New Technologies in International Law / Tymofeyeva, Crhák et al.

EPOR), whereby the powers of the public prosecutor to issue an EPdO independently are limited in comparison to the EIO. As in the area of material scope, the European legislator has opted for a less restrictive approach with regard to the group of bodies authorised to issue an EPsO. The order can be issued or confirmed by a judge, a court, an investigating judge or a public prosecutor, regardless of the type of data requested (Art. 4:3 EPOR). The Regulation also makes it possible – in emergency cases 166 – to issue any EPsO or EPdO to obtain subscriber data, or to obtain data requested for the sole purpose of identifying the user, by the non-judicial authorities without their prior validation, if this cannot be obtained in time and if these authorities could issue an order in a similar domestic case. In such cases, however, the order must be validated within 48 hours at the latest, on pain of its immediate revocation and the restriction of the use of the data obtained (Art. 4:5 EPOR). 4. Execution of EPOs As mentioned above, the orders under discussion are to be transmitted directly to their addressees by means of certificates, namely EPOCs for European Production Orders and EPOC-PRs for European Preservation Orders, the templates for which are annexed to the Regulation. Obviously, the procedure for the execution of the orders varies according to their type and may involve the subsidiary participation of the competent authorities, including in particular a specific category of “enforcing authority” - the authority of the executing State which, according to its law, is competent to receive the orders and certificates for notification or for their enforcement in case of unjustified refusal of execution by the addressee. The detailed EPOC enforcement procedure is set out in Art. 10 of the EPOR. It starts with the receipt of a certificate by the addressee, who must in any case immediately take the necessary measures to preserve the requested data. However, the subsequent steps depend on the nature of the data requested. Pursuant to Art. 8:1, the EPOC related to the EPdO issued to obtain traffic or content data is the subject of a notification addressed to the enforcing authority, by transmitting the certificate to this authority at the same time as to the addressee. 167 In such cases, the enforcing authority has 10 days to analyse the order and to raise one of the grounds for refusal listed in Art. 12:1 EPOR: – the data requested are protected by immunities or privileges, or are covered by rules for the determination or limitation of criminal liability relating to freedom of the press or freedom of expression, which prevent the execution or enforcement of the order; 166 Defined as a situation where there is an imminent threat to the life, physical integrity or safety of a person, or to a critical infrastructure, as defined in Article 2, point (a), of Directive 2008/114/EC, where the disruption or destruction of such critical infrastructure would result in an imminent threat to the life, physical integrity or safety of a person, including through serious harm to the provision of basic supplies to the population or to the exercise of the core functions of the State (Art. 3:18 EPOR). 167 With the exception of the cases in which, at the time of issuing the order, the issuing authority has reasonable grounds to believe that the offence has been committed, is being committed or is likely to be committed in the issuing state and the person whose data are requested resides in this state.

54