Effective data protection and direct cooperation on digital evidence

Abstract

This chapter for the Cambridge Handbook of Digital Evidence in Criminal Investigations (CUP, 2023) explores the relationship between EU data protection law and public-private ‘direct cooperation’ on digital evidence in criminal investigations. It asks whether a prima facie neat separation between the GDPR and the LED always matches the realities of private-to-public data transfers for criminal investigations, and questions whether that legal framework is sufficiently harmonious to warrant description as an EU data protection acquis. The chapter distinguishes scenarios of formal (and informal) direct cooperation, viewing those scenarios through the conceptual prism of data controllership. That frame is then applied to the European Commission’s 2018 ‘e-Evidence package’, along with the other co-legislators’ competing visions, before a first look at the final 2023 compromise text from a data protection perspective. The chapter analyses the extent to which CJEU case law illuminates theoretical blind spots, and critically discusses whether the ongoing strengthening of enforcement powers is likely to herald not only greater legal certainty on the supply of digital evidence but also meaningful, workable data subject rights. The chapter closes with a reflection on the future place of EU data protection standards within the Council of Europe’s own new direct cooperation mechanism – that of the Second Additional Protocol to the Budapest Convention.