A Bill is passing through the House of Lords that would enable UK authorities to directly obtain data held overseas as part of their investigation of serious crimes.
The second reading of the Crime (Overseas Production Orders) Bill took place on 11 July 2018 and the Bill will be discussed in committee stage in September.
The Bill would enable UK law enforcement agencies (in particular the SFO but also FCA investigators), to obtain a court order compelling any person holding data overseas to produce or grant access to data for the purposes of investigating or prosecuting serious crimes. Orders would only be made where the UK has an international agreement with the jurisdiction in which the data custodian is based. There are currently no such agreements in place, but the UK and the US have been negotiating a bilateral data sharing agreement since 2015. A UK-US agreement would cover around 90% of communications – with Facebook, Google, Twitter etc. all having data stored in the US.
The new procedure is mainly aimed at obtaining data from telecoms and data storage providers, and is intended to be much faster than the current mutual legal assistance treaties (MLAT) route. Under the MLAT system, requests are highly bureaucratic and often take up to a year to process, which arguably does not allow UK law enforcement agencies to respond promptly in the pursuit of serious crime.
It remains to be seen how this system will work in practice, especially as the international framework of bilateral treaties to give effect to such orders is not in place, and the MLAT process for those countries that have agreed to support each other is not exactly smooth. But it is another example of closer anticipated coordination between enforcement agencies in different jurisdictions, and should allow English prosecutors to obtain evidence in economic crime cases much more quickly.
It also places a significant additional burden on telecoms and other data providers, who will have to be prepared to deal quickly (the default deadline for providing the data being seven days) with cross-border orders on a more regular basis.
A cross-border agreement between the UK and the US would be the first agreement signed under the US CLOUD Act. The CLOUD Act allows the US to agree to remove US law restrictions on US companies disclosing data directly to a foreign country in response to orders issued by that country. (See our briefing on the CLOUD Act).
Outside the US, the European Commission published proposals in April 2018 for a European Production Order regime. This would allow courts in one EU member state to request electronic evidence directly from a service provider operating in the EU and established in another member state – regardless of where the evidence is stored. The UK would be able to decide whether to opt in to the measures, although if the regulation ends up being adopted after Brexit in March 2019, it is unclear whether the regime would be effective in the UK during the post-Brexit transition period.
