The EC is set to propose three options that will form the basis of a future legislative proposal.
EU Justice Commissioner Vera Jourova said: “I am sure that now in the shadow of the recent terrorist attacks and increasing threats in Europe there will be more understanding among the ministers, even among those who come from countries where there has not been a terrorist attack.”
EU justice ministers are to meet in Brussels on Thursday to discuss the EC’s proposals, which will then form the basis of a motion put forward by the EU executive by early 2018.
Of the three EC proposals, the least intrusive option involves allowing law enforcement agencies in one member state to ask an IT provider in another member state to turn over electronic evidence, without having to ask that member state first.
The second option would see the companies obliged to turn over data if requested by law enforcement agencies in other member countries.
The most intrusive option, allowing law enforcement agencies direct access to information in the cloud, is being suggested for situations where authorities do not know the location of the server hosting the data or there is a risk of the data being lost.
“This third option is kind of an emergency possibility which will require some additional safeguards protecting the privacy of people,” Jourova said. “You simply cannot massively collect some digital data for some future use.”
“My preference is to go for this as an extraordinary measure for extraordinary threats, for high gravity criminal offences such as terrorism and there I am in favour of enabling the use of personal data,” Jourova said, adding that no decision has yet been taken.
The types of data that could fall within the scope of the law will be discussed on Thursday, from location or traffic data to personal communications, as well as safeguards such as requiring that law enforcement requests are necessary and proportionate.
Currently law enforcement agencies in Germany seeking data stored in Ireland – the location of many US tech firms’ European headquarters, including Facebook’s – would have to rely on Irish authorities requesting the data from them, which is a slow and cumbersome process.
It is a fine line between speeding law enforcement efforts in moments of crisis and eroding user data privacy, with critics saying that maintaining user trust in the cloud is critical, particularly where that data could be seized. Direct access to user data would raise many questions over privacy and safeguards.
Microsoft recently won a high-profile battle against the US Department of Justice’s request that it turn over emails stored on a server in Ireland in which the EC backed Microsoft saying that EU-held data should not be directly accessed by foreign authorities.
More about:
