Chapter 13 focuses on Luxembourg, which sits near the top of several regional and international indexes for ICT development, digital economy and society, and technological readiness, and hosts an impressive and growing number of data centres along with the regional or global headquarters of major internet and e-commerce players. The country’s small size, highly connected nature and financial strength translate into the active cooperation of service providers in criminal investigations in both domestic and cross-border situations. Drawing on interview-based research, this chapter provides an international audience with a targeted overview of the Luxembourg legal framework, the ways in which it has adapted to developments at the international and EU levels (Budapest Convention, European Investigation Order, Law Enforcement Directive) and the practical as well as legal challenges relating to the various forms of cooperation between service providers and law enforcement authorities. It offers a comprehensive, up-to-date picture of national data retention rules and discusses the potential impact of the new European Production Order on service providers in Luxembourg.

Chapter 12 analyses Irish law on police access to digital evidence. It outlines the domestic legal framework regarding data retention, interception of communications and access to stored data. It then considers the law governing cross-border requests for data. It assesses the extent to which these rules are adequate for law enforcement purposes and whether these rules are compatible with the European Convention on Human Rights, the Charter of Fundamental Rights and data protection standards.

Chapter 15 looks at the new set of investigative measures introduced by the reform of the Criminal Procedure Code in Spain, in 2015, which changed completely the approach to the investigation of cybercrime, transformed now into one of the most modern in Europe. The new regulation introduced the latest high-tech investigative tools, imposing a complete set of duties of cooperation on all internet service providers. However, the Spanish legislator failed to amend the domestic legal framework on electronic communications data retention, and so it is not compatible with the jurisprudence of the Court of Justice of the EU. This chapter describes the rules as developed and applied by the Spanish courts, before and after the amendments of the Criminal Procedure Code 2015, and several subsequent laws on digital data that, since then, have been adopted in reaction to the EU’s legal framework in the field.

Chapter 16 comparatively examines the national legislation in EU member states in order to reveal common patterns and differences in legal rules and their practical application with respect to gathering digital evidence for the purpose of criminal investigations. The study is essentially based on the information provided in the preceding book chapters, covering seven national legal systems selected for this research: Belgium, Estonia, Germany, Ireland, Luxembourg, Poland and Spain. The comparative analysis investigates not only the rules on access to digital evidence but also their broader legislative context. Indeed, before analysing how data can be obtained, it is important to understand the legal terminology and categorisations used in the different legal systems, as well as the national rules on data retention in light of the case law of the Court of Justice of the EU.

Chapter 9 analyses the extent to which lawmakers have taken the peculiarities of e-evidence into account and highlights flaws in the resulting legal regime. It addresses the Belgian preservation of general data retention and the possibility to use unlawfully retained and/or accessed data. Next, it delves into the wide spectrum of duties for (internet) service providers to cooperate in criminal proceedings. It discusses the broad interpretation of the territorial scope of the Yahoo! and Skype case law from Belgian courts and its codification in subsequent legislation, including how voluntary cooperation with law enforcement remains important in practice. It briefly examines the legal framework for cross-border cooperation, often perceived as ineffective and needlessly time-consuming. Lastly, it sheds light on the potential impact of the EU e-Evidence Regulation, concluding that, under domestic legislation, a coherent, completely fundamental-rights-proof legal framework is still lacking. It shows Belgium’s support for a pan-EU regime and better international cooperation, provided its law enforcement can maintain the possibility of direct cooperation in a sufficiently effective way.

Chapter 17 discusses China’s Criminal Procedure Law, which provides a general cooperation obligation for all relevant entities, including service providers. As collecting data from service providers has become increasingly important in criminal investigations, the past decade has witnessed a certain number of laws, regulations and explanatory documents adopted to specify service providers’ cooperation obligations. This chapter systematically studies these provisions and summarizes the rich content of service providers’ cooperation obligations relating to collection of historical and real-time data in criminal investigations as well as in their daily operation. It also discusses future improvements to the current legislations, namely more protection of sensitive data, due process in evidence collection and criminal liability for service providers when cooperation obligations cannot be fulfilled. Based on China’s position of respecting data sovereignty, China requires data to be stored locally. Foreign LEAs can obtain data from Chinese service providers only via mutual legal assistance, and service providers in China are prohibited from providing data directly to foreign LEAs.

Chapter 11 explores how German criminal procedure, in the same way as German substantive criminal law, builds on a main body of legislation that was drafted in the nineteenth century. While the German Code of Criminal Procedure has been amended numerous times – also with the intention to address digital transformation and the shift to an information society – the obtaining of digital evidence (in particular from service providers), its analysis and its transformation into evidence introduced in a criminal trial remain areas with many challenges, uncertainties of legal interpretation and need of legislative reform. This chapter aims to provide an overview of core themes of digital evidence in criminal justice and the cooperation of service providers in criminal matters in Germany – in particular those that seem of most relevance to an international audience.

The rapid growth of information and communications technology over the past two decades, including email, the internet, smartphones, social media, messaging applications and global positioning systems, has enhanced our ability to obtain and share information about the world. However, in the rush to secure the latest mass-produced technology device, many people give relatively less consideration to the implications for the security of the data that they produce and the consequential impact on individual privacy. That data is of great value in the corporate sector, to inform marketing strategies; and to governments to understand the behaviour of their citizens. As was noted in Chapter 1, developments in the past decade, such as the Snowden revelations, and the activities of the former political strategy firm Cambridge Analytica, have increased awareness of the implications of inadequate privacy protections. However, the convenience of new technologies may take precedence for many.