New Technologies in International Law / Tymofeyeva, Crhák et al.

obtained through the EPO can be divided into the following categories: subscriber data, traffic data or content data (Art. 3:8 EPOR). In addition, the Regulation also refers to the category of “data requested for the sole purpose of identifying the user”. This includes IP addresses and the corresponding source ports, as well as timestamps, i.e. the date and time, or the technical equivalents of these identifiers, i.e. metadata relating to the mere fact of using a network service, but not relating to specific activities. According to the Regulation, subscriber data or data requested for the sole purpose of identifying the user may be requested in all cases of criminal offences as well as for the execution of a custodial sentence or a detention order of at least four months (Art. 5:3). 164 On the other hand, the conditions for issuing an EPdO to obtain traffic or content data are more restrictive, as it is limited to proceedings for criminal offences punishable in the issuing State by a maximum penalty of at least three years’ imprisonment and other offences referred to in specified EU Directives 165 , if they are committed in whole or in part by means of an information system, as well as the execution of a custodial sentence or detention order of at least four months imposed for such offences (Article 5:4). The following paragraphs of Article 5 impose further restrictions on the issuance of the EPdO. These include restrictions on data stored or processed as part of an infrastructure provided to a public authority, data protected by professional privilege and other immunities or privileges granted under the law of the executing State, or data subject to rules on the determination and limitation of criminal liability relating to freedom of the press or freedom of expression. Unlike an EPdO, an EPsO is a decision that orders only the preservation of electronic evidence and the prevention of its removal, deletion or alteration for the purposes of a subsequent production order or request for production via EIO or MLA. It is therefore a preliminary measure which does not, at this stage, result in the transmission of the requested data to the issuing authority. The issuing of an EPsO is therefore subject to a lower degree of formal rigour. It can be issued for all offences for which it could have been issued under the same conditions in a similar domestic case, provided that it is necessary and proportionate for the purpose of the case (Art. 6:2 and 6:3 EPOR). The scope of the information requested also determines the circle of authorities empowered to issue specific orders, in particular the EPdO. In fact, given the direct nature of the orders and the fact that they are generally not subject to prior scrutiny by the official body of the executing State, the European legislator has made the involvement of the judicial authority mandatory for certain orders. Thus, an EPdO to obtain subscriber data or data requested for the sole purpose of identifying the user may be issued by a judge, a court, an investigating judge or a public prosecutor competent in the case, or validated by them if issued by another competent authority as defined by the issuing State. However, an EPdO to obtain traffic or content data can only be issued or validated by a judge, a court or an investigating judge (Art. 4:1 and 4:2 164 With the exception of decisions rendered in absentia , in cases where the person convicted absconded from justice. 165 This includes fraud and counterfeiting of non-cash means of payment, sexual abuse and sexual exploitation of children and child pornography, attacks against information systems and terrorism-related offence.

53