Publications — European criminal law — 30 July 2026

From the Sky ECC litigation to the e-Evidence Regulation: towards a new European law of digital evidence

The e-Evidence Regulation, applicable from 18 August 2026, allows a judicial authority to order the production of traffic or content data directly from a service provider established in another Member State. This study measures the new scheme against the standard of effective remedy identified by the Sky ECC and EncroChat litigation.

By Naguin Zekkouti, attorney at the Paris and Lyon Bars

Introduction

On 18 August 2026, Regulation (EU) 2023/1543 of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings will become applicable throughout the Member States¹. Adopted on the basis of Article 82(1) of the Treaty on the Functioning of the European Union, this instrument allows a French judicial authority to address a production order for traffic or content data directly to a service provider established in another Member State, without any involvement of a judicial authority of the State of establishment and without that State exercising the enforcement review which had, until now, characterised every instrument of European criminal cooperation.

This shift occurs against a background of institutional tension. On 27 March 2026, the Commission sent letters of formal notice to twenty-two Member States for failure to transpose Directive (EU) 2023/1544, the deadline for which had been set at 18 February 2026². Yet that directive is the indispensable counterpart of the Regulation: it requires providers to designate the establishment or legal representative empowered to receive orders. The Regulation will therefore enter into application at a time when the infrastructure intended to ensure its reception remains, in most Member States, legally incomplete. This discrepancy is not an administrative contingency: it constitutes the first field of litigation under the new scheme.

It would nonetheless be reductive to see in it merely a technical reform of judicial cooperation. The e-Evidence Regulation belongs to a sequence whose logic must be reconstructed. A first generation of instruments — classical mutual legal assistance, international letters rogatory, bilateral conventions — rested on a State-to-State relationship, mediated by central authorities, and presupposed review exercised successively by two sovereign powers. A second generation, inaugurated by Directive 2014/41/EU on the European Investigation Order³, replaced that diplomatic logic with the principle of mutual recognition, reducing the executing State's review to an exhaustive list of grounds for refusal. It is this second generation that gave rise to the Sky ECC and EncroChat litigation, and whose limits have now been brought before the Court of Justice. The e-Evidence Regulation opens a third generation: cooperation is no longer interstate, it becomes direct, with the issuing authority addressing the service provider itself.

This displacement is not merely procedural. It alters the nature of judicial review. Where two judicial orders concurred in reviewing the measure, only one remains fully competent — that of the issuing State — while the executing State retains a residual power of objection and the service provider is invested with an unprecedented role, midway between executor and filter. Hence the question running through this study: does the Regulation organise a dejudicialisation of the obtaining of electronic evidence, or the emergence of a European judicial review of a new kind, concentrated but not weakened?

The answer cannot be deduced from the text alone. It depends on how the courts will articulate this scheme with Articles 7, 8, 47 and 48 of the Charter of Fundamental Rights and with Articles 6, 8 and 13 of the European Convention on Human Rights. Yet the litigation concerning encrypted messaging services has already, and strikingly, framed the terms of this debate — and has begun to answer it. By decision of 17 October 2024, A.L. and E.J. v. France, the European Court of Human Rights held that EncroChat users prosecuted in the United Kingdom had available to them in France, on the basis of Article 694-41 of the Code of Criminal Procedure, an effective remedy enabling them to challenge both the transmission of the data and the interception which had produced it⁴. Less than a year later, on 16 September 2025, the Criminal Chamber of the Cour de cassation stayed proceedings and referred to the Court of Justice two questions concerning the existence, in the State executing a European Investigation Order, of a remedy allowing a person prosecuted elsewhere to challenge the lawfulness and necessity of the evidence obtained. The case is pending under number C-625/25⁵.

This apparent contradiction is not one, and it constitutes the starting point of this study. The thesis defended here is that the effectiveness established in 2024 rested on three supports strictly specific to the European Investigation Order regime, none of which survives under the e-Evidence Regulation. The Sky ECC litigation was not an isolated episode: it was the laboratory of the questions the Regulation will generalise, and the standard it made it possible to identify is precisely the one the new instrument no longer satisfies.

We shall first present the scheme established by the Regulation and the break it effects with the classical model (I), before examining the still uncertain regime of fundamental rights protection which accompanies it (II), and then outlining the shape of the litigation to come (III).

I. The break with the classical model of European criminal cooperation

A. What the Regulation establishes

1. Two instruments

The Regulation creates two distinct orders⁶. The European Production Order, notified by means of a certificate known as an EPOC, requires the addressee to transmit data already stored. The European Preservation Order, notified by an EPOC-PR certificate, merely freezes the data to prevent its deletion, pending a subsequent request for production made through any appropriate instrument. This duality is not innocuous: it allows an issuing authority to secure evidence even before the substantive conditions justifying its production have been met, which will call for careful examination in the light of the requirement of necessity.

2. A gradation by category of data

The Regulation distinguishes between subscriber data, data requested for the sole purpose of identifying the user, traffic data and content data⁷. This taxonomy governs the whole regime: it determines the offence threshold required, the status of the authority empowered to issue the order and the applicability of the notification mechanism to the executing State. For the least sensitive categories, the order may be issued in any criminal proceedings and by a prosecutor. For traffic and content data, the Regulation requires a seriousness threshold and reserves issuance or validation to a judge⁸ — an architecture bearing the direct imprint of the Court of Justice's case law on the independence of the public prosecutor, to which we shall return.

3. Compressed deadlines

The addressee must respond within ten days, reduced to eight hours in cases of urgency⁹. These deadlines, compared with the months required by classical mutual assistance, say in themselves what the instrument is for: the effectiveness of the investigation. They also say what difficulty results for the defence, since no adversarial review can materially be inserted into such a timetable.

4. The addressee

The order is addressed not to an authority but to the designated establishment or legal representative of the service provider, whose designation Directive (EU) 2023/1544 makes mandatory¹⁰. This is the tipping point of the system: the addressee of the judicial order is no longer a judicial body but a private operator. It is also, as noted, the current point of fragility, since this designation obligation remains massively untransposed.

5. Residual review by the executing State

The Regulation does not eliminate all involvement of the State where the data is held, but it radically transforms its nature. For traffic and content data, a notification is sent to the authority of the enforcing State, which has a circumscribed power of objection¹¹. A comparable mechanism exists in the event of conflicting obligations with the law of a third State: the addressee raises a reasoned objection within ten days of receiving the EPOC; the issuing authority reviews the order and, if it intends to maintain it, refers the matter for review to the competent court of its own State, enforcement being suspended pending the outcome¹². The displacement can be measured: litigation arising from enforcement is decided by the court of the issuing State. The executing State objects; it no longer adjudicates.

6. What disappears without replacement: Article 694-41 of the Code of Criminal Procedure and Article 14(7) of Directive 2014/41

This point deserves to be isolated, for it governs the entire demonstration which follows, and it generally goes unnoticed.

Under the European Investigation Order, French law provides, in Article 694-41 of the Code of Criminal Procedure, a remedy against any measure taken on French territory in execution of an investigation order, on the same conditions and according to the same procedures as if it had been executed in domestic proceedings¹³. That provision transposes Article 14 of Directive 2014/41, which requires Member States to guarantee remedies equivalent to those available in a similar domestic case. To this are added two complementary provisions: Article D47-1-16 of the Code of Criminal Procedure, which provides for the issuing State to be informed of the existence and outcome of the challenge, and Article 14(7) of the Directive, which obliges the issuing State to take account of a successful challenge¹⁴.

These three provisions form a coherent whole: a contestable act on the territory of the State where the measure is executed, information of the prosecuting State, and an obligation for the latter to draw the consequences. It will be seen that it is precisely on this whole that the European Court of Human Rights relied in concluding that an effective remedy existed.

Yet the e-Evidence Regulation contains no equivalent of any of the three. There is no longer a measure taken on the territory of the enforcing State in execution of a cooperation instrument, since the order is addressed to a private operator and executed by it: the very object of the Article 694-41 remedy disappears. There is no mechanism for informing the issuing State of the outcome of a national challenge. And there is no provision requiring the issuing State to take account of a challenge which has succeeded elsewhere.

It is this disappearance, more than any other feature of the instrument, which causes the system to tip.

B. The generational shift

1. Three successive models of evidence circulation

The first model, that of classical mutual legal assistance, rested on a complete interstate architecture. The request, made by international letter rogatory, passed through central authorities, was examined by the judicial authority of the requested State, executed according to the forms of the lex loci, and then transmitted back. Two sovereign powers concurred in the act, two legal orders applied their guarantees to it, and two courts could take cognisance of it.

This model was slow. That criticism must be taken seriously rather than mentioned in order to be dismissed. In an environment where data is volatile, where providers operate short retention periods and where criminal structures act simultaneously across several legal orders, a delay of several months is not administrative heaviness: it is a practical impossibility. Classical mutual assistance was not merely inconvenient for the investigator; it had become, for a growing share of cases, inoperative. The European legislature is therefore responding to a real problem, and the analysis which follows contests neither its existence nor its gravity. It bears on what the chosen solution entails: the slowness of the former model was the counterpart of a double review, and the whole question is whether that review has been reconstituted elsewhere or has simply been lost.

The second model, established by Directive 2014/41/EU of 3 April 2014, substituted the logic of mutual recognition for that of the request. The executing State no longer examines the appropriateness of the measure: it executes it, save by invoking one of the exhaustively listed grounds for refusal¹⁵. Review subsists, but it changes nature — it becomes the exception where it was the principle. It is in the interstices of this model that the Sky ECC and EncroChat litigation lodged itself. The Court of Justice locked its logic in the M.N. (EncroChat) judgment: the principle of mutual recognition precludes the authority which issued a European Investigation Order from reviewing the lawfulness of the separate procedure by which the evidence whose transmission is sought was collected in the executing State¹⁶. A decisive formulation: the court of the issuing State does not review the collection. It was still necessary that the court of the executing State could be seised — and that is precisely what Article 694-41 made possible.

The third model is that of the e-Evidence Regulation. It is no longer a matter of arranging the relationship between two judicial authorities: the issuing authority addresses itself directly to the private operator holding the data. The State where the data is stored is no longer an enforcement partner; it becomes, at best, a notified third party.

2. The marginalisation of the executing State

The Regulation retains a notification mechanism and a power of objection for the most sensitive categories of data. But three features narrowly circumscribe its scope.

First, that power is not general: it is indexed to the category of data, so that entire swathes of the scheme escape any involvement of the enforcing State. Second, the objection is exercised within deadlines which preclude any serious examination — ten days, eight hours in urgent cases — and on circumscribed grounds, not on an autonomous assessment of the lawfulness of the measure. Finally and above all, where the objection succeeds, the dispute is not resolved before the court of the executing State: it is the competent court of the issuing State which carries out the review. The mechanism is consistent with the logic of mutual recognition pushed to its conclusion, but it consummates the break: the executing State submits observations; it no longer renders a decision.

The vocabulary of the Regulation reflects this displacement. One no longer speaks of an executing State but of an enforcing State — the semantic nuance registers the loss of the judicial function.

3. What this does to criminal sovereignty

One must guard here against the sovereigntist reflex, which has no place in reasoning under EU law. What is at stake is not the preservation of a State competence for its own sake; it is that the review exercised by the executing State was, in practice, one of the rare places where the lawfulness of the collection could be questioned by reference to a legal order distinct from that which prosecutes. Mutual recognition presupposes equivalence of guarantees; the history of the encrypted messaging litigation shows that this equivalence is sometimes postulated rather than verified.

The resulting question is less one of an infringement of sovereignty than one of a redistribution of review: if the enforcing State no longer adjudicates, if the issuing State does not review the collection carried out elsewhere, and if the service provider is not a judicial authority, where is the judge?

4. The preliminary reference in C-625/25: a question posed under the second model, whose real stake lies in the third

The question referred to the Court of Justice by the Criminal Chamber on 16 September 2025 formally concerns Directive 2014/41. It asks whether it is compatible with Article 47 of the Charter for the legislation of the executing State to make no provision, for the benefit of the person against whom the evidence is relied upon in the issuing State, for a remedy allowing its lawfulness and necessity to be challenged; in the alternative, it asks whether the principle of equivalence of remedies enshrined in Article 14(1) of the Directive requires such a remedy to be made available. Framed in this way, it appears confined to an instrument a substantial part of whose field the e-Evidence Regulation will absorb. That would be to misconceive its scope.

For the configuration submitted to the Court is not specific to the European Investigation Order: it is that of a circle of non-review several elements of which survive the change of instrument.

The first lock is jurisprudential: since M.N., the prosecuting court does not review the collection.

The second is national and procedural. The Article 694-41 remedy is available only in respect of measures executed pursuant to a European Investigation Order — yet, in the Sky ECC configuration, the interceptions arose from separate, earlier French domestic proceedings independent of any investigation order, an obstacle which the Criminal Chamber expressly identifies¹⁷. Here lies the decisive difference with A.L. and E.J., where the transmission to the United Kingdom did indeed arise from a European Investigation Order, which provided the object of the remedy.

The third lock is that of standing, to which we shall return: on 7 January 2025 the Criminal Chamber held that an applicant has no standing to challenge the whole body of interceptions concerning third-party users in separate proceedings¹⁸.

The fourth, finally, is one of primary law. Under Article 276 TFEU, the EU judicature has no jurisdiction to review the validity or proportionality of operations carried out by the police or other law-enforcement services in a Member State. The General Court recalled this clearly in the judgment BW v Europol and Eurojust of 25 February 2026, holding that Europol cannot be held jointly liable for damage arising from unlawful processing occurring in the course of national police operations, even where that processing took place within cooperation founded on the Europol Regulation¹⁹. The route to the EU judicature is therefore, on this ground, constitutionally closed.

Two objections must be examined before going further, for they are not without force.

The first is that this configuration would not be a failure of the system but its very logic. The court of the issuing State fully reviews the necessity and proportionality of its own request; review of the collection falls to the legal order in which it was carried out, and it is not for a foreign court to take it up. This is the premise of mutual recognition, not its accident. The objection is serious — the European Court of Human Rights indeed adopted it in 2024 — and it is decisive where the review it presupposes is in fact accessible. The whole difficulty is that this accessibility is not constant: it depends on the existence, in the State of collection, of a contestable act and of a person entitled to contest it.

The second objection is more troublesome. It may be argued that the executing State's review was largely formal, so that its disappearance would be less a loss than a clarification. The observation is partly accurate, and it would be wrong to adorn the former model retrospectively with virtues it did not always possess. But it can be turned around: if that review was formal, then the equivalence of guarantees on which mutual recognition rests was never verified — it was postulated. The e-Evidence Regulation pushes that postulate one step further, by removing even the material possibility of verification.

Yet it is this structure that the Regulation carries forward — and hardens on three points.

First, it removes the last judicial act of the enforcing State. Under Directive 2014/41, the person concerned had a remedy whose accessibility could be debated; under the Regulation, in most cases there is no longer any decision of the enforcing State capable of forming its object. The complaint bore on the extent of a legal remedy; tomorrow it will bear on the absence of any contestable object.

Second, it displaces the fault line without closing it. The Criminal Chamber's hesitation stemmed in particular from the fact that the collection measures, ordered outside any European Investigation Order, did not constitute an implementation of EU law within the meaning of Article 51(1) of the Charter²⁰. Under the Regulation, the order indisputably falls within EU law, which removes that difficulty. But it reappears upstream: the manner in which the provider constituted, structured and retained the data produced remains governed by national law and by data protection law, outside the scope of the Regulation. The blind spot does not disappear; it moves one notch up the evidential chain, and now lodges itself with a private actor bound by no duty to give reasons to the person concerned.

Finally, it substitutes for the uncertainty about access to a remedy a power of objection which is not a remedy. The enforcing State may object; it does so through an authority, within very short deadlines, on circumscribed grounds, and without the person concerned — not yet notified — being a party. The Regulation organises a review; it does not organise adversarial proceedings.

5. An international convergence: the CLOUD Act and the Budapest Convention

This development is not a European singularity. The Clarifying Lawful Overseas Use of Data Act, adopted by the United States Congress in March 2018 in the wake of the Microsoft Ireland litigation, proceeds from a parallel logic: the United States may conclude bilateral agreements allowing orders to be presented directly to the service providers of each country²¹. The first such agreement, signed with the United Kingdom in 2019, entered into force on 3 October 2022²². The mechanism is the same: circumvention of mutual legal assistance, direct access to the operator, review concentrated in the requesting State.

The chronology is revealing. The two European legislative proposals were presented jointly by the Commission on 17 April 2018, a few weeks after the adoption of the CLOUD Act²³. On 25 September 2019, the Union and the United States opened negotiations on an agreement concerning cross-border access to electronic evidence, on the basis of a Commission recommendation of 5 February 2019, which drew a critical opinion from the European Data Protection Supervisor²⁴. The e-Evidence Regulation is therefore not merely an internal reform: it is also the instrument by which the Union equips itself with a framework enabling it to deal on equal terms with the American scheme.

The Budapest Convention on Cybercrime and its Second Additional Protocol, on enhanced cooperation and disclosure of electronic evidence, form part of the same movement²⁵.

From this convergence, one conclusion follows: the dejudicialisation of access to electronic evidence is a deep-seated movement, not a choice peculiar to the European legislature. What distinguishes the European model is that it is set within a legal order endowed with a directly invocable charter, a court competent to review compliance with it, and a superimposed conventional system. The question is therefore not whether review disappears, but whether it is reconstituted elsewhere — and in what form.

II. A still uncertain regime of fundamental rights protection

The Regulation does not ignore fundamental rights; it refers to them abundantly and claims to organise their protection. The question is therefore not that of an instrument indifferent to liberties, but that of the adequacy of the chosen guarantees to the structure described. To judge of this, one must first determine what the instruments of protection are able to grasp of this scheme (A), before testing the guarantees it organises (B).

A. The normative framework: what the instruments of protection grasp of the new scheme

1. The scope of the Charter: an illusory gain

Under Directive 2014/41, the applicability of the Charter was not self-evident. The Criminal Chamber noted this on 16 September 2025: collection measures ordered outside any European Investigation Order did not as such constitute an implementation of EU law within the meaning of Article 51(1).

Under the Regulation, that difficulty apparently disappears. The European Production Order is an act adopted pursuant to an EU regulation; its issuance, its statement of reasons, its addressee and its deadlines fall within EU law, and the Charter applies to it as of right.

That would be to confuse two objects. The Charter now grasps the order; it does not grasp, any more than before, the reservoir on which the order bears. The data produced pursuant to an EPOC was not constituted by the Regulation: it was collected, structured and retained by the provider under its national law and the rules on personal data²⁶. That upstream phase remains outside the material scope of the Regulation.

There follows a dissociation which governs the whole examination: the proportionality review bears on the order, not on the reservoir. An order may be perfectly necessary and proportionate as an act while bearing on a body of data constituted by an operation to which the requirement of proportionality was never applied.

2. Article 276 TFEU: a limit of primary law

To this material limit is added a second, more rarely noted in this context, which stems from the Treaty itself. Article 276 TFEU deprives the EU judicature of jurisdiction to review the validity or proportionality of operations carried out by the police or other law-enforcement services in a Member State.

The BW judgment of 25 February 2026 provides the fullest illustration of this to date. The General Court there declares itself without jurisdiction to examine the authorisation by the French court of the interception operations, their conduct, and the joint investigation team agreement concluded between Belgium, France and the Netherlands, which is not an act of the Union²⁷. It states that, notwithstanding the joint liability regime under Article 50 of the Europol Regulation, that agency cannot be held liable for damage arising from unlawful processing occurring in the course of national police operations.

The scope of this limit must nonetheless be precisely measured, for the same judgment delimits its contours in a manner useful to the defence. Outside police operations properly so called, the General Court recognises itself as empowered, under the derogating joint liability regime, to assess the lawfulness of acts or conduct of Member States, whether on the basis of EU law or of the national law concerned²⁸. The Article 276 obstacle is therefore functional, not organic: it turns on the nature of the operation, not on the status of its author.

A counter-intuitive consequence for the e-Evidence Regulation will be drawn from this below.

3. Articles 7 and 8 of the Charter: the intensity of the interference

This is the ground on which the Regulation is most soundly constructed. The gradation by category of data, with differentiated offence thresholds, constitutes the direct internalisation of the case law developed since Digital Rights Ireland, then Tele2 Sverige and La Quadrature du Net, which linked the degree of interference to the nature of the data and to the possibility of drawing precise conclusions about private life²⁹.

The limit is that this gradation reasons by category, not by volume. Yet it is the extent of the accessible data that the Court of Justice now takes as the criterion of seriousness. In the judgment C.G. v Bezirkshauptmannschaft Landeck of 4 October 2024, delivered by the Grand Chamber under Directive 2016/680, it characterised access to all the data on a mobile telephone as an interference liable to be serious, or even particularly serious³⁰. One should refrain from transposing that decision mechanically, since it was delivered in a distinct normative framework: it provides a calibration grid, not a precedent.

4. Article 48 of the Charter: the position of the person concerned

Article 48 guarantees the presumption of innocence and respect for the rights of the defence. Its specific contribution lies in the definition of a procedural position. Yet the person whose data is produced has none at the enforcement stage: they are not a party, not notified, not represented. The dialogue is established between an issuing authority, an enforcing authority and a private operator, none of whom has the function of asserting their interests.

This absence is not in itself irregular: the confidentiality of the investigation justifies an investigative measure not being adversarial at the moment of its execution. It becomes problematic when combined with the absence of any subsequent possibility of effectively challenging the measure — that is, when it ceases to be a deferral and becomes a deprivation.

5. Article 47 of the Charter: the forum

We come to the point which governs the others. Article 47 guarantees the right to an effective remedy before a tribunal. The difficulty is not that of the content of the remedy, but that of its addressee: before which court?

The court of the issuing State does not review the collection, M.N. forbidding it. The court of the enforcing State renders, under the new scheme, no decision open to challenge. The EU judicature is deprived of jurisdiction by Article 276 TFEU as regards police operations. And the service provider is not a court.

Article 47 has practical effect only if a forum exists. It is this question, and not that of the standards of review, which is pending before the Court of Justice.

6. The European Convention on Human Rights: the most serious objection, and its exact scope

Here one must confront the decision which most directly contradicts the foregoing analysis, for to evade it would ruin the argument.

By decision of 17 October 2024, A.L. and E.J. v. France, the European Court of Human Rights declared inadmissible the applications of two EncroChat users prosecuted in the United Kingdom on the basis of data intercepted by the French authorities and transmitted pursuant to a European Investigation Order issued by the Crown Prosecution Service. The Court did not merely find a procedural obstacle: it held, after a detailed examination, that the applicants had an effective remedy available in France. The complaint under Articles 6 and 13 was dismissed as manifestly ill-founded³¹.

The reasoning deserves to be set out precisely, for it constitutes the standard against which the Regulation will have to be measured.

The Court first observes that, since the Court of Justice precludes the issuing State from reviewing the separate collection procedure, the remedies available in the executing State assume decisive importance³². It thus takes note of the lock imposed by M.N. and draws the consequence that it must be compensated elsewhere.

It then identifies that compensating factor: Article 694-41 of the Code of Criminal Procedure, which allows any interested person to exercise, against a measure taken in execution of a European Investigation Order, the remedies which would be available in domestic proceedings. It notes that French case law accepts that a person under formal investigation may challenge, by way of an application for annulment, the inclusion in the file of material obtained in separate proceedings, and may on that occasion invoke the irregularity of the acts carried out in those proceedings — hence the lawfulness and necessity of the investigative technique initially employed³³. It states that the exercise of that remedy did not require the applicants to incriminate themselves³⁴.

Finally, it verifies the modalities of redress, and this is the decisive point: the remedy makes it possible to obtain in France the annulment of the enforcement measure; Article D47-1-16 provides for the issuing State to be informed; and Article 14(7) of the Directive obliges the latter to take account of a successful challenge. The Court infers that the redress is appropriate, the British courts being required to take account of any success³⁵.

The objection is therefore of the first order, and it would be dishonest to minimise it. Three observations nonetheless delimit its scope.

The first concerns the very object of the decision. The applicants had exercised no remedy in France³⁶. The Court therefore rules on the availability of a legal remedy, not on its tested effectiveness; it indeed recalls that doubt as to the efficacy of a domestic remedy must be submitted to the national courts³⁷. Yet that doubt has since been submitted to them. On 7 January 2025, the Criminal Chamber delimited access to the remedy by holding that an applicant has no standing to challenge the whole body of interceptions concerning third parties. On 16 September 2025, it held the question sufficiently serious to refer it to the Court of Justice. The national test which the Court called for has therefore taken place, and it produced a preliminary reference rather than a confirmation. One should not infer that the European Court was mistaken: the two decisions do not bear strictly on the same question. But the second reveals a limit which the first did not have to examine.

The second concerns the configuration. In A.L. and E.J., the transmission did arise from a European Investigation Order, which provided the object of the Article 694-41 remedy. In the configuration submitted to the Court of Justice, the interceptions were earlier than and independent of any investigation order. The object is lacking, and this is precisely the second lock identified above.

The third is the most important for this study, and it is decisive. The effectiveness found in 2024 rests on three supports: a contestable act on the territory of the State of collection, information of the issuing State, and an obligation for the latter to take account of the success of the remedy. These three supports are specific to the European Investigation Order regime. None survives under the e-Evidence Regulation, where enforcement is the act of a private operator, where no information mechanism is provided for, and where no provision requires the issuing State to draw the consequences of a challenge which has succeeded elsewhere.

The decision of 17 October 2024 therefore does not refute the thesis defended here: it supplies its yardstick. It establishes what an effective remedy requires in a configuration of cross-border circulation of evidence. The e-Evidence Regulation removes precisely what the European Court held to be determinative.

Two further reservations must be formulated. First, Article 13 of the Convention is less demanding than Article 47 of the Charter, in that it does not require the body seised to be a court; but the enforcing State's power of objection does not satisfy it either, being neither exercised by the person concerned nor brought to their knowledge. Second, as the General Court recalled in BW, in the absence of the Union's accession to the Convention, the Strasbourg Court cannot find a violation by the Union itself³⁸. The conventional route remains open against Member States; it is not open against the Regulation.

B. The guarantees put to the test

1. The status of the issuing authority: a real guarantee, but one which answers a different question

The Regulation reserves to a judge the issuing or validation of orders bearing on traffic and content data. This requirement is not stylistic: it reflects the case law arising from the Prokuratuur judgment of 2 March 2021, by which the Court of Justice held that the public prosecutor's office, responsible for directing the investigation and, where appropriate, for bringing the prosecution, cannot be regarded as an independent authority in the sense required to authorise access to traffic and location data³⁹. The European legislature has drawn that consequence, and this must be conceded without reservation.

But the concession delimits the guarantee. Prokuratuur answers the question who orders access; it does not answer the question who reviews what has been collected. A judge validating an EPOC exercises full review over their own request. They exercise none over the conditions in which the data was constituted — not through negligence, but because M.N. forbids it and the Regulation does not place that phase within its scope.

Judicial involvement is real and useful. It covers one stage of the chain; it does not close the circle.

2. Necessity and proportionality: a requirement without an instrument of verification

The Regulation makes issuance subject to conditions of necessity and proportionality, and requires that the measure could have been ordered in comparable domestic proceedings⁴⁰. The requirement is classical and well formulated.

It is review of compliance with it that is lacking. The statement of reasons is not communicated to the person concerned at the enforcement stage. The addressee, a private operator, has neither the vocation nor the means to challenge the assessment made by a foreign judicial authority. The enforcing authority rules on circumscribed grounds, within deadlines precluding any thorough examination.

To this is added the dissociation established above: even were that review fully exercised over the order, it would not bear on the reservoir. If access to all the data on a device constitutes an interference capable of being particularly serious, access to a body of content data held by a provider cannot receive less demanding treatment. The architecture of the Regulation offers no mechanism enabling that standard to be applied to what the act bears upon.

The requirement exists. The instrument for verifying it does not.

3. Deferred notification: review without adversarial process, a remedy without information

The Regulation provides for information of the person concerned, but deferred and liable to be postponed in the interests of the investigation⁴¹. The principle of deferral calls for no criticism.

Two difficulties deserve to be noted.

The first concerns the confusion between the enforcing State's power of objection and a remedy. It is not one: it is exercised by an authority and not by the person concerned, founded on exhaustively defined grounds, devoid of adversarial process, and where it succeeds it leads to a review before the court of the issuing State. The Regulation organises an inter-institutional review; it does not organise a right to a remedy.

The second is more fundamental, and it is measured against the 2024 standard. A deferred remedy satisfies Article 47 only on condition that its holder knows its object — that they know what data has been produced, by what process, on what basis. That level of information does not follow from the Regulation. Where the European Court noted in 2024 that the issuing State would be informed of the outcome of the remedy and required to take account of it, the Regulation provides for neither.

4. The Article 18 remedy: a designated forum, and which one

The Regulation is not silent on remedies. Its Article 18 devotes an entire provision to them, and it would be wrong to reason as though the text had omitted them⁴². The objection must therefore be met head-on, for it is the first any opponent will raise.

Three elements must be noted. Paragraph 1 recognises, for any person whose data has been requested, a right to effective remedies against the order, without prejudice to the remedies available under the General Data Protection Regulation and Directive 2016/680. Paragraph 2 specifies its content: the possibility of challenging the legality of the measure, including its necessity and proportionality. Paragraph 5 finally obliges the issuing State and any other Member State to which the evidence has been transmitted to ensure that the rights of the defence and the fairness of the proceedings are respected when assessing the evidence obtained⁴³. These provisions are real and their scope must be acknowledged.

But it is paragraph 2 which decides everything, and it does so in a subordinate clause. The right to effective remedies, it states, “shall be exercised before a court in the issuing State in accordance with its national law”⁴⁴.

The forum is therefore designated — and it is unique. The Regulation does not merely fail to provide anything in the enforcing State: it expressly locates the remedy in the prosecuting State. The closing reservation of the same paragraph, “without prejudice to fundamental rights guarantees in the enforcing State”, does not restore a forum. It refers to substantive guarantees, not to a legal remedy — and we have seen that the enforcing authority's power of objection does not constitute one.

Yet this is precisely the configuration which the European Court of Human Rights held, in 2024, to be insufficient in itself. Its reasoning proceeded from the finding that, since the issuing State cannot review the collection by reason of M.N., the remedies available in the executing State assume decisive importance. Article 18 does the opposite: it concentrates the remedy where review of the collection is jurisprudentially excluded.

The result is therefore not the absence of a remedy; it is a remedy whose object is truncated. The person prosecuted will be able to challenge before the court of the issuing State the legality of the order, its necessity and its proportionality. They will not be able, before that same court, to contest the conditions in which the provider constituted the data which the order extracts. The Article 18 remedy covers the order; it does not cover the reservoir.

One then measures why the question referred in Case C-625/25 exceeds the instrument which carries it. What is at issue is not the existence of a remedy, but its location.

Conclusion of Part II. The assessment is differentiated. The Regulation answers correctly the question of the authority. It answers imperfectly that of proportionality, whose requirement it lays down without organising its verification. It answers that of the forum, but by fixing it in the issuing State alone — that is, precisely where the M.N. case law forbids review of the collection — and it removes the three elements on which the European Court of Human Rights had founded, less than two years before its entry into application, a finding of effectiveness. Yet it is the third question which governs the others: a requirement of proportionality which can be debated only before the court of the State that itself assessed it, and which can never be debated as regards the conditions in which the data was constituted, is not fully a guarantee: it is, in part, an instruction which the issuing authority addresses to itself.

III. The future litigation of electronic evidence

A. Sky ECC, EncroChat, ANOM: the first repertoire of digital defence

The litigation arising from the dismantling of encrypted messaging services has constituted, in less than six years, the first repertoire of defence arguments in matters of digital evidence — and it has shown how the courts respond to them. Each of the three major cases isolated a distinct question, and each will reappear under the Regulation.

1. EncroChat: the verifiability of the process

The interception carried out on the EncroChat network rested on Article 706-102-1 of the Code of Criminal Procedure, which authorises recourse to State resources subject to national defence secrecy in order to carry out the technical operations of interception and decryption⁴⁵. The defence argued that this scheme deprived it of any possibility of verifying the reliability of the process.

The Conseil constitutionnel declared those provisions constitutional by its decision of 8 April 2022, while expressly noting that they have the effect of withdrawing information relating to those resources from adversarial debate⁴⁶. Conformity is admitted in full knowledge of that withdrawal.

The Criminal Chamber nonetheless opened a breach. By a series of judgments of 11 October 2022, it quashed decisions of investigating chambers which had rejected applications for annulment without addressing the presence in the file of the certificate of accuracy under Article 230-3⁴⁷. Review of the process, impossible in substance, shifts onto a document. But the scope of that breach was immediately delimited: by judgment of 10 May 2023, the Court held that where the intercepted data was not encrypted, no certificate was required⁴⁸.

Deprived of access to the process, the defence falls back on documentary verification of its lawfulness; and that verification is itself conditional. This is the situation which will recur in the face of data produced by a provider pursuant to an EPOC — a stream certified by the very entity which constituted it.

2. Sky ECC: standing in the face of mass collection

The most natural argument, faced with an operation bearing on more than one hundred thousand users, consists in challenging its mass and indiscriminate character. The Criminal Chamber neutralised it on 7 January 2025, approving the trial judges for having held that the applicant had no standing to seek annulment of the whole body of interceptions concerning third-party users, in separate proceedings concerning directly neither his own interests nor the protection of his private life⁴⁹.

The lock is one of admissibility, not of substance. It is not held that mass collection would be lawful; it is held that the person who suffers its effects has no standing to contest it as a whole. Structural disproportion escapes review through the sole operation of standing.

That judgment casts retrospective light on the decision of 17 October 2024. The European Court had found that a remedy allowed the lawfulness and necessity of the investigative technique initially employed to be challenged. It had not ruled on the extent of what the applicant could thereby call into question. The Criminal Chamber answered: what targets him, not the architecture which produced it. The remedy exists; it is individual.

This lock will re-form under the Regulation, and at lesser cost: where an EPOC bears on data extracted from a body constituted globally, the person concerned will be entitled to challenge the order targeting them, not the conditions in which that body was formed.

3. ANOM: the reliability of the producer of the evidence

Operation Trojan Shield, conducted between 2018 and 2021, presents a singularity which makes it the limiting case. The ANOM platform was not compromised by the authorities: it was designed, distributed and operated by them, the Federal Bureau of Investigation and the Australian Federal Police having controlled it from the outset⁵⁰. The producer of the evidence was the accuser.

That finding, which is not disputed, suffices for the demonstration. Caution is however required regarding the litigation to which it gave rise. Part of German scholarship maintains that the courts called upon to authorise the collection were kept in ignorance of the platform's true origin; were it established, that thesis would engage Article 6 of the Convention well beyond a single legal order⁵¹. It is not established to date, and the German courts have admitted the ANOM data in evidence. It is mentioned because it will be argued, not because it is settled.

The interest of ANOM does not depend on the outcome of that controversy. It lies in revealing, through an extreme case, the nature of the blind spot. The Regulation makes the provider the end point of the evidential chain, without organising any independent verification of what it produces. That architecture rests on a presumption of neutrality of the producer. ANOM shows what happens when that presumption is false — and when no mechanism of the scheme would allow it to be discovered.

4. A fourth lesson: the closure of the direct European route

To this repertoire is now added a lesson of another order, drawn from litigation brought before the EU courts.

By judgment of 25 February 2026, the General Court ruled on the action of a Serbian national prosecuted in the Netherlands and in Serbia on the basis of Sky ECC data, directed against Europol and Eurojust⁵². The outcome is instructive on two counts.

First, it confirms the extent of the closure. The General Court declares itself without jurisdiction to examine the authorisation by the French court of the interception operations, their conduct, the transmission of the documents obtained, and the joint investigation team agreement — which, signed by only three Member States, is not an act of the Union, even though Europol and Eurojust were associated with it as participants.

Second, and this is the remarkable point, the General Court recognised that a transmission of data by Eurojust to the Serbian authorities was open to challenge, expressly holding that it constituted the final step of a procedure beyond which the lawfulness of the transmission could never again be contested, the courts of the third country being able neither to assess its validity under EU law nor to make a preliminary reference to the Court. It held that this recognition was alone capable of guaranteeing effective review of the transfer of intercepted data and of its use for purposes other than those of the proceedings for which it had been collected⁵³.

The reasoning is exactly that which this study pursues: the absence of any other avenue of review requires the opening of the one that remains. It was held by the EU judicature itself. An appeal is pending before the Court of Justice⁵⁴.

B. The litigation to come under the Regulation

1. The lawfulness of the EPOC: the apparent ground

The first reflex will be to challenge the order itself: competence of the issuing authority in the light of the category of data, compliance with the offence threshold, validation by a judge where required, statement of reasons as to necessity and proportionality, regularity of the notification. This litigation will exist and will be useful. The letters of formal notice of March 2026 suggest that, in the first months of application, there will be substantial litigation on the very regularity of the designation of addressees.

Its scope will be limited by what has been established: review of the order does not grasp the reservoir.

2. The shift towards authenticity, integrity and the chain of custody

It is here that the litigation will shift, and that shift is the necessary consequence of the structure described. If enforcement no longer produces a judicial act of the enforcing State, the defence loses its habitual object of challenge. It can no longer attack an act: there is none. It remains for it to attack what the act has produced.

That requirement is not to be constructed. Convention law has long formulated it. The Strasbourg Court does not rule on the admissibility of evidence, which is a matter for domestic law; it examines whether the proceedings, including the manner in which the evidence was obtained, were fair as a whole⁵⁵. That examination is organised around two directly transposable criteria: the opportunity given to the applicant to challenge the authenticity of the evidence and to oppose its use, which the Court regards as the decisive element; and the quality of the evidence, that is, whether the circumstances in which it was obtained cast doubt on its reliability or accuracy⁵⁶.

These two criteria designate what the Regulation does not organise. What guarantee of the integrity of the transmitted data? What traceability of its extraction? What certification, and by whom? French law knows, in Article 230-3, the requirement of a certificate of accuracy signed by the head of the technical body. Nothing equivalent bears on the provider addressed by an EPOC, which is neither a technical body designated by the judicial authority, nor a neutral third party, but a private undertaking subject to a compliance obligation coupled with penalties⁵⁷.

A serious objection must be formulated. The overall fairness approach is notoriously permissive: in Schenk as in Khan, the Court found no violation even though the evidence had been unlawfully obtained, since the defence had been able to contest it and it was not the sole basis of the conviction⁵⁸. An opponent will argue that this standard validates the scheme.

The answer lies in the distinction between contesting and contesting usefully. What Convention case law requires is not the formal presence of the evidence in the debate, but the effective possibility of challenging its authenticity. A party who knows neither the extraction process, nor the conditions of retention, nor the reasons for the order has no means of calling into question the authenticity of what is relied upon against them: they may deny it, not contest it.

3. The procedural consequences of violations

The question of sanction is the necessary extension of the foregoing, all the more decisive since, in the absence of adversarial process at the enforcement stage, ex post exclusion remains the only lever.

EU law contains no general rule of exclusion and refers essentially to national laws. But that reference is not unconditional: the Court of Justice held, in M.N., that the national court must disregard evidence on which a party is not in a position to comment effectively⁵⁹. It is less the irregularity of the obtaining than the impossibility of debating it which founds exclusion.

The two European orders converge here, which is rare in evidential matters. The Court of Justice's criterion — the impossibility of commenting effectively — coincides with that of the Strasbourg Court — the impossibility of challenging authenticity. That convergence gives the argument a foundation which neither basis would have in isolation.

Applied to the enforcement of an EPOC, the reasoning is immediate. If the person prosecuted can neither access the technical modalities of production, nor challenge the conditions in which the data was constituted, nor obtain communication of the reasons for the order, they are not in a position to comment effectively on the evidence relied upon against them.

4. Interpretative litigation: the foreseeable preliminary questions

One may identify, without great risk, the questions which will reach the Court of Justice:

— does Article 47 of the Charter require that a remedy be available, in the State where the data is held, to a person prosecuted elsewhere on the basis of an EPOC? This is the direct transposition of C-625/25;

— must the proportionality review bear on the conditions in which the body of data from which the order seeks extraction was constituted, or only on the request?

— what requirements do Articles 47 and 48 of the Charter, read in the light of Article 6 of the Convention, impose as regards the traceability and certification of data produced by a private provider?

— is deferred notification compatible with the right to an effective remedy where it durably deprives the person of knowledge of the object of the remedy?

— what procedural consequences follow from enforcement carried out in disregard of the designation obligations under Directive 2023/1544?

5. Validity litigation: an open route, and a paradox

A second register, whose ambition is different, must be clearly distinguished from the foregoing: challenging the validity of the Regulation itself.

The action for annulment is closed to the individual. The two-month time limit under the sixth paragraph of Article 263 TFEU has expired. The condition of direct and individual concern is insurmountable for an act of general application. And the third limb of the fourth paragraph of Article 263 is inapplicable, the notion of a regulatory act excluding legislative acts and the Regulation in any event entailing implementing measures⁶⁰.

That closure is not a lacuna: it is assumed. The Court has held that the Treaty organises a complete system of legal remedies in which the national court, through the preliminary reference, ensures review of the legality of EU acts⁶¹. It therefore itself directs the individual towards the national court.

That is where the argument is to be pleaded. The person prosecuted raises, before the investigating chamber or the trial court, the invalidity of the Regulation. No time limit can be invoked against them, and the obstacle arising from the TWD case law does not apply, since they could not have brought an action for annulment⁶². The national court is not obliged to refer at a party's request, but it cannot itself find invalidity: if it considers the argument well founded, it must refer to the Court⁶³. The argument must therefore be constructed not to persuade, but to render the doubt impossible to dismiss by summary reasoning.

Two arguments deserve to be identified.

The first concerns the legal basis. The Regulation is founded on Article 82(1) TFEU, which concerns judicial cooperation based on mutual recognition. If the demonstration conducted in Part I is correct, the scheme no longer falls within it: there is no decision of one State recognised by another, but an order addressed to a private person.

The second concerns Article 47 of the Charter. A regulation which organises an interference without providing for a forum competent to review its exercise itself infringes the right to an effective remedy. This is no longer a defect of interpretation, it is a vice of the act. The precedent is known: Directive 2006/24 was not annulled on direct action, it was invalidated on a reference for a ruling on validity.

A paradox deserves finally to be noted. Article 276 TFEU precludes only review of operations carried out by the police or other law-enforcement services. Yet the enforcement of an EPOC is not one: it is an act adopted by a judicial authority pursuant to an EU regulation, addressed to a private operator. The General Court moreover stated, in BW, that outside those specific operations it remains empowered to assess the lawfulness of Member States' acts. The shift towards e-Evidence could therefore, against all expectation, remove part of the litigation from the Article 276 obstacle — and reopen before the EU judicature what classical police cooperation closed to it. The proposition is advanced here as a hypothesis; it deserves to be tested.

6. Return to C-625/25: the alternative which governs the decade

One objection must be dismissed at the outset: that which would see in the entry into application of the Regulation a cause of lapse of the question referred. The Regulation does not repeal Directive 2014/41, which it complements⁶⁴; the European Investigation Order will remain the instrument for the transmission of evidence already held by a Member State — precisely the configuration from which both the Sky ECC litigation and A.L. and E.J. arise. To this is added the consideration of the backlog: proceedings pending on the basis of data transmitted since 2021 will still be counted, for several years, in the thousands.

If the Court holds that Article 47 of the Charter requires a remedy to be available in the State where the evidence was collected, the principle will be immediately transposable to the Regulation, whose very economy it will weaken. If it holds, on the contrary, that the legal remedies available in the issuing State suffice, it will validate the architecture of the Regulation in advance.

That alternative nonetheless presupposes that the Court rules on the ground of the Charter. Here lies the true unknown, and it turns less on the sense of the answer than on its basis. The Criminal Chamber posed two questions of different foundation: the first invokes Article 47 of the Charter; the second, in the alternative, the principle of equivalence under Article 14(1) of the Directive⁶⁵. A solution based on Article 47 would state a requirement of primary law, opposable to any instrument organising the cross-border circulation of evidence, the Regulation included. A solution based on Article 14(1) alone would remain an interpretation of secondary law, confined to the instrument which carries it — and the Regulation, endowed with its own regime, would escape it.

It is therefore the ground chosen, rather than the operative part of the judgment, which will determine whether the answer constitutes a guiding principle of the European law of digital evidence or a case-specific solution destined to expire with the instrument which prompted it. The Advocate General's Opinion will, in that respect, be more instructive than the question itself.

The chronology gives this alternative a singular sharpness. The request was lodged on 23 September 2025; the case remains pending. The Regulation will become applicable on 18 August 2026. The Court will therefore rule on the earlier model at a time when the new model is already in force. It will judge the second generation in knowledge of the third.

Conclusion

The e-Evidence Regulation cannot be reduced to the alternative with which we began. It does not dejudicialise the obtaining of electronic evidence in the sense of entrusting the decision to private actors: the order remains a judicial act, and the European legislature has even strengthened, as regards the competent authority, the requirements arising from the Court of Justice's case law. But nor does it bring forth a European judicial review of a new kind, for it does not organise the forum before which that review would be exercised.

What it effects is more precise, and more problematic: it concentrates review at one point of the chain — issuance — and leaves it vacant everywhere else. The constitution of the data escapes the issuing court through the effect of mutual recognition; its production escapes adversarial process through the effect of the private nature of the addressee; its contestation escapes the person concerned through the effect of deferred notification.

The most striking point lies elsewhere. In October 2024, the European Court of Human Rights held that an EncroChat user prosecuted abroad had an effective remedy available in France, and it founded that finding on three precise elements: a contestable act on the territory of the State of collection, information of the prosecuting State, and an obligation for the latter to take account of the success of the remedy. Twenty-two months later, the e-Evidence Regulation enters into application reproducing none of the three. This is not an accidental regression; it is the assumed consequence of the choice of direct cooperation with providers. Its price must nonetheless be measured.

The Sky ECC litigation had posed this question before the Regulation became applicable. The Criminal Chamber brought it before the Court of Justice on 16 September 2025, under an instrument which the new text does not replace but overlays. Just as Digital Rights Ireland, Tele2 Sverige and La Quadrature du Net shaped, for a generation, the European law of communications data, the answer given in Case C-625/25 will determine the standards of European digital evidence for the decade now opening.

These questions will be raised, and they will be raised before national courts before they are raised in Luxembourg or Strasbourg. To bring them requires a competence which is no longer that of domestic criminal procedure alone: command of EU law, of Convention law and of the technique of digital evidence ceases to be a field of specialisation and becomes a condition of practice in transnational criminal litigation.

Notes

Study published on 30 July 2026 on zekkouti-avocat.com. Any reproduction, even partial, is subject to authorisation. A French version of this study is available: version française.