CIPPIC joined a number of civil society groups in a submission outlining concerns regarding a proposition by the Council of Europe to adopt a second protocol to its Cybercrime Convention with the objective of lowering current safeguards in place when law enforcement agencies seek access to data stored in foreign countries. The submission, which was spearheaded by our friends at EDRi, establishes a number of preliminary baseline requirements for any international instrument aiming to facilitate cross-border law enforcement access to data. While only a starting point, some of the minimum requirements in the submission will surely need to be addressed if the proposed second protocol is to have the legitimacy and global adoption its authors hope. These include:

  • Limiting the second protocol to addressing gaps left by a reformed MLAT regime
  • The need for competent and independent judicial authorization as a centre-piece to any cross-border data access regime
  • The data hosting state must be notified when a foreign law enforcement agency accesses data hosted within its territory
  • A right to challenge foreign data requests in the country of the affected data subject, and by that country's standards.

In addition, as pointed out by the Electronic Frontiers Foundation in a comment on the second protocol, the proposal should not operate to lower existing protections such as Canada's prohibition on sharing digital identifiers without judicial authorization or the United States' requirement for probable cause-based production orders. Finally, the letter calls for a prohibition on data localization laws that are imposed without any privacy justification, for the primary objective of imposing often arbitrary and invasive surveillance obligations. For example, Russia has been taking increasingly aggressive steps in compelling global online platforms to host Russian data locally to facilitate invasive surveillance and censorship practices.