How New E-Evidence Rules Will Affect EU-US Data Transfers

In an article recently authored for Law360, Alex van der Wolk, chair of Morrison Foerster’s European Data, Cyber + Privacy practice, and Dan Alam, Data, Cyber + Privacy associate, looked back at how cross-border requests from law enforcement have historically been viewed within the EU, and how new e-evidence regulation will change that approach, while also discussing the challenges that EU and U.S. businesses will face navigating conflicting obligations across the two continents.

Regulatory changes set to apply in August 2026 (Regulation (EU) 2023/1543) respond “to a pressing need to obtain and preserve digital evidence necessary for criminal investigations, noting that relevant data are increasingly stored outside the EU and existing mechanisms are too slow,” as they noted.

“Once in force, the e-evidence regulation and accompanying national laws will enable EU courts and law enforcement authorities to compel service providers to produce and preserve electronic data, including data held outside the EU, on compressed timelines and without reliance on mutual legal assistance treaties, or MLATs. This approach brings the EU significantly closer to the model employed by U.S. law enforcement authorities, pursuant to the U.S. Stored Communications Act and the Clarifying Lawful Overseas Use of Data Act, or CLOUD Act.”

However, there are challenges, as they discussed: “This convergence may undermine the position that direct law enforcement requests for data across borders are inherently incompatible with EU data protection principles, and may prompt a reassessment of how the GDPR applies to transfers made in response to non-EU law enforcement requests. Until a CLOUD Act agreement between the EU and the U.S. is concluded, service providers will continue to navigate competing legal obligations, and the need for legal certainty in this area remains necessary.”

Read the full article.