The e-Evidence Regulation is the EU’s answer to the same problem the CLOUD Act addressed: criminal evidence sits with providers in another jurisdiction, and the government-to-government route is too slow to be useful.
What the Regulation created
Two instruments:
- European Production Order (EPOC): compels a provider to hand over specified electronic evidence.
- European Preservation Order (EPOC-PR): compels a provider to preserve data pending a subsequent production order.
Both are issued by a judicial authority in one member state and served directly on a provider’s designated establishment or legal representative in another. The receiving state’s government is not an intermediary in the way it is under an MLAT.
The deadlines are the story
| European Production Order | MLAT request | |
|---|---|---|
| Served on the provider by | The issuing authority directly | Domestic authority after review |
| Standard deadline | 10 days | No fixed deadline in practice |
| Emergency deadline | 8 hours | Not applicable |
| Typical real-world elapsed time | Days | Many months |
An eight-hour emergency window is the operational headline. It is shorter than many providers’ escalation paths, and it does not pause for weekends. Meeting it is a staffing and tooling question before it is a legal one.
Categories of data and thresholds
The Regulation distinguishes between categories, with subscriber data and data requested solely to identify a user available on a broader basis, and traffic and content data subject to tighter conditions, generally limited to more serious offences. As with the Stored Communications Act’s tiers, matching the request to the category is the substantive review step.
What it means for a company
- Designate an establishment or legal representative. Without one there is no valid service address, and this is a precondition rather than a formality.
- Build for eight hours, not ten days. The emergency path needs a named owner, out-of-hours coverage, and a decision route that does not depend on one person being reachable.
- Verify the issuing authority. A short deadline is exactly the pressure a fraudulent request exploits, and the same verification logic that applies to emergency disclosure requests applies here.
- Know the refusal grounds and the procedure for raising them. They exist, but they must be invoked properly and within the timeline.