Article 5Conditions for issuing a European Production Order

1. An issuing authority may only issue a European Production Order where the conditions set out in this Article are fulfilled.

2. A European Production Order shall be necessary for and proportionate to the purpose of the proceedings referred to in Article 2(2), taking into account the rights of the suspect or the accused person, and may only be issued if a similar order could have been issued under the same conditions in a similar domestic case.

3. A European Production Order to obtain subscriber data or to obtain data requested for the sole purpose of identifying the user as defined in Article 3, point (10), may be issued for all criminal offences and for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice.

4. A European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), of this Regulation or to obtain content data shall only be issued:

• (a)
  for criminal offences punishable in the issuing State by a custodial sentence of a maximum of at least three years; or
• (b)
  for the following offences, if they are wholly or partly committed by means of an information system:

  • (i)
    offences as defined in Articles 3 to 8 of Directive (EU) 2019/713 of the European Parliament and of the Council ⁽³²⁾;
  • (ii)
    offences as defined in Articles 3 to 7 of Directive 2011/93/EU;
  • (iii)
    offences as defined in Articles 3 to 8 of Directive 2013/40/EU;
• (c)
  for criminal offences as defined in Articles 3 to 12 and 14 of Directive (EU) 2017/541;
• (d)
  for the execution of a custodial sentence or a detention order of at least four months, following criminal proceedings, imposed by a decision that was not rendered in absentia, in cases where the person convicted absconded from justice, for criminal offences referred to in points (a), (b) and (c) of this paragraph.

5. A European Production Order shall include the following information:

• (a)
  the issuing authority and, where applicable, the validating authority;
• (b)
  the addressee of the European Production Order as referred to in Article 7;
• (c)
  the user, except where the sole purpose of the order is to identify the user, or any other unique identifier such as user name, login ID or account name to determine the data that are being requested;
• (d)
  the requested data category as defined in Article 3, points (9) to (12);
• (e)
  if applicable, the time range of the data for which production is requested;
• (f)
  the applicable provisions of the criminal law of the issuing State;
• (g)
  in emergency cases as defined in Article 3, point (18), the duly justified reasons for the emergency;
• (h)
  in cases where the European Production Order is directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, a confirmation that the conditions set out in paragraph 6 of this Article are met;
• (i)
  the grounds for determining that the European Production Order fulfils the conditions of necessity and proportionality under paragraph 2 of this Article;
• (j)
  a summary description of the case.

6. A European Production Order shall be addressed to the service provider acting as controller in accordance with Regulation (EU) 2016/679.

By way of exception, the European Production Order may be directly addressed to the service provider that stores or otherwise processes the data on behalf of the controller, where:

• (a)
  the controller cannot be identified despite reasonable efforts on the part of the issuing authority; or
• (b)
  addressing the controller might be detrimental to the investigation.

7. In accordance with Regulation (EU) 2016/679, the processor that stores or otherwise processes the data on behalf of the controller shall inform the controller about the production of the data unless the issuing authority has requested the service provider to refrain from informing the controller, for as long as necessary and proportionate, in order not to obstruct the relevant criminal proceedings. In that case, the issuing authority shall indicate in the case file the reasons for the delay in informing the controller. A short justification shall also be added in the EPOC.

8. Where the data are stored or otherwise processed as part of an infrastructure provided by a service provider to a public authority, a European Production Order may only be issued where the public authority for which the data are stored or otherwise processed is located in the issuing State.

9. In cases where data protected by professional privilege under the law of the issuing State are stored or otherwise processed by a service provider as part of an infrastructure provided to professionals covered by professional privilege (‘privileged professional’), in their business capacity, a European Production Order to obtain traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or to obtain content data may only be issued:

• (a)
  where the privileged professional resides in the issuing State;
• (b)
  where addressing the privileged professional might be detrimental to the investigation; or
• (c)
  where the privileges were waived in accordance with the applicable law.

10. If the issuing authority has reasons to believe that the traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data requested by the European Production Order are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press or freedom of expression in other media, the issuing authority may seek clarification before issuing the European Production Order, including by consulting the competent authorities of the enforcing State, either directly or via Eurojust or the European Judicial Network.

The issuing authority shall not issue a European Production Order if it finds that the requested traffic data, except for data requested for the sole purpose of identifying the user as defined in Article 3, point (10), or the content data are protected by immunities or privileges granted under the law of the enforcing State, or that those data are subject in that State to rules on determination and limitation of criminal liability relating to freedom of the press and freedom of expression in other media.