I spoke earlier at the #DataSummitDublin about cross-border access to data by police. It was a relatively short presentation (and I was a bit rushed by arriving late!) so there might be a couple of points worth expanding on. 1/
First - notification. A big issue in the caselaw and for surveillance oversight is whether individuals are notified that they have been put under surveillance or their data accessed. I’ve covered that here (p.12 on): researchrepository.ucd.ie/bitstream/1019… 2/
Does the Commission e-evidence proposal address that? It does provide for notification in some circumstances. 3/ 
But that appears to leave notification in other circumstances to the discretion of the service provider. Some are good at notifying, others aren’t; this doesn’t seem to oblige them to notify. 4/
The second big issue is that of abusive requests. What happens if an authoritarian regime seeks access to data on an opponent which is held elsewhere in the EU? 5/
The e-evidence proposal provides, essentially, that it’s the job of the company which receives a production order to determine if it’s abusive. 6/
But there are two problems with this. First - in principle is it correct that the private company should be the human rights gatekeeper? Second - practically, how can the company do that based on the "sole information” in the order? 7/
Realistically, is the order going to make it clear that it is abusive? Or is it going to be written in a way which is facially plausible? Does the proposal stop the company taking into account wider information such as EU findings re the govts in HU/PL? 8/
Third - the e-evidence proposal isn’t a panacea for Ireland. It’s focused on data access by police in other EU member states. It doesn’t in itself solve the problem that domestic Irish law doesn’t have a specific framework for data access, leaving it to a mishmash of powers. 8/
If nothing is done at local level, the e-evidence scheme could become just another layer running in parallel with the unsatisfactory domestic law. (And its requirements could be evaded by using the domestic law instead.) 9/
Finally, it’s worth remembering that almost all telecoms data access in Ireland is based on legislation which a former Chief Justice has found to be an illegal form of mass surveillance. We’re still storing up problems, and convictions which may ultimately be overturned. 10/10
