Upcoming EU law -electronic evidence in criminal proceedings

Mynymbox

I’m interested to know how non-EU provider (cloud/hosting and even domain registrars) with server locations and services for customers in the EU will handle the issue of "electronic evidence in criminal proceedings," which comes into force in the EU for all providers on August 18, 2026.

https://eur-lex.europa.eu/EN/legal-content/summary/electronic-evidence-in-criminal-proceedings.html

I haven't seen any discussion about it somewhere and many non EU providers just seems to ingore it which will bring them into huge troubles as they can freeze assets, take down servers for non compliance etc.

rpqu

Sounds very exploitable as DoS

hyperblast

fuck the eu!

(love europe)

RickBakkr

@Mynymbox said: I haven't seen any discussion about it somewhere

Not to mention that many EU member states are not even close to actually incorporating this legislation into local legislation and enforcement thereof. Apart from API spec, officially, we are still yet to receive most details with regards to this new legislation .. where the Dutch introduction is already pushed back until (at least) Q1 '27.

vovler

EU will eventually create it's own GFW through sheer policy

vovler

This is most likely to force compliance with chat control, destroying VPNs and finding more ways to fine Google, Meta and alike a few more billions.

Mainfrezzer

I quickly flew over and I fail to see how this is supposed to be a mayor change. While maybe not obligated right now, usually in both countries it probably constitutes a crime. This just seem like a shortcut where you don't need to contact the us government, for example, first. Although I'm sure that this will be abused for mean things said about politicians on a website, because obviously, making fun of government officials is a horrible clown crime

Mynymbox

@RickBakkr said:

@Mynymbox said: I haven't seen any discussion about it somewhere

Not to mention that many EU member states are not even close to actually incorporating this legislation into local legislation and enforcement thereof. Apart from API spec, officially, we are still yet to receive most details with regards to this new legislation .. where the Dutch introduction is already pushed back until (at least) Q1 '27.

What does this exactly mean? Running servers and getting a request from Germany is still a issue, right?

rpqu

@vovler said:
This is most likely to force compliance with chat control, destroying VPNs and finding more ways to fine Google, Meta and alike a few more billions.

Totally. Chat control also exempt politicians

Mynymbox

@Mainfrezzer said:
I quickly flew over and I fail to see how this is supposed to be a mayor change. While maybe not obligated right now, usually in both countries it probably constitutes a crime. This just seem like a shortcut where you don't need to contact the us government, for example, first. Although I'm sure that this will be abused for mean things said about politicians on a website, because obviously, making fun of government officials is a horrible clown crime

The issue is that a non EU hosting providers needs a legal represenation in the EU which costs a lot of money since they charge you a lot to be available 24/7 and a license for the system etc. Till now and still till August 18 authorities contacted you via abuse email address or legal email address from the provider website.

rpqu

@Mynymbox said:

@Mainfrezzer said:
I quickly flew over and I fail to see how this is supposed to be a mayor change. While maybe not obligated right now, usually in both countries it probably constitutes a crime. This just seem like a shortcut where you don't need to contact the us government, for example, first. Although I'm sure that this will be abused for mean things said about politicians on a website, because obviously, making fun of government officials is a horrible clown crime

The issue is that a non EU hosting providers needs a legal represenation in the EU which costs a lot of money since they charge you a lot to be available 24/7 and a license for the system etc.

That's what politicians called as job creation

Mainfrezzer

@Mynymbox said:

@Mainfrezzer said:
I quickly flew over and I fail to see how this is supposed to be a mayor change. While maybe not obligated right now, usually in both countries it probably constitutes a crime. This just seem like a shortcut where you don't need to contact the us government, for example, first. Although I'm sure that this will be abused for mean things said about politicians on a website, because obviously, making fun of government officials is a horrible clown crime

The issue is that a non EU hosting providers needs a legal represenation in the EU which costs a lot of money since they charge you a lot to be available 24/7 and a license for the system etc. Till now and still till August 18 authorities contacted you via abuse email address or legal email address from the provider website.

Should have said that specific directive 😄

Yeah bit odd. Now that's a perfect opportunity to offer my mailbox up for use 😄

RickBakkr

@Mynymbox said:

@RickBakkr said:

@Mynymbox said: I haven't seen any discussion about it somewhere

Not to mention that many EU member states are not even close to actually incorporating this legislation into local legislation and enforcement thereof. Apart from API spec, officially, we are still yet to receive most details with regards to this new legislation .. where the Dutch introduction is already pushed back until (at least) Q1 '27.

What does this exactly mean? Running servers and getting a request from Germany is still a issue, right?

The way I see it, the current situation will just remain to be in place.

That means that foreign law enforcement have to use the 'regular' requests for legal assistance from the other member states, regardless of whether the requesting state has implemented eEvidence or not. To my understanding, the biggest change that is now being implemented, is having a technologically more advanced way of issuing such orders.

You should not be committing a crime now, or after eEvidence implementation, regardless.

concept

The US has laws similar to this, that is why OVH created a separate entity in the US.

Mainfrezzer

5. Member States shall ensure that both the designated establishment or the legal representative and the service provider can be held jointly and severally liable for non-compliance with obligations deriving from the applicable legal framework upon the receipt of decisions and orders falling within the scope laid down in Article 1(2), so that each of them may be subject to penalties for non-compliance by any of them. In particular, Member States shall ensure that it is not possible for the service provider or the designated establishment, or the legal representative where applicable, to use the lack of appropriate internal procedures between the service provider and the designated establishment or the legal representative as a justification for non-compliance with those obligations. Joint and several liability shall not apply for actions or omissions of either the service provider or the designated establishment, or the legal representative where applicable, which constitute a criminal offence in the Member State applying the penalties.

that bit is a tat crazy after reading it.

How the fuck do they think thats remotely okay.

rpqu

@Mainfrezzer said:

5. Member States shall ensure that both the designated establishment or the legal representative and the service provider can be held jointly and severally liable for non-compliance with obligations deriving from the applicable legal framework upon the receipt of decisions and orders falling within the scope laid down in Article 1(2), so that each of them may be subject to penalties for non-compliance by any of them. In particular, Member States shall ensure that it is not possible for the service provider or the designated establishment, or the legal representative where applicable, to use the lack of appropriate internal procedures between the service provider and the designated establishment or the legal representative as a justification for non-compliance with those obligations. Joint and several liability shall not apply for actions or omissions of either the service provider or the designated establishment, or the legal representative where applicable, which constitute a criminal offence in the Member State applying the penalties.

that bit is a tat crazy after reading it.

How the fuck do they think thats remotely okay.

Because they can get away with crazy shit.
PSA: vote for party/individual that reject chat control