Overseas Production Orders: Companies should prepare for new powers to gather electronic data

23 May 2022

The Crime (Overseas Production Orders) Act 2019 (COPOA) was enacted three years ago to give law enforcement agencies the power to directly obtain electronic data from service providers based outside the UK for the purpose of preventing, detecting and investigating serious crimes through the use of Overseas Production Orders (OPOs).
 

In order for OPOs to be issued, a bilateral agreement must be in place between the requesting country and the country where the service provider holding the data is based. At the moment, there is only one such agreement in place with the United States (the Data Sharing Agreement). Discussions with Australia are on-going. An expansion to other countries would mark a major departure from current MLA arrangements which have been criticised for bureaucracy and delay leading to the abandonment of international investigations. Data obtained pursuant to OPOs can be used as evidence in criminal proceedings making this an attractive tool for investigations.

How do they work?

A UK based investigator (the police, SFO, FCA, HMRC and counter terrorism financial investigators) must apply to a Crown Court for an OPO, which allows courts to directly compel overseas companies to produce data without the need to request another state’s assistance in the investigation through traditional MLA routes.

Only certain authorised officers can apply, and the Crown Court judge must be satisfied that at least part of the data sought will substantially aid an investigation into a person overseas for an indictable or terrorism related offence, and certify the Order. Find out more about how they are expected to work here.

 

What can companies expect in practice?

Companies should be aware of the type of data which can be compelled using an OPO under the current Data Sharing Agreement with the US. Disclosure which could lead to a breach of data protection legislation cannot be compelled. Similarly, data subject to legal professional privilege cannot be compelled. OPOs also cannot be used to infringe upon freedom of speech or target individuals based on race, sex, sexual orientation, religion, ethnicity or political opinion. Recipients will need to consider these issues when responding to such an order.

It is important to note that an OPO cannot be used to target a US citizen and MLA must be used instead in those cases regardless of the location of the individual in question. Conversely, the US authorities can obtain data relating to a British Citizen where they are located outside the UK.

The types of data capable of being compelled by way of OPOs will include: contents of electronic or wire communication (and the traffic or metadata pertaining to it), data stored or processed for a user (and the traffic or metadata pertaining to it) and, subscriber information when sought pursuant to an order that also seeks any of the other types of data referenced above.

The recipient of an OPO will usually have a very short time frame (7 days) within which to comply. In practice, where OPOs require disclosure of large quantities of data, it is anticipated that the courts will extend this timeframe.

Of concern for most companies, COPOA is silent in respect of costs which might be significant in some cases depending on the volume of material requested and the specific legal issues surrounding data protection, free speech and discrimination which might arise in any assessment as to whether or not the material is responsive to the request.

If there are grounds to object to the OPO, communication service providers (CSPs) are able to challenge its terms in the UK courts. Companies should also be aware that failure to comply with an OPO is not a criminal offence – it is, however, failure to comply with a court order which could lead to contempt of court proceedings.

 

Recent updates

Some practical amendments to COPOA have recently been implemented in the widely criticised Policing, Crime and Sentencing Act (enacted on 28 April 2022). While these amendments do not address the issues highlighted around data protection, they do widen the scope of which types of data can be compelled under an OPO.

Previously all communications data (including information concerning recipient, sender and time of sending the data) sought from telecommunications service providers were excluded from COPOA’s scope.  

Lastly, the Act removes the requirement in COPOA that the Secretary of State serve OPO. It will still be necessary for a Crown Court judge to approve OPOs on the grounds that they are necessary and proportionate.

 

Conclusion

In response to questions by MPs in an evidence session on 29 March 2022, the Director of the SFO referenced the international component of most cases currently being investigated by the SFO, and stated that the SFO was not experiencing difficulties in getting evidence from overseas by virtue of the relationships it built with foreign law enforcements partners. This may in part explain why, since COPOA received Royal Assent on 12 February 2019, no OPOs have been issued in the UK as yet. However, it is to be expected that UK enforcement agencies will shortly begin make using of this helpful tool, and companies will need to be prepared to deal with such requests with a quick turnaround.

Further information 

If you have any questions regarding the information above, please contact Áine Kervick, Virginia Tournon in our criminal litigation team.

About the author

Áine is a Senior Associate in the criminal team with a wide range of criminal litigation experience. She provides advice and representation to individuals and corporates from the initial stages of criminal investigations up to trial. She regularly represents individuals at police station interviews.

Virginia is an associate in the criminal team.

 

Share insightLinkedIn Twitter Facebook Email to a friend Print

Email this page to a friend

We welcome views and opinions about the issues raised in this blog. Should you require specific advice in relation to personal circumstances, please use the form on the contact page.

Leave a comment

You may also be interested in:

Skip to content Home About Us Insights Services Contact Accessibility