Overseas production orders: speeding up the authorities’ ability to obtain data from abroad

Overseas production orders (OPO) will give law enforcement agencies the ability to obtain electronic data from service providers outside the UK that can then be used for criminal investigations and prosecutions. As a new legal development, they are likely to be of great value to investigators.

Introduced by the Crime (Overseas Production Orders) Act 2019, which received Royal Assent in February, OPOs will enable UK law enforcement agencies to gain access to electronic data based abroad much more speedily. Although not yet in force, when they are operative they will represent a major change from the system of mutual legal assistance that the authorities previously had to rely on.

In introducing the concept of OPOs, the Home Office stated that the government believed that investigating authorities required them in order to detect, investigate and secure convictions in serious criminal cases. It argued that there was a need to make the gathering of electronic evidence quicker and more reliable.

Before the Act was passed, law enforcement agencies’ dependence on mutual legal assistance channels saw it take anywhere between six months and a matter of years to obtain electronic evidence from abroad. This could obviously have a detrimental effect on a time-sensitive investigation or a prosecution. An OPO will enable an agency to gain access to data such as messages, files and pictures within days or weeks.

Under the new process, a person classed as an appropriate officer must apply to the Crown Court for an OPO. An appropriate officer means a police officer, an officer of HM Revenue and Customs, a member of the Serious Fraud Office, an accredited financial investigator, a counter-terrorism financial investigator or a person appointed by the Financial Conduct Authority under section 168(3) or (5) of the Financial Services and Markets Act 2000 to conduct an FCA Investigations" href="/expertise/financial-conduct-authority-fca-investigations/">investigation.

The process involving OPOs brings data that is stored abroad by companies into line with existing procedures for obtaining data that is kept in the UK.

The OPO Process

When the application for an OPO is made before a judge, the applicant must identify the designated international co-operation arrangement under which the application is made and specify or describe the electronic data for which the order is sought. For the purposes of this Act, a designated international co-operation arrangement means a relevant treaty which relates - in whole or in part - to the provision of mutual assistance in connection with the investigation or prosecution of offences and is designated by the Secretary of State by regulations. 

An OPO can only be used by a UK law enforcement agency where there is such an international cooperation arrangement in place between the UK and that country where the holder of the electronic data is based or operates. In anticipation of the UK introducing OPOs, the US passed the CLOUD (Clarifying Lawful Overseas Use of Data) Act in preparation for an agreement on data access between the two countries. While such a UK-US agreement is believed to be close to completion, it is not yet in place. This agreement could prove vital because the US holds an estimated 90% of the data likely to be obtained by OPOs and because it would be the first international co-operation arrangement concluded that would enable OPOs to be used. The European Union has introduced the European Production Order as part of a series of measures to enhance use of electronic evidence, although any Brexit agreement may have an impact on if and how this applies to OPOs. 

Conditions Required for an OPO 

An OPO can only be made if the applicant is able to meet certain conditions. 

An OPO may be made against a person in respect of electronic data if the judge is satisfied that that person operates in, or is based in, a country outside the United Kingdom which is a party to the designated international co-operation arrangement specified in the application for the order. 

The judge must also be satisfied that there are reasonable grounds for believing that: 

•  An indictable offence has been committed and proceedings in respect of the offence have been instituted or the offence is being investigated - or the order is sought for the purposes of a terrorist investigation. This is a much lower requirement than Section 20 (2) of the Investigatory Powers Act 2016, which had said that the minimal threshold for authorities to access data was if it was in the interests of national security, the prevention or detection of serious crime or in the interests of the economic well-being of the United Kingdom.
• The person against whom the order is sought has possession or control of all or part of the electronic data specified or described in the application for the order.
•  All or part of the electronic data specified or described in the application for the order is likely to be of substantial value to the proceedings or investigation.
•  All or part of the electronic data specified or described in the application for the order is likely to be relevant evidence in respect of the offence; although this requirement does not apply if the OPO is sought for a terrorist investigation. 
•  It is in the public interest for all or part of the electronic data specified to be produced because of its potential benefit to the criminal proceedings or investigation.

When making an application for an OPO, the applicant must specify the person who should be presented with or given access to the data mentioned in the order and the time period by which this should be done.

The data has to be to be produced within seven days of the OPO being served on the subject, unless a different length of time is specified when the OPO is granted.

Electronic data produced in compliance with an OPO may be retained for so long as is necessary in all the circumstances. This includes retaining it so that it can be used as evidence in proceedings in respect of an offence. 

If the applicant or anyone affected by the OPO wants to vary or revoke it, they must return to court and meet many of the same conditions that had to be met in the original application.

Restrictions on OPO Use 

While OPOs are likely to be viewed by agencies as a much-needed step forward, they are not without their limitations. 

It should be recognised that OPOs cannot be used for any purpose. Prior to their introduction, the Home Office spoke of OPOs being subject to robust safeguards and that any judge deciding to grant one would consider a subject’s right to privacy. 

An applicant for an OPO must not specify or describe in the application electronic data that he or she has reasonable grounds for believing consists of or includes excepted electronic data. Excepted electronic data means electronic data that is subject to legal privilege or is a confidential personal record, such as records relating to a person’s physical or mental health.

The applicant is also not allowed to use the OPO indefinitely. An OPO that is not served within three months of the day it was made is to be treated as if it had been quashed immediately after the end of that period.

Restrictions on the Subject of an OPO

While the case that has been made for OPOs centres on the fact that they make it easier to obtain electronic data from abroad quicker, they place a number of restrictions on anyone who is the subject of one.

If someone is served with notice that an application has been made for an OPO that relates to that person’s data, they must not conceal, destroy, alter or dispose of any of the electronic data specified or described in the application. They are also not allowed to tell anyone that the application has been made or discuss its contents with anyone.

In making an OPO, a judge can include a non-disclosure requirement. This prevents the person against whom the order is made from disclosing that it has been made or divulging its contents to anyone unless they have the permission of a judge or the written permission of the appropriate officer who applied for the order.

An OPO that includes a non-disclosure requirement must specify or describe when the requirement is to expire. But even if an OPO that includes an unexpired non-disclosure requirement is revoked, the judge can order that the person against whom the order was made is still subject to the nondisclosure requirement.

Yet an application for an OPO can be made on a without-notice basis, unless there are reasonable grounds to believe that the data created or acquired is for the purposes of journalism and stored by or for the person who created or acquired it. It may be the case with many OPOs, therefore, that the subject is unaware of the application being made. 

There is little doubt that OPOs could be what the Americans would call a “game changer’’ when it comes to obtaining data. But as yet the penalties for failing to comply with one are unclear and their use will depend on a network of designated international co-operation arrangements being in place.

This article was published on Lexology.com.