A first-of-its-kind agreement between the US and UK governments came into force this week, promising to streamline digital investigations for British law enforcers.
The Data Access Agreement technically allows each country’s investigators to benefit from faster access to data stored by service providers in the other country, although in practice it will mainly benefit UK cops requesting information from US social media and other companies.
Because of local legal restrictions on US providers sharing their data with foreign governments, investigators were previously forced to lodge requests via Mutual Legal Assistance Treaties (MLATs), which was a slow, painful and error-prone process.
The Data Access Agreement will speed things up considerably, forcing cloud storage companies, social media providers, messaging platforms and other digital service providers to reply to overseas production orders (OPOs) within seven days, according to law firm Cooley.
Failure to do so could render them in contempt of court, it warned.
“The Data Access Agreement will allow information and evidence that is held by service providers within each of our nations and relates to the prevention, detection, investigation or prosecution of serious crime to be accessed more quickly than ever before,” noted a joint statement penned between Washington and London.
“This will help, for example, our law enforcement agencies gain more effective access to the evidence they need to bring offenders to justice, including terrorists and child abuse offenders, thereby preventing further victimization.”
However, legal experts have also warned that any UK service providers responding to requests from US law enforcers would have to consider whether there was a “legal basis” for data transfers under the GDPR. Data flowing the other way would not be subject to the same concerns given the European Commission’s adequacy decision regarding the UK.
That said, Cooley predicted that OPOs would still come under intense legal scrutiny.
“It is expected that OPOs may (and will) be challenged on a significant number of different grounds, including for breach of data protection laws and to determine applicability of US or UK legal privilege protections,” it said.
“The primary venue to challenge OPOs sent by UK law enforcement will be the Courts of England and Wales; however, it is likely that challenges will be made concurrently in the US. The scene is now set for critically important legal challenges to be made to help determine how the new process should be applied across the CSP community.”
Firms served with an OPO are urged to seek legal advice as soon as they receive an order.