Concluding report of the High-Level Group on access to data for effective law enforcement

By The High Level Group, European Commission

The European Union constitutes an area of freedom, security and justice where fundamental rights and the different legal systems and traditions of the Member States are respected. It endeavours to ensure a high level of security1 through measures to prevent and combat crime and to facilitate coordination and cooperation between law enforcement, judicial and other competent authorities. Technological developments and the digitalisation of our societies have led both to significant changes in citizens’ daily lives and to new challenges for law enforcement and judicial authorities in ensuring a high level of security, at both national and EU level. In today’s digital age, almost every criminal investigation has a digital component. This was addressed in April 2023 in the scoping paper for the High-Level Expert Group on access to data for effective law enforcement: Technologies and tools […] are also abused for criminal purposes. This development makes it increasingly challenging to maintain effective law enforcement across the EU to safeguard public security and to prevent, detect, investigate, and prosecute crime, and to meet victims’ legitimate expectations of justice and compensation. If not properly addressed, there is a real risk that this current trend will enable criminals to go ‘dark’ […]. This is a serious threat to individuals’ and society’s security and can ultimately impede on the positive obligation of the state to continue ensuring the rule of law and a democratic society2 . The right to respect for private and family life, home and communications, and the right to the protection of personal data, are guaranteed under the Charter of Fundamental Rights of the EU. Confidentiality of communication, be it in writing or on the phone, has been a major achievement of democratic societies, ensuring that neither the state nor private actors may interfere in peoples’ freedom of expression and enabling the establishment of a flourishing civil society. The enjoyment of those rights can be subject to limitations under the law, in particular with regard to measures intended to safeguard national security, defence or public security and for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of electronic communication systems, provided these measures are necessary, appropriate and proportionate within a democratic society. Therefore, law enforcement and judicial authorities may open and read written communications, intercept phone calls and listen to conversations, if deemed necessary, proportionate and justified, if such measures are in line with the applicable legal provisions and if they are carried out with due respect for fundamental rights. This possibility should be available to all competent authorities, irrespective of technological developments. The proliferation of new forms of interpersonal communication that has occurred in recent years means that all of society has to adapt to new realities. We must ensure that communication among citizens remains protected, and at the same time that law enforcement and judicial authorities continue to be able to fulfil their duty of protecting citizens by preventing and fighting serious and organised crime and terrorism. The need for adaptation is urgent, and the experts call on policymakers to act promptly as law enforcement authorities (LEAs) are already behind the pace of technological developments, which directly affects their ability to uphold citizens’ rights. At the informal meeting of justice and home affairs ministers on 26 January 2023, home affairs ministers reflected on the challenges posed by technological developments for law enforcement in the digital age. They also expressed concern that the applicable rules and their interpretation through case-law, together with practical and operational impediments, are making it increasingly challenging for LEAs to carry out their work, in particular when it comes to the retention of and access to data necessary to investigate and prosecute crime3 . Following this discussion, the Council endorsed the establishment of a group to develop a strategic forward-looking vision on effective and lawful access to data, electronic evidence and information in the digital age for judicial and law enforcement authorities: the High-Level Group on access to data for effective law enforcement (HLG)4 . The HLG’s goal was to find solutions to the challenge inherent in permitting lawful access to data in order to uphold a high level of security for all people living in the EU, while ensuring compliance with fundamental rights, including the rights to privacy and to data protection, as well as a high level of cybersecurity, through efficient and future-proof solutions. The 42 recommendations5 , the main deliverable resulting from the work of the HLG, come at a time when calls for online accountability are increasing. The recommendations address current and anticipated challenges in view of technological developments, aiming to enable a comprehensive EU approach to ensuring effective criminal investigations and prosecutions. The recommendations are clustered in three blocks: capacity building; cooperation with industry and standardisation; and legislative measures. They emphasise the challenges law enforcement faces in accessing data in a readable format for criminal investigations due to the lack of harmonised data retention obligations and stringent requirements of EU case-law, the growing use of end-to-end encryption and the lack of cooperation by certain non-traditional telecommunications services. While welcoming the e-evidence rules, the recommendations highlight their limits in addressing challenges posed by encryption and call for stronger cooperation between law enforcement and judicial authorities and service providers to nurture a permanent dialogue and a mutual understanding of operational, technical and business needs and to overcome difficulties in accessing encrypted data. According to experts, stronger cooperation between law enforcement and service providers will improve the situation to a certain extent, but a future-proof solution also requires that obligations upon service providers to cooperate be enforced by legislation, without weakening encryption in a generalised or systematic way for the users of a service.

Brussels: European Commission, 2024. 51p.