Law enforcement agencies in the UK will shortly have new powers to compel banks in other parts of the world to disclose the electronic data that they store.

On 12 February, the UK's Crime (Overseas Production Orders) Act 2019 came into force. Its aim is to help law-enforcement agencies speed up the process of obtaining disclosures of electronic data stored outside the UK for use in criminal and regulatory investigations and prosecutions in the UK. Although the Act is in force, law enforcement agencies cannot yet use it because it can only operate where there are, in place, “designated international co-operation arrangements” which provide for mutual assistance in connection with investigations or the prosecution of offences. Such designated co-operation arrangements will, in time, be ratified and designated by the Secretary of State. It is understood that the first such designated co-operation agreement is likely to be agreed between the UK and the United States.
 
So, what’s the big deal?

Historically, the production of evidence from overseas for use in British prosecutions has been a long, drawn-out and uncertain process. British law-enforcement agencies have had to rely on the provisions of Mutual Legal Assistance Treaties (MLATs) which can take months, sometimes years, to bear fruit in every case. For some British law enforcement agencies, the only means to a quicker process has been through the ability to find some corporate presence in the UK or some unwitting officer or individual whom the authorities can serve with process in the UK.

Criminal wrongdoing is, more than ever before, taking on an international dimension. Moreover, the physical location of evidence has become a more common and complex issue with the predominant use of electronic communications and the plethora of communication platforms and applications available to the public. Although British law enforcement agencies have effective means of gathering electronic data in the UK, they are currently stuck with the slow and cumbersome MLAT process if they want to obtain evidence from abroad.

So what are OPOs?  

British law enforcement agencies (which include the Serious Fraud Office, the National Crime Agency, the police, HM Revenue and Customs and the Financial Conduct Authority) can apply to the Crown Court for an Overseas Production Order (OPO) to require a person based overseas to produce or provide access to electronic data, regardless of the location in which it is stored.

In making an OPO, the judge in question must be satisfied that there are reasonable grounds for believing that:

• the person against whom the order is sought operates or is based in a country outside the UK which is a party to, or participates in, a designated co-operation arrangement;
• an indictable offence has been committed and proceedings in respect of the offence have been instituted or the offence is being investigated;
• the person against whom the order is sought has possession or control of all or part of the electronic data;
• all or part of the electronic data sought is likely to be of substantial value to the proceedings or investigation;
• all or part of the electronic data sought is likely to be relevant evidence in respect of the indictable offence committed or the offence being investigated;
• it is in the public interest for all or part of the electronic data sought to be produced.

The Act does provide for the protection from disclosure of legally privileged data and confidential personal records.

A person who has been served with an OPO will have 7 days in which to produce or give access to the electronic data that British authorities seek. He/it (or indeed any interested party) will be able to challenge the OPO but only by applying to the issuing court in the UK – he/it can no longer challenge the disclosure requirement in his/its own local courts.
 
So this is a good thing - right?

In true fence-sitting style, my answer is both yes and no. For the law enforcement agencies, of course, the answer is yes. It will speed up the process by which they obtain important electronic evidence for use in investigations and prosecutions. The electronic data that they will obtain through an OPO will be directly admissible in criminal proceedings.  Their problem is that, unfortunately, international fraudsters can be quite sophisticated and will be forever driven to use more creative and devious means through which to orchestrate their schemes.

For the persons who are probably going to be the most common recipients of an OPO: social media platform providers, encrypted communication services providers, telecommunications service providers, the answer is most likely yes and no in equal measure.  On the one hand, they are subject to clear provisions that takes the substance of the decision out of their hands.  However, it does create an extra burden in considering issues such as legal privilege and what constitutes confidential personal records.

For the subjects of criminal investigations and prosecutions, of course, it is a bad thing. However, let us pause here for a second. Not every subject of an investigation or prosecution is a bad person. One wrinkle in the Act is that OPOs can be obtained without notice to the subject. This prevents the subject from being able to make representations to the issuing court about the compulsion of the electronic data before it is disclosed to the British law enforcement agency. That in itself is no major change to the regime because evidence obtained under an MLAT is, more often than not, obtained under a necessary veil of secrecy, especially if it occurs at the investigatory stage. However, if evidence obtained by an OPO becomes admissible in criminal prosecutions without qualification, it could become a very big deal for a subject who, it would appear, is no longer able to challenge admissibility.

Great, so OPOs look like a pretty cast-iron way to compel people to disclose electronic evidence, right?

Yes they do – or rather they will, once designated co-operation arrangements are in place. In real terms, the Act creates a tool that British law-enforcement agencies will be able to use to obviate legal and technical obstacles which have surrounded the compulsion of electronic evidence where the ability to actually locate that data has become ever more complex.

The only potential issue for British law-enforcement agencies is the lack of an effective sanction for non-compliance with an OPO – contempt of court is all that the directors of the person served with an OPO have to fear if they fail to comply. Although contempt of court is no laughing matter, it has little effect on a director located in a different jurisdiction who cannot be extradited for it. Of course, there are reputational issues to consider and, for companies that operate globally, not co-operating with criminal authorities may cause unwanted criticism or scrutiny.  

One final point arises in relation to the nature of electronic evidence. Unlike physical evidence, it is not static. It can change when accessed or processed. Presently, the Act requires a person who has been served with an OPO not to “conceal, destroy, alter or dispose of” the electronic data. “Alter” may become an issue in cases where accessing or processing data leads to alterations to it.

Once OPOs become effective, there will undoubtedly be problems for the new regime and challenges to it. It remains to be seen whether these arise from the issues that we have identified, or from others.

* Jonathan Brogden can be reached on +44 (0)20 7894 6290 or at jbrogden@dacbeachcroft.com