UK courts can now order US entities to provide electronic data to UK law enforcement, under a new 'landmark' US UK data sharing agreement.

The agreement has been heralded as a step towards removing barriers that can prevent speedy disclosure of electronic data and impede cross-border law enforcement. The US UK agreement is expected to be the template for similar bilateral agreements in future. But should we be concerned about how easily the authorities can access this data, and are there sufficient checks and balances in place to ensure it is used judiciously?

A 'landmark' data access agreement

On 28 February 2020, the US-UK Agreement on 'Access to Electronic Data for the Purpose of Countering Serious Crime' came into force. The Agreement is a designated international co operation arrangement under the UK's Crime (Overseas Production Orders) Act 2019 (the 2019 Act). Together with the 2019 Act, it enables UK law enforcement to obtain overseas production orders (OPOs) in the UK courts against service providers operating or based in the US. An OPO requires the service provider to produce or provide access to specified electronic data, wherever it is stored. A service provider will be in scope if it is a private entity that provides the public with communications or data storage / processing services, or if it stores or processes data on behalf of such entities.

The Agreement also enables US law enforcement to obtain data from UK service providers, building on the framework established by the US Cloud Act. However, the biggest service providers are located in the US, meaning that UK law enforcement are the principal beneficiaries of the Agreement.

Previously, in order to obtain material held overseas by non-UK entities, UK authorities had to request mutual legal assistance (MLA) from local authorities. As acknowledged in the Explanatory Memorandum to the Agreement, the MLA process requires considerable resources and it can often be several months or even years before the material sought is produced, which can impede a criminal investigation or prosecution.¹ The Agreement and 2019 Act speed this up dramatically. Under the 2019 Act, once an OPO is served (which must be within three months of being issued by the UK court), the material must be produced within seven days, although this may be made longer or shorter by the issuing judge.

It is important to note that the Agreement and the 2019 Act do not specify penalties for failing to comply with an OPO. A US company's refusal to comply with an OPO could lead to its directors being in civil contempt of court, which is punishable by a fine or imprisonment. However, as confirmed by the UK's Supreme Court,² civil contempt of court is not an extraditable offence, and it is unlikely in practice that such penalties could be enforced against a director who remained outside the UK courts' jurisdiction (although a director who came within the jurisdiction – e.g. on a UK business trip – could be exposed to enforcement action). It should also be borne in mind that the MLA process is still available to UK / US authorities and could (if used) result in an order being made against the US provider by a US court.

The 2019 Act is designed to provide the one size fits all framework for OPOs, but the substance of how any particular agreement should operate is to be found in the bilateral treaties that may be agreed between States. As a result, it is possible that the OPO regime may operate slightly differently depending on the terms of the applicable designated international co operation agreement. As such, it is interesting to see that the 2019 Act and the Agreement are not perfectly aligned. For example, under the Agreement, an OPO may be made in relation to any 'serious crime', which is defined as an offence with a maximum penalty of at least three years' imprisonment. Under the 2019 Act, an OPO may be made in relation to any indictable offence.³

An interesting feature is the status of encrypted material. The Agreement makes no mention of the format in which the material is to be provided. The 2019 Act requires that the electronic data is produced or accessible in a visible and legible form, which suggests material must be decrypted. However, in English law, accessing encrypted data is governed by Part III of the Regulation of Investigatory Powers Act 2000 (RIPA). The DOJ has addressed the question of decryption under the US Cloud Act, which it described as 'encryption neutral' and not creating '…any new authority for law enforcement to compel service providers to decrypt communications. Neither does it prevent service providers from assisting in such decryption, or prevent countries from addressing decryption requirements in their own domestic laws.'⁴  In short, despite the wording of the 2019 Act, if encrypted material is provided, the UK authorities must turn to the provisions of RIPA.

What safeguards exist?

Sewn into the Agreement are a number of safeguards that limit the scope of this new regime. For example, there are targeting restrictions, which include a prohibition on OPOs that may be used to infringe freedom of speech or to disadvantage certain groups, and a prohibition on issuing an OPO on behalf of a third country, or the US / UK sharing any data received with a third country without the other's consent. Importantly, the Agreement also prohibits OPOs that seek to obtain data or information about certain categories of persons in the receiving country. For example, UK courts cannot issue an OPO in order to get data or information about a US corporation, US citizen, national or permanent resident, or any person located in US territory.

The OPO must be targeted at specific accounts and identify its objective. OPOs must also be subject to review or oversight by a judicial body or independent authority.

The Agreement also envisages the designation of an authority by the UK's Home Secretary, which will transmit the OPOs. The Agreement requires that the designated authority review an OPO to ensure it complies with the Agreement. This requirement is satisfied by section 9 of the 2019 Act, by which the Home Secretary has designated herself as the relevant authority. This should ensure that any variation between the Agreement, or other designated co operation arrangement, is reconciled. In addition, the remedy of judicial review against the Home Secretary's decision to transmit the OPO remains available.

Notwithstanding the availability of judicial review, one of the criticisms of the 2019 Act is that an application for an OPO may be made without notice, and the tight timetable for the production of material sought does not allow much time for a legal challenge. The 2019 Act allows an issuing judge to include a non disclosure requirement in an OPO, which prevents the recipient from disclosing the existence of the order or its contents to any person without the leave of a judge or written permission from the law enforcement officer who obtained it. The service provider who receives the OPO is likely to be a neutral party in any criminal investigation or prosecution, and there does not appear to be any good reason for the absence of a notice requirement in order to allow a challenge to be made prior to the OPO being issued. As currently drafted, a recipient of an OPO may receive – but is not entitled to – notice, and is likely to first become aware of the OPO when it is served.

Another concern is the lack of clarity about the oversight mechanism. The 2019 Act provides for an application to be made to vary or revoke an OPO. The recipient of an OPO, as a 'person affected by the order', can make the application, which must be based on one of the specified grounds. In short, it must be demonstrated that the requirements for making an OPO under the 2019 Act have not been met.

The Agreement provides for an additional process for raising an objection that is not mentioned in the 2019 Act. It provides that an objection in the first instance should generally be made with the designated authority in the issuing state, in the UK, the Secretary of State, in a reasonable time after receipt of the OPO. The Secretary of State is required to respond to those objections and, if not resolved, the objections may be raised with the designated authority in the receiving state. The two designated authorities can then confer 'in an effort to resolve' the objections. Whether the recipient of the OPO will be privy to this process of decision making is unclear.

Another significant safeguard is that an OPO must not conflict with domestic data privacy laws. This means that a UK recipient of an OPO must also comply with GDPR obligations (as incorporated into UK law following the end of the Brexit transition period). In addition, the UK will not provide data where it is to be used in relation to an offence attracting the death penalty, and the US will not provide data in relation to targeted US persons (as noted above) or in relation to specific offences that may raise freedom of speech concerns.⁵  The 2019 Act also prohibits UK authorities seeking to obtain legally privileged information or certain types of confidential personal data (e.g. relating to an identifiable individual's health).

How will the data access agreement work in practice in the UK?

Under the 2019 Act, the Serious Fraud Office, the Financial Conduct Authority, Her Majesty's Revenue and Customs, the police or any other "appropriate officer"⁶  can apply to the court for an OPO.

To be successful, the enforcement authorities will need to satisfy a UK judge that, among other things, the intended recipient of the OPO has possession or control of the data, that the data is likely to be of "substantial value" to the investigation or proceedings and that accessing or producing the data is in the public interest.

If the application is successful and the order is granted by the UK court, the Secretary of State will serve it directly on the recipient.

As noted above, failure to comply with the OPO could constitute a civil contempt of court, which could result in a potential fine or up to two years in prison for the receiving entity's directors (although enforcement is likely to be challenging).⁷ In practice, the prospect of reputational damage is likely to be a more immediate concern for the receiving entity.

Where the OPO recipient chooses to comply, the seven day deadline for producing the data is likely to exert significant pressure, particularly as the burden will fall on them to identify and exclude data that may be privileged, confidential or subject to GDPR concerns. All of this has the potential to be overly burdensome for companies that possess and control vast amounts of electronic data.

A new reality for criminal investigations?

The Agreement will remain in place for five years and whether it proves to be as useful as it was proclaimed will be proven by how many OPOs are issued, how prolific they are and the success of any challenge. In practice, UK based law enforcement authorities should be able to get access to data held abroad more quickly and more easily than ever before. However, this will depend on the willingness of US service providers to comply with OPOs (given the limited consequences for non compliance) and the extent to which relevant data is encrypted. 

As it currently stands, no OPOs have been publicly reported, and the relative lack of 'teeth' may mean that law enforcement have to resort to the previously used and cumbersome MLA process in some instances. The OPO is novel and perhaps imperfect, but it is part of the drive to ensure swifter and less bureaucratic access to data relevant to criminal investigations. Although not yet concluded, the EU is in the process of negotiating a similar agreement with the US to create a European Production Order (EPO), in recognition of the fact that more than half of all criminal investigations include a cross border request to access electronic evidence. Imperfect or not, OPOs or similar powers are here to stay in one form or another. Although in the US, data access agreements are made under the US Cloud Act, the OPO regime and any future EPO framework may differ, so companies with operations in different jurisdictions will have to become familiar with both.

If OPOs do become the favoured process, companies that store vast amounts of electronic data would do well to prepare now. Communications service providers and companies that store or process data must be ready to respond at short notice. Mapping out cloud data, knowing and documenting where data is stored and being sure that people in the business are keeping this information up to date will be essential. A good understanding of legal privilege and data protection legislation will be necessary, too.

No company (or shareholder) wants directors or officers held in contempt of court, but it would be wise to decide upon the strategy to be adopted, as very little time will be permitted to 'take stock' once an OPO has been served. There is a balance to be struck between the reputational damage caused by a finding of contempt and being seen as obstructive to investigations involving what may be very serious crimes, including terrorism and child sex abuse, and undermining consumer confidence.

Should an OPO be challenged, complied with or ignored? This is the question many service providers will have to grapple with. Responding will require flexibility and a framework for action that ensures the most suitable response, whilst also taking into account the lingering background presence of the slow but sharp-toothed MLA process.

_{1 'Explanatory Memorandum to the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime'.
2 R v O' Brien [2014] UKSC 23.
3 An indictable offence in English law is any offence which may be tried on indictment in the Crown Court. These include offences with a maximum penalty of less than three years' imprisonment.
4 White Paper 'Promoting Public Safety, Privacy and the Rule of Law Around the World: The Purpose and Impact of the Cloud Act, April 2019.
5 'Understanding in relation to the Death Penalty under the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Criime'
6  Section 2 of the 2019 Act.
7  Section 15 of the 2019 Act}

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2020 White & Case LLP