Long arm of the law: new powers to gather electronic evidence overseas

The Bill would give law enforcement agencies and prosecutors the power to apply for an OPO to obtain electronic data directly from service providers based outside the UK for the purposes of criminal investigations and prosecutions for serious crime.

The Crime (Overseas Production Orders) Bill puts forward a new proposal to speed up the process of securing access to electronic evidence held outside the UK. The legislation is rapidly making its way through parliament, and has received little attention thus far. The Overseas Production Order (OPO) would, no doubt, enable information to be shared across borders much more quickly. Nevertheless, the proposals as set out should be assessed with a critical eye: the safeguards for the data subject are limited, with few checks and balances protecting the rights of the individual.

What is an Overseas Production Order?

The Bill would give law enforcement agencies and prosecutors the power to apply for an OPO to obtain electronic data directly from service providers based outside the UK for the purposes of criminal investigations and prosecutions for serious crime. This is a radical departure from the current mutual legal assistance regime.

How would it work?

The House of Lords briefing paper on the new proposals set out the way in which an application for an OPO must specify the data being sought. To grant an OPO, a judge must be satisfied that the data is likely to be of substantial value to the criminal proceedings or the investigation in relation to which it is requested, and that production of the data would be in the public interest.

Once an order has been authorised the subject of that order should provide the requested data to the investigating or prosecuting authority that applied for the order. 

This brings the powers of the courts in relation to data stored by companies abroad into line with those based abroad, where the UK has an international agreement. 

The provisions in the Bill will set out:

• The scope and reach of an OPO and who may apply for one;
• The requirements which need to be met before a judge makes an OPO and what must be included in the application for an order;
• Restrictions on serving an OPO, including the time period within which the data covered by the OPO must be supplied;
• Additional safeguards and protections for certain types of data; and
• The ways in which an overseas production order can be served.

Current system – not fit for purpose

In introducing the new proposal, the Home Office Factsheet set out the Government view that police, and prosecuting authorities, must be able to detect, investigate and secure convictions in serious criminal and terrorist cases. It underlines how obtaining evidence via Mutual Legal Assistance can be a slow and cumbersome process. It argues reform is necessary to make the process for gaining access to evidence held electronically faster and more reliable, saying that in many cases today, evidence cannot be obtained in time to support a prosecution or an investigation.  

The Explanatory Memorandum to the Bill sets out how this proposed new regime addresses the “constraints of existing domestic court orders and the limits of MLA” in being able to require the production of this evidence from another jurisdiction quickly. The Bill does this by creating a new overseas production order which has extraterritorial scope.

The House of Lords briefing paper on the topic recalls that while the Investigatory Powers Act 2016 allowed for the acquisition of data from overseas for investigation purposes, it does not apply to the use of such data on an evidential basis.

A relevant international agreement

An overseas production order can only be used where there is an international agreement in place between the UK and the territory in which the relevant provider is based. 

As the Explanatory Memorandum confirms, this may be an agreement or other arrangement with another country or countries, which relates to the provision of MLA in connection with the investigation or prosecution of offences. 

The Bill reflects the “anticipated framework” required to implement such international agreements or arrangements in future.

Indeed, the United States has tackled this issue with the CLOUD Act (Clarifying Lawful Use of Overseas Data Act). The Lords briefing paper confirms that the UK Government has stated that the US passed the CLOUD Act “in anticipation and preparation” for a bilateral UK-US data access agreement and that the Government has described the Crime (Overseas Production Orders) Bill as “the final element of legislative change required to enable UK law enforcement to take advantage of the proposed agreement when investigating and prosecuting crime”. 

Alongside this, the European Production Order was introduced at EU level as part of package of measures on electronic evidence.  

Though the UK could chose to opt-in to this measure, given the lack of clarity regarding applicability of instruments post-Brexit it seems as if the choice has been to go it alone for now.

Safeguards?

The Factsheet sets out how each application for an overseas protection order would be subject to “robust safeguards”, and decided by a judge with “due regard for the right to privacy”. 

A statement was made by Government that the provisions of this Bill are compatible with the Convention Rights (within the meaning of section 19 of the Human Rights Act 1998). 

This view was challenged in the recent House of Lords by Lord Rosser who stated that “Those words might not be accepted without question by everyone”.

There are limits set out in the Bill: for example, the new powers may only be used for an indictable offence. As a threshold, this is extremely low: indictable offences include theft (of any value); public nuisance; abstracting electricity or unlawfully obtaining personal data.

Missing from the proposal are the checks and balances in the executing state that one would normally see in the context of cross border evidence gathering and instruments of mutual recognition. 

In the case of the European Arrest Warrant, for example, executing states have played a vital role in safeguarding rights. 

Moreover there is lack of clarity around the use of the data as evidence once it has been provided to the requesting state: is it restricted to the offence for which the order is made? What happens if other offences are disclosed? Would a further application be necessary?

Next steps

The Bill was debated in the House of Lords in a second reading on 11 July and is due to be discussed in committee stage of the House of Lords on 5 September.