New Technologies in International Law / Tymofeyeva, Crhák et al.

1:1 EPOR). This provision is particularly important because, as mentioned in the preamble to the Regulation, in many cases data will no longer be stored or otherwise processed on a service provider’s or user’s device, but will be made available on a cloud based infrastructure. As a result, providers of such services do not necessarily need to maintain servers in a particular jurisdiction. Indeed, some European branches of global IT companies and service providers, unwilling to cooperate with judicial and law enforcement authorities, have refused to execute EIOs on the pretext that the requested digital data is not physically located in the country to which the order is directed. 162 This excuse will no longer be accepted under the EPOR, while the application of its provisions will not depend on the actual location of the service provider’s establishment or of the data processing or storage facility, as it will apply generally to all service providers offering services in the EU (Art. 2:1 EPOR). For this purpose, the term “providing services” is understood as enabling natural or legal persons in a Member State to use the ICT services 163 and having a substantial connection with the Member State, based on specific factual criteria, which is deemed to exist if the service provider has an establishment in a Member State or, in the absence of such an establishment, if there is a significant number of users in one or more member states, or if the activities are directed towards one or more member states (Art. 3:4 EPOR). Another revolutionary aspect of EPOs is the way in which they are delivered to the addressee. In fact, the above-mentioned orders, like EIOs, are to be transmitted by means of standard forms (called “certificates”). However, unlike the EIO forms, these certificates are to be addressed directly to the designated establishment or to the legal representative designated or appointed by the service provider in digital form (Art. 9:1 EPOR), as all written communication between the competent authorities and the addressees of the orders should, as a rule, be carried out through the decentralised IT system (Art. 19:1 EPOR). 3. Conditions for issuing EPOs Due to the different nature of the two orders, the conditions for their issuance are different. Of the investigative instruments discussed, the EPdO has the most significant consequences, as it obliges the addressee both to preserve digital evidence and to hand it over to the foreign issuing authority. As a general rule, the EPdO can only be issued if it is necessary and proportionate for the purpose of the case in question, taking into account the rights of the suspect or accused person. Furthermore, the EPdO may only be issued if a similar order could have been issued under the same conditions in a similar domestic case (Article 5:2 EPOR). It is also important to note that the admissibility of the order depends on the scope of the information requested. The electronic evidence that can be 162 Tosza S, ‘All Evidence is Equal, but Electronic Evidence is More Equal Than Any Other: The Relationship Between the European Investigation Order and the European Production Order’ (2020) 11(2) New Journal of European Criminal Law 161. 163 For the purposes of the EPOR, this category covers (a) electronic communications services as defined in Article 2, point (4), of Directive (EU) 2018/1972; (b) internet domain name and IP numbering services and proxy services; (c) other information society services as referred to in Article 1(1), point (b), of Directive (EU) 2015/1535 that enable their users to communicate with each other or make it possible to store or otherwise process data on behalf of the users (Art. 4:3 EPOR).

52