V, that a subsequent request for production has been issued. During that 60-day period, the issuing authority may, using the form set out in Annex VI, extend the duration of the obligation to preserve the data by an additional 30-day period, where necessary to allow for the issuing of a subsequent request for production.
2. Where, during the period of preservation set out in paragraph 1, the issuing authority confirms that a subsequent request for production has been issued, the addressee shall preserve the data as long as necessary to produce the data once the subsequent request for production is received.
3. Where the preservation is no longer necessary, the issuing authority shall inform the addressee without undue delay and the obligation to preserve on the basis of the relevant European Preservation Order shall cease.
4. Where the addressee considers, based solely on the information contained in the EPOC-PR, that the execution of the EPOC-PR could interfere with immunities or privileges, or with rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, under the law of the enforcing State, the addressee shall inform the issuing authority and the enforcing authority using the form set out in Annex III.
The issuing authority shall take the information referred to in the first subparagraph into account, and shall decide, on its own initiative or at the request of the enforcing authority, whether to withdraw, adapt or maintain the European Preservation Order.
5. Where the addressee cannot comply with its obligation to preserve the requested data because the EPOC-PR is incomplete, contains manifest errors or does not contain sufficient information to execute the EPOC-PR, the addressee shall, without undue delay, inform the issuing authority referred to in the EPOC-PR and seek clarification, using the form set out in Annex III.
The issuing authority shall react expeditiously and at the latest within five days of the receipt of the form. The addressee shall ensure that it can receive the necessary clarification or any correction provided by the issuing authority in order for the addressee to fulfil its obligations set out in paragraphs 1, 2 and 3. In the absence of a reaction from the issuing authority within the five-day period, the service provider shall be exempt from the obligations set out in paragraphs 1 and 2.
6. Where the addressee cannot comply with its obligation to preserve the requested data because of a de facto impossibility due to circumstances not attributable to the addressee, the addressee shall, without undue delay, inform the issuing authority referred to in the EPOC-PR explaining the reasons for such de facto impossibility, using the form set out in Annex III. Where the issuing authority concludes that such impossibility does exist, it shall inform the addressee that the EPOC-PR no longer needs to be executed.
7. In all cases where the addressee does not preserve the requested data, for reasons other than those referred to in paragraphs 4, 5 and 6, the addressee shall, without undue delay, inform the issuing authority of those reasons, using the form set out in Annex III. The issuing authority shall review the European Preservation Order in light of the justification provided by the addressee.
Grounds for refusal of European Production Orders
1. Where the issuing authority has notified the enforcing authority pursuant to Article 8, and without prejudice to Article 1(3), the enforcing authority shall, as soon as possible but at the latest within 10 days following receipt of the notification, or, in emergency cases, at the latest within 96 hours following such receipt, assess the information set out in the order and, where appropriate, raise one or more of the following grounds for refusal:
(a)
the data requested are protected by immunities or privileges granted under the law of the enforcing State which prevent the execution or enforcement of the order, or the data requested are covered by rules on the determination or limitation of criminal liability that relate to freedom of the press or freedom of expression in other media, which prevent the execution or enforcement of the order;
(b)
in exceptional situations, there are substantial grounds to believe, on the basis of specific and objective evidence, that the execution of the order would, in the particular circumstances of the case, entail a manifest breach of a relevant fundamental right as set out in Article 6 TEU and in the Charter;
(c)
the execution of the order would be contrary to the principle of ne bis in idem ;
(d)
the conduct for which the order has been issued does not constitute an offence under the law of the enforcing State, unless it concerns an offence listed within the categories of offences set out in Annex IV, as indicated by the issuing authority in the EPOC, if it is punishable in the issuing State by a custodial sentence or a detention order for a maximum period of at least three years.
2. Where the enforcing authority raises a ground for refusal pursuant to paragraph 1, it shall inform the addressee and the issuing authority. The addressee shall stop the execution of the European Production Order and not transfer the data, and the issuing authority shall withdraw the order.
3. Before deciding to raise a ground for refusal, the enforcing authority notified pursuant to Article 8 shall contact the issuing authority by any appropriate means, in order to discuss the appropriate measures to take. On that basis, the issuing authority may decide to adapt or to withdraw the European Production Order. Where, following such discussions, no solution is reached, the enforcing authority notified pursuant to Article 8 may decide to raise grounds for refusal of the European Production Order and inform the issuing authority and the addressee accordingly.
4. Where the enforcing authority decides to raise grounds for refusal pursuant to paragraph 1, it may indicate whether it objects to the transfer of all data requested in the European Production Order or whether the data may only be partly transferred or used under conditions specified by the enforcing authority.
5. Where the power to waive the immunity or privilege as set out in paragraph 1, point (a), of this Article, lies with an authority of the enforcing State, the issuing authority may request the enforcing authority notified pursuant to Article 8 to contact that authority of the enforcing State to request it to exercise that power without delay. Where the power to waive the immunity or privilege lies with an authority of another Member State or a third country or with an international organisation, the issuing authority may request the authority concerned to exercise that power.
User information and confidentiality
1. The issuing authority shall, without undue delay, inform the person whose data are being requested about the production of data on the basis of a European Production Order.
2. The issuing authority may, in accordance with the national law of the issuing State, delay or restrict informing, or omit to inform, the person whose data are being requested, to the extent that, and for as long as, the conditions in Article 13(3) of Directive (EU) 2016/680 are met, in which case the issuing authority shall indicate in the case file the reasons for the delay, restriction or omission. A short justification shall also be added in the EPOC.
3. When informing the person whose data are being requested as referred to in paragraph 1 of this Article, the issuing authority shall include information about available remedies pursuant to Article 18.
4. The addressees and, if different, the service providers shall take the necessary state-of-the-art operational and technical measures to ensure the confidentiality, secrecy and integrity of the EPOC or the EPOC-PR and of the data produced or preserved.
Reimbursement of costs
1. The service provider may claim reimbursement of its costs from the issuing State, if that possibility is provided for in the national law of the issuing State for domestic orders in similar situations, in accordance with the national law of that State. Member States shall inform the Commission about their national rules for reimbursement, and the Commission shall make them public.
2. This Article shall not apply to the reimbursement of costs of the decentralised IT system as referred to in Article 25.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
