Cloud computing has severed the link between a criminal investigation's location and the location of the evidence it needs: data relevant to purely domestic cases routinely sits on servers of foreign providers, sharded across jurisdictions. The pre-internet Mutual Legal Assistance Treaty (MLAT) system is too slow and too location-bound for this reality, and the unilateral and bilateral alternatives that have emerged — the US CLOUD Act, its executive agreements with the UK and Australia, the Council of Europe's Second Additional Protocol, and the EU's 2023 e-Evidence package — remain fragmented and legally contested. This problem restates the open reform question left by Abraha's 2021 mapping study — whose abstract documents that the mapped initiatives are assessed for their 'suitability and sustainability' and that 'there is little agreement on what these reforms or alternative approaches should look like' — as developed in the same author's 2026 monograph, which sets out 'to reconcile the practical necessities of law enforcement seeking digital evidence stored overseas with the territorial sovereignty of the countries hosting that data, the fundamental rights of individuals whose personal data is being sought, and the interests of technology companies whose cooperation is required': whether any institutional design can reconcile the 'loss of location' with rule-of-law and data-protection safeguards at the scale of routine cloud-era investigations; what institutional architecture (a self-standing EU–US agreement, a framework-plus-bilaterals structure, an expanded Budapest Convention mechanism, or a new multilateral instrument) could be simultaneously operational, legally sustainable under the GDPR and the CJEU's Schrems II line of case law, and politically acceptable to states with divergent governance models; and how third-country effects, notification and remedy gaps in bilateral CLOUD Act agreements can be constrained. As of 2026 the core transatlantic and multilateral questions remain open: the EU–US agreement negotiations are unconcluded, the Second Additional Protocol is not yet in force, and in-force CLOUD Act agreements are documented as operating without individual remedies.

Background

When police or prosecutors need communications, subscriber records, or files held by an online service provider, the governing question used to be where the data physically sits: evidence located abroad was requested through the mutual legal assistance (MLAT) system — treaties under which one state's judicial authority formally asks another's to compel production — a procedure that presumes the requesting state can identify the competent foreign authority, knows where the data is, and can wait weeks or months. Cloud computing broke all three assumptions. Providers such as Microsoft, Google and Meta store, replicate and move customer data across borders dynamically, so even an exclusively domestic investigation may need data whose location is unknown or deliberately irrelevant, and the 2018 Microsoft Ireland dispute (US warrants for e-mail stored in Ireland) crystallised the conflict between a state's power to order 'its' providers to disclose data and other states' sovereignty and privacy law. Jennifer Daskal's contemporary analysis of the resulting US Clarifying Lawful Overseas Use of Data (CLOUD Act) of 2018 explains its two parts: Sections 103–104 assert that US providers must comply with US process regardless of where the data is stored, while Section 105 authorises the executive branch to certify bilateral 'executive agreements' through which approved foreign governments can obtain data directly from US providers under their own domestic orders, subject to baseline conditions (rule-of-law, human-rights and oversight requirements). The EU simultaneously developed its 'e-evidence' instruments, and the Council of Europe negotiated a Second Additional Protocol to its 2001 Budapest Convention on Cybercrime — the main multilateral treaty on cybercrime and digital evidence — to permit direct cooperation between state authorities and service providers established abroad. Abraha (2021) maps this proliferation of initiatives into four approaches (reformist, unilateralist, internationalist, nuanced) and shows that, while there is consensus that the MLAT system is unsustainable, there is little agreement on what should replace it. The unresolved tension is three-sided: effective law enforcement needs speed, volume and direct provider cooperation; territorial sovereignty and conflicts-of-law doctrine (notably GDPR Articles 48 and 44–49, which restrict transfers compelled by foreign orders and, after the CJEU's Schrems II judgment of 16 July 2020 invalidating the EU–US Privacy Shield, demand 'essential equivalence' of protection) resist extraterritorial compulsion; and providers are caught in the middle, exposed to contradictory legal duties. Each candidate solution has a documented defect: the in-force US–UK and US–Australia CLOUD Act executive agreements are reported to create a 'remedial no-man's land' — no rights or remedies for individuals whose data is seized — while operating at high volume; the Second Additional Protocol (opened for signature 12 May 2022) requires, under Article 16(3) of the Protocol, ratification by five Parties to the Budapest Convention to enter into force and, as of 26 August 2026, has only four ratifications (Serbia, Japan, Hungary, Costa Rica), with the US, the UK and Canada among its more than forty non-ratifying signatories; the EU's internal e-Evidence package (Regulation (EU) 2023/1543 on European Production and Preservation Orders, applicable from 18 August 2026) resolves the question only within the EU; and the EU–US negotiations, launched under a 2019 Council mandate and resumed after conclusion of the internal package, remain stuck on the architectural divergence between the US preference for a framework agreement followed by bilaterals with member states (as the CLOUD Act requires) and the EU's insistence on a single self-standing, EU-wide agreement, with open questions about Charter of Fundamental Rights compatibility, reciprocity and the role of the CJEU. Understanding this debate requires no more than these concepts: MLAT (the treaty-based request system), the CLOUD Act (US statute asserting data-control jurisdiction plus bilateral agreement authorisation), the e-Evidence package (the EU's mutual-recognition instruments letting one member state's authority order providers in another to produce or preserve data), the Second Additional Protocol (the Council of Europe's multilateral direct-cooperation protocol), and Schrems II (the CJEU's data-transfer adequacy jurisprudence).

Problem Statement

Restating the open design question left by Abraha's mapping of cross-border data access initiatives (IJLIT 2021), as developed in the author's 2026 monograph and as it stands after the partial developments of 2022–2026: Is there an institutional design for law-enforcement access to electronic evidence held across borders — in the form of treaty or agreement text, certification criteria, and notification and remedy mechanisms — that (1) scales to the routine volumes and speed of cloud-era criminal investigations — which the MLAT system demonstrably does not; (2) is legally sustainable under the conflicting bodies of law involved, including the GDPR and the CJEU's Schrems II line of case law on international data transfers, the EU Charter of Fundamental Rights, and third states' sovereignty and constitutional protections — reconciling the practical necessities of law enforcement with territorial sovereignty, the fundamental rights of individuals whose data is sought, and the interests of the providers whose cooperation is required — without forcing providers into mutually contradictory legal duties; and (3) is politically and institutionally adoptable by a sufficiently broad set of states? Illustrative dimensions of this design question — not a mandatory checklist that an answer must resolve item-by-item — include: (a) whether the EU–US negotiation, launched under a 2019 Council mandate, can bridge the architectural divergence between a self-standing EU-wide agreement and a CLOUD Act-conforming framework-plus-bilaterals structure — and, if not, what legislative or treaty changes on either side would be required; (b) how bilateral CLOUD Act executive agreements should be constrained in their third-country effects — what notification, consultation or veto mechanisms should protect affected non-party states, and what individual remedies should be built in, given that the in-force US–UK and US–Australia agreements currently provide none; (c) how the certification/qualification process for such agreements can avoid producing a fragmented 'winners and losers' landscape of access regimes; and (d) whether the multilateral route — the Budapest Convention's Second Additional Protocol, not yet in force — can attract ratification from states with divergent governance models while preserving or improving domestic privacy protections, or whether another institutional form is needed.

References

  1. Halefom H. Abraha, 'Law enforcement access to electronic evidence across borders: mapping policy approaches and emerging reform initiatives', International Journal of Law and Information Technology 29(2):118–153 (2021). DOI: 10.1093/ijlit/eaab001. https://doi.org/10.1093/ijlit/eaab001
  2. Halefom H. Abraha, 'Regulating Cross-Border Data Access for Law Enforcement', Hart Publishing (Hart Studies in Information Law and Regulation), 2026, ISBN 9781509973279. DOI: 10.5040/9781509973286. https://doi.org/10.5040/9781509973286
  3. Theodore Christakis and Fabien Terpan, 'EU–US negotiations on law enforcement access to data: divergences, challenges and EU law procedures and options', International Data Privacy Law 11(2):81–106 (2021). DOI: 10.1093/idpl/ipaa022. https://doi.org/10.1093/idpl/ipaa022
  4. Marcin Rojszczak, 'CLOUD Act agreements from an EU perspective', Computer Law & Security Review 38:105442 (2020). DOI: 10.1016/j.clsr.2020.105442. https://doi.org/10.1016/j.clsr.2020.105442
  5. Jennifer Daskal, 'Unpacking the CLOUD Act', eucrim – The European Criminal Law Associations' Forum 13:220–225 (2018). DOI: 10.30709/eucrim-2018-022. https://doi.org/10.30709/eucrim-2018-022
  6. Council of Europe, Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence, CETS No. 224, opened for signature Strasbourg, 12 May 2022 (status chart consulted 26 August 2026). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=224 (protocol text: https://rm.coe.int/1680a49dab)
  7. Gianluca Forlani, 'The E-evidence Package: The Happy Ending of a Long Negotiation Saga', eucrim – The European Criminal Law Associations' Forum 18:174–181 (2023). DOI: 10.30709/eucrim-2023-013. https://doi.org/10.30709/eucrim-2023-013
  8. Jorge A. Espina Ramos, 'European Preservation and Production Orders: A Non-Exclusive Approach to E-Evidence within the EU: Implications of the Union Legislator's Choice to Derogate from the Precedence of Union Law in the E-Evidence Regulation', eucrim – The European Criminal Law Associations' Forum 20:216–220 (2025). DOI: 10.30709/eucrim-2025-018. https://doi.org/10.30709/eucrim-2025-018
  9. Dan Jerker B. Svantesson and Anna-Maria Osula, 'Unresolved Jurisdictional Issues in Law Enforcement Access to Data', in Vanessa Franssen and Stanisław Tosza (eds.), The Cambridge Handbook of Digital Evidence in Criminal Investigations, Cambridge University Press, 2025. DOI: 10.1017/9781009049771.004. https://doi.org/10.1017/9781009049771.004
  10. Theodore Christakis, 'From Mutual Trust to the Gordian Knot of Notifications: The EU e-Evidence Regulation and Directive', in Vanessa Franssen and Stanisław Tosza (eds.), The Cambridge Handbook of Digital Evidence in Criminal Investigations, Cambridge University Press, 2025, pp. 173–199. DOI: 10.1017/9781009049771.009. https://doi.org/10.1017/9781009049771.009
  11. Gavin Robinson, 'Effective Data Protection and Direct Cooperation on Digital Evidence', in Vanessa Franssen and Stanisław Tosza (eds.), The Cambridge Handbook of Digital Evidence in Criminal Investigations, Cambridge University Press, 2025. DOI: 10.1017/9781009049771.005. https://doi.org/10.1017/9781009049771.005
  12. Ma. Angela Leonor Aguinaldo and Paul de Hert, 'Moving in the Right Direction for Transborder Access to Digital Evidence in Criminal Matters?', in Vanessa Franssen and Stanisław Tosza (eds.), The Cambridge Handbook of Digital Evidence in Criminal Investigations, Cambridge University Press, 2025. DOI: 10.1017/9781009049771.010. https://doi.org/10.1017/9781009049771.010
  13. Andrea Cocchini, 'The Second Additional Protocol to the Convention on Cybercrime: Strengthening international cooperation or endangering fundamental rights?', Archiv des Völkerrechts 61:60–83 (2023). DOI: 10.1628/avr-2023-0005. https://doi.org/10.1628/avr-2023-0005
  14. Jukka Ruohonen, 'Recent Trends in Cross-Border Data Access by Law Enforcement Agencies', arXiv:2302.09942 (2023). https://arxiv.org/abs/2302.09942
  15. Fran Casino, Claudia Pina, Pablo López-Aguilar, Edgar Batista, Agusti Solanas and Constantinos Patsakis, 'SoK: Cross-border Criminal Investigations and Digital Evidence', arXiv:2205.12911 (2022). https://arxiv.org/abs/2205.12911
  16. Barry Appleton, 'Whose Law Governs Canadian Data? The CLOUD Act, Executive Agreements and Digital Sovereignty', Balsillie Papers (2026). DOI: 10.51644/bap97. https://doi.org/10.51644/bap97
  17. Case note, 'CJEU 16 July 2020 – C-311/18 EU-US Privacy Shield Agreement: Legality of Data Transfers to Non-EU Countries – Schrems II', GRUR International 70:299–312 (2021). DOI: 10.1093/grurint/ikab012. https://doi.org/10.1093/grurint/ikab012