“I like to take the image of a runner. He does his 100 meters and, as he approaches the finish line, he slows down and sits down,” quips Jacques Martinon, judge of freedoms and detention at the Toulouse judicial court, speaking of France. The country, like many others, has not yet transposed into national law the European directive of the e-Evidence package, a legislative instrument aimed at accelerating the access of investigators and magistrates to digital data from private companies established in other countries of the European Union (EU) in the context of criminal cases.
Late, France, which nevertheless worked on its development and its safeguards, received formal notice from the European Commission, the deadline having been set for February 18. “I am surprised because there was a real will, we felt that it was a priority,” notes Maxime Lassalle, lecturer at the University of Burgundy, whose work focuses on business and European criminal law and the right to data protection.
Reduce survey latencies
Adopted on a European scale in 2023, this tool makes it easier to obtain digital traces (IP addresses, contents of an email box, geolocation data) in particular from tech giants like Meta, Google or Microsoft. How ? It allows investigators to contact companies directly and requires the latter to designate an establishment or legal representative responsible for receiving and executing decisions and injunctions from cross-border authorities. “A standard procedure is ten days and, in an emergency, it’s eight hours. In the event of the kidnapping of a child, you are in a life-threatening emergency. This is a huge step forward in terms of deadlines! », assures Jacques Martinon. The stakes are high since today, “85% of criminal investigations involve digital data”, notes the European Council.
Currently, to prosecute offenders, the authorities can contact companies that respond positively, according to their internal data protection policy, or turn to the chancelleries of the countries where the companies are hosted. The latter collaborate within the framework of their legislation. “For particularly tax reasons, most Gafam (Google, Apple, Facebook (Meta), Amazon and Microsoft, major players via their social networks and office tools, Editor’s note) are mainly based in Ireland,” explains the magistrate. But “a classic request for mutual assistance takes on average ten months, and a European investigation decision takes up to 120 days,” specifies Jacques Martinon in an article published on the website of the World Saturday and co-signed by magistrate Frédéric Macé and teacher-researcher Théodore Christakis, taking as an example the tragic affair of Lyhanna, a teenager raped and killed in Gers in May.
An issue of “digital sovereignty”
Germany, Italy and Ireland are in working order to ensure that companies based there respect this system, which Jacques Martinon describes as a “digital sovereignty issue”. “The Irish have created a new entity to ensure the implementation of the e-Evidence package. They estimate that the flow of injunctions from foreign authorities will be nearly 300,000 per year,” indicates the magistrate. In France, the transposition is dragging while implementation has been effective since August 18 for companies. Contacted, the Ministry of Justice indicates that it has started interministerial “compliance” work, but no timetable has been set. If a brief note shows the outlines of the application of this directive, magistrates and researchers are still waiting for clear compliance of the European tool. “I don’t know what’s blocking it. Is this linked to the broader debate on data collection, the cost of implementation…” asks Maxime Lassalle. “The idea of our platform is to put the spotlight on a technical subject, not sexy, which does not attract votes” but which allows, ultimately, to speed up the work of justice.
