Cross-border gathering of evidence requires cross-border protection of legal professional privilege
On August 18, 2026, a European Regulation will enter into force that deals with the cross-border obtaining of electronic evidence in criminal cases (Regulation (EU) 2023/1543, hereafter referred to as the E-evidence Regulation). Judicial authorities in the EU will soon be able to address a production order (‘EPOC’) directly to digital service providers in the EU, including internet and email providers and cloud service providers, regardless of where the requested data is located.
The E-evidence Regulation is based on mutual trust between Member States. Only in specific cases, the Member State of the service provider is notified of an EPOC. Within ten days after notification, that Member State can invoke a ground for refusal, including that execution could interfere with legal professional privilege (‘LPP’).
During the drafting stage of the E-evidence Regulation, professional associations of journalists and lawyers expressed their concerns about this limited and discretionary notification procedure. Considering the declining rule of law in a few Member States, more legal protection would have been justified.
Moreover, we can learn from Dutch experiences with covert production orders. Roughly speaking, the EPOC is a European variant of the power of the Dutch public prosecutor to secretly demand data from a service provider with the permission of the examining judge (article-126ng/ug of the Dutch Code of Criminal Procedure).
The use of this power has led to structural violations of LPP in the Netherlands. Confidential communications between lawyers and clients have (secretly) been used and kept by investigative authorities for years. After a (civil) procedure against the Dutch State, which was initiated by Stibbe, the Supreme Court confirmed in early 2024 that the examining judge is the central authority in filtering and assessing privileged information in criminal investigations. Meanwhile, in a “Steering Committee LPP” organized from the Dutch Ministry of Justice, the introduction of a system of automatic filtering of privileged information is being examined.
To prevent history from repeating itself, EU-wide measures must be taken. The fact that the E-evidence Regulation states that an EPOC shall not be issued if the issuing authority considers the data protected by LPP is not sufficient. An issuing authority eager for information may take a rather narrow view of LPP. Moreover, the scope of LPP will vary from state to state. Would a Hungarian or Polish authority care about the protection of LPP under Dutch law? Apart from that: the Dutch production orders were also not allowed to target information protected by LPP, but investigative authorities usually define the production orders very broadly. Because digital data are provided in bulk, this regularly includes privileged information.
In this context, the notification procedure is not a serious safeguard. In many cases, the Member State where the data is collected will not even be notified of an EPOC as it is only addressed to the service provider. But even with notification, the protection is (too) limited. I fear that the opportunity toinvoke a ground for refusal within ten days by (already overburdened) authorities will not be at the top of their priority list. The importance of efficient cooperation is also a factor which makes it (even) less attractive to flag the risk privileged information is included in a data collection following a (bulk) EPOC.
As is often the case, the granting of (cross-border) powers has not been accompanied by the organization of adequate (cross-border) legal protection. While Member States must adhere to the right to a fair trial and the case law of the European courts, unambiguous minimum standards set by the European legislature on the scope and protection of LPP are lacking. Moreover, practical safeguards are also needed to effectively protect LPP. An EU-wide system of automatic filtering of privileged information, mandatory for all Member States, could contribute to this. We still have some time before August 2026.
