Understanding the EPOC and EPOC-PR request types is essential for operators subject to the EU e-Evidence Regulation. The EU e-Evidence Regulation (Regulation 2023\/1543) represents one of the most significant developments in cross-border digital evidence gathering within the European Union. At its core, the regulation introduces two new orders, the European Production Order and the European Preservation Order, which reach the provider as standardised certificates (EPOC and EPOC-PR) and enable judicial authorities in one EU member state to order data directly from the designated establishment or legal representative of a provider in another Member State, wherever the provider is headquartered. For telecommunications operators and other service providers, understanding the distinction between these two instruments is essential for building compliant response processes.<\/p>\n\n\n\n
Cet article propose une analyse d\u00e9taill\u00e9e de l\u2019EPOC et de l\u2019EPOC-PR, en expliquant le r\u00f4le de chaque instrument, qui est habilit\u00e9 \u00e0 les d\u00e9livrer, ce qu\u2019ils exigent des prestataires de services, en quoi ils diff\u00e8rent l\u2019un de l\u2019autre et comment ils s\u2019articulent avec les dispositifs existants interception l\u00e9gale<\/a> obligations.<\/p>\n\n\n\n The EPOC is an order requiring a service provider to produce specific electronic evidence to the issuing authority. It is the more consequential of the two instruments, as it compels the actual disclosure of data. EPOCs can be issued for subscriber data, for data requested for the sole purpose of identifying the user (such as an IP address with source port and timestamp), for traffic data, and for content data. The authorisation requirements depend on the category. In this article, ‘EPOC’ and ‘EPOC-PR’ are used as shorthand for the orders they transmit.<\/p>\n\n\n\n For subscriber data and user-identification data \u2014 which include basic registration information and IP addresses with source port and timestamp \u2014 an EPOC can be issued by a judge, a court, an investigating judge, or a prosecutor (or by another competent investigating authority, subject to validation). For traffic data and content data \u2014 which include communication metadata such as connection logs and the actual content of communications \u2014 an EPOC must be issued or validated by a judge, a court or an investigating judge, reflecting the higher privacy impact of these data categories. For these categories the issuing authority usually notifies the enforcing authority at the same time; outside emergencies, the provider then transmits at the end of the 10-day period unless a ground for refusal is raised.<\/p>\n\n\n\n When a service provider receives an EPOC, it must produce the requested data within ten days, or within eight hours in emergency cases. Any problem with an order (an incomplete form, manifest errors, de facto impossibility, immunities or privileges) is reported on the Annex III form to the issuing authority and, where it was notified, to the enforcing authority of the Member State where the provider’s designated establishment or legal representative is located. Potential conflicts with the law of a third (non-EU) country are raised by the provider through a reasoned objection within 10 days (Article 17). However, the provider cannot simply refuse to comply; the regulation obliges the addressee to execute the order within the deadline unless one of these specific procedures applies.<\/p>\n\n\n\n L\u2019EPOC marque une rupture significative par rapport aux proc\u00e9dures traditionnelles d\u2019entraide judiciaire (MLA), qui exigent que les demandes transitent par des autorit\u00e9s centrales et dont le traitement peut prendre des mois, voire des ann\u00e9es. En permettant aux autorit\u00e9s judiciaires d\u2019adresser directement des ordonnances aux prestataires de services, le r\u00e8glement sur les preuves \u00e9lectroniques r\u00e9duit consid\u00e9rablement le temps n\u00e9cessaire \u00e0 l\u2019obtention de preuves num\u00e9riques transfrontali\u00e8res. Pour les prestataires de services, cela signifie qu\u2019ils doivent \u00eatre pr\u00eats \u00e0 recevoir, valider et r\u00e9pondre aux EPOC dans des d\u00e9lais tr\u00e8s courts.<\/p>\n\n\n\n L\u2019EPOC-PR est un instrument moins intrusif qui impose \u00e0 un fournisseur de services de conserver des preuves \u00e9lectroniques sp\u00e9cifiques dans l\u2019attente d\u2019une demande de communication ult\u00e9rieure. Contrairement \u00e0 l\u2019EPOC, l\u2019EPOC-PR n\u2019oblige pas le fournisseur \u00e0 divulguer des donn\u00e9es \u2014 il lui impose simplement de veiller \u00e0 ce que les donn\u00e9es sp\u00e9cifi\u00e9es ne soient pas supprim\u00e9es, modifi\u00e9es ou rendues indisponibles de quelque mani\u00e8re que ce soit. L\u2019EPOC-PR fait office de mesure conservatoire visant \u00e0 emp\u00eacher la perte de preuves pendant que l\u2019autorit\u00e9 \u00e9mettrice pr\u00e9pare une ordonnance de production ou toute autre proc\u00e9dure judiciaire en vue d\u2019obtenir les donn\u00e9es.<\/p>\n\n\n\n Prosecutors can issue an EPOC-PR for any data category, whereas EPOCs for traffic or content data require a judge, a court or an investigating judge. This broader issuing authority reflects the lower privacy impact of preservation (the data is retained but not disclosed) compared to production (the data is actually disclosed to the requesting authority).<\/p>\n\n\n\n When a service provider receives an EPOC-PR, it must take immediate steps to preserve the specified data. The preservation obligation ends after 60 days. Within that period the issuing authority can extend it once by 30 days if it needs more time to issue a production request. If it confirms (Annex V) that a production request has been issued, the provider must keep preserving the data until it is produced. Without either, the obligation lapses, and the data fall back under the provider’s normal retention rules.<\/p>\n\n\n\n L'EPOC-PR s'av\u00e8re particuli\u00e8rement utile dans les situations o\u00f9 des \u00e9l\u00e9ments de preuve risquent d'\u00eatre supprim\u00e9s \u2014 par exemple, lorsqu'un suspect a connaissance d'une enqu\u00eate et pourrait tenter de d\u00e9truire des preuves, ou lorsque les donn\u00e9es sont susceptibles d'\u00eatre supprim\u00e9es automatiquement en vertu des politiques de conservation du fournisseur de services. En garantissant rapidement la conservation des donn\u00e9es, l\u2019EPOC-PR emp\u00eache la perte de preuves tout en laissant le temps n\u00e9cessaire au processus d\u2019autorisation plus rigoureux requis pour une ordonnance de production.<\/p>\n\n\n\n Les diff\u00e9rences entre l'EPOC et l'EPOC-PR sont fondamentales et portent sur plusieurs aspects. La distinction la plus fondamentale r\u00e9side dans leur finalit\u00e9 : un EPOC impose la production (divulgation) des donn\u00e9es, tandis qu'un EPOC-PR impose uniquement la conservation (r\u00e9tention) des donn\u00e9es. L'impact d'un EPOC sur la vie priv\u00e9e est nettement plus important que celui d'un EPOC-PR, ce qui se traduit par des exigences d'autorisation et des garanties proc\u00e9durales diff\u00e9rentes.<\/p>\n\n\n\n Issuing authority requirements differ between the two instruments. EPOCs for traffic and content data must be issued or validated by a judge, a court or an investigating judge, while EPOC-PRs can be issued by prosecutors without judicial validation. This difference reflects the proportionality principle \u2014 the more invasive the measure, the higher the level of judicial oversight required.<\/p>\n\n\n\n Response timescales also differ. EPOCs require production within ten days (or eight hours in emergencies), while EPOC-PRs require immediate preservation with the obligation lasting 60 days (extendable by a further 30 days, and until the data is produced once the authority confirms that a production request has been issued). The EPOC-PR is designed to be a rapid, temporary measure, while the EPOC is a definitive order requiring substantive compliance.<\/p>\n\n\n\n The grounds for refusal differ between the two instruments. For EPOCs that require notification, the enforcing authority can refuse on limited grounds (immunities and privileges, a manifest breach of fundamental rights, ne bis in idem, dual criminality). The provider itself can flag immunities or privileges on the Annex III form, file a reasoned objection on third-country law, and object to enforcement only on the grounds in Article 16(4), points (a) to (f). For EPOC-PRs there is no notification and no ground for refusal by the enforcing authority, and no third-country objection procedure. The provider can report problems on the Annex III form and, if enforcement is sought, object on the grounds in Article 16(5).<\/p>\n\n\n\n Les op\u00e9rateurs de t\u00e9l\u00e9communications comptent parmi les destinataires les plus susceptibles de recevoir \u00e0 la fois des EPOC et des EPOC-PR, compte tenu du volume de donn\u00e9es relatives aux abonn\u00e9s, au trafic et aux contenus qu\u2019ils d\u00e9tiennent. Les op\u00e9rateurs doivent mettre en place des processus et des syst\u00e8mes permettant de traiter ces deux types d\u2019ordonnances, notamment la capacit\u00e9 de recevoir et de valider les ordonnances entrantes, d\u2019identifier les donn\u00e9es pertinentes dans leurs syst\u00e8mes, de conserver les donn\u00e9es en r\u00e9ponse aux EPOC-PR, de fournir les donn\u00e9es en r\u00e9ponse aux EPOC, de suivre l\u2019\u00e9tat d\u2019avancement et les d\u00e9lais de chaque ordonnance, et de tenir \u00e0 jour la documentation et les pistes d\u2019audit pour conformit\u00e9 r\u00e9glementaire<\/a>.<\/p>\n\n\n\n Le d\u00e9lai de r\u00e9ponse de dix jours pour les EPOC (et de huit heures pour les urgences) est particuli\u00e8rement exigeant. Les op\u00e9rateurs doivent disposer de processus permettant l\u2019identification et l\u2019extraction rapides des donn\u00e9es demand\u00e9es, leur examen par du personnel juridique et de conformit\u00e9 qualifi\u00e9, ainsi que leur transmission s\u00e9curis\u00e9e \u00e0 l\u2019autorit\u00e9 requ\u00e9rante. Les processus manuels reposant sur l\u2019intervention de chaque individu peuvent ne pas suffire \u00e0 respecter ces d\u00e9lais de mani\u00e8re syst\u00e9matique, et les op\u00e9rateurs devraient envisager d\u2019investir dans des syst\u00e8mes automatis\u00e9s ou semi-automatis\u00e9s pour traiter les demandes de preuves \u00e9lectroniques.<\/p>\n\n\n\n Il est important de distinguer les ordonnances relatives aux preuves \u00e9lectroniques de l\u2019interception l\u00e9gale. L\u2019interception l\u00e9gale implique la capture et la transmission en temps r\u00e9el des communications au fur et \u00e0 mesure qu\u2019elles ont lieu. Les ordonnances relatives aux preuves \u00e9lectroniques, en revanche, concernent des donn\u00e9es stock\u00e9es, c'est-\u00e0-dire des donn\u00e9es qui ont d\u00e9j\u00e0 \u00e9t\u00e9 g\u00e9n\u00e9r\u00e9es et qui sont conserv\u00e9es par le fournisseur de services. Un EPOC peut demander des donn\u00e9es historiques de trafic, des dossiers d'abonn\u00e9s ou du contenu stock\u00e9, mais il n'autorise pas l'interception en temps r\u00e9el.<\/p>\n\n\n\n Cependant, ces deux cadres sont compl\u00e9mentaires. Les forces de l\u2019ordre peuvent recourir \u00e0 des mandats relatifs aux preuves \u00e9lectroniques pour obtenir des donn\u00e9es historiques sur les habitudes de communication d\u2019une personne cibl\u00e9e, puis recourir \u00e0 l\u2019interception l\u00e9gale pour surveiller les communications en cours de cette personne. Les op\u00e9rateurs doivent \u00eatre en mesure de prendre en charge ces deux cadres, en disposant de syst\u00e8mes et de processus adapt\u00e9s \u00e0 chacun d\u2019entre eux. Le conservation des donn\u00e9es<\/a> Les politiques de l'op\u00e9rateur jouent \u00e9galement un r\u00f4le important, car la disponibilit\u00e9 des donn\u00e9es historiques d\u00e9pend de la dur\u00e9e pendant laquelle l'op\u00e9rateur conserve les diff\u00e9rentes cat\u00e9gories de donn\u00e9es.<\/p>\n\n\n\n Les op\u00e9rateurs devraient commencer \u00e0 se pr\u00e9parer \u00e0 Conformit\u00e9 en mati\u00e8re de preuves \u00e9lectroniques<\/a> by designating a designated establishment (if established in the EU) or appointing a repr\u00e9sentant l\u00e9gal<\/a> in a Member State where they offer services (if not) to receive and handle e-Evidence orders. This was due by 18 August 2026. They should map which data they actually hold and for how long under existing law and business need, so they can find it quickly. The e-Evidence Regulation does not require them to keep data longer than they already do. They should also develop internal procedures for receiving, validating, and responding to both EPOCs and EPOC-PRs, train relevant staff on the requirements and timescales, and implement technical systems to support the rapid identification, preservation, and extraction of requested data.<\/p>\n\n\n\n The EPOC and EPOC-PR are the two pillars of the EU e-Evidence framework, each serving a distinct purpose in the cross-border evidence-gathering process. The EPOC compels the production of specified data, while the EPOC-PR requires its preservation. Together, they provide law enforcement with a faster, more direct mechanism for obtaining digital evidence across EU borders, complementing the slower EIO and MLA channels, which remain available. For telecommunications operators, compliance with both instruments requires investment in processes, systems, and trained personnel \u2014 but providers that set this up properly gain smoother compliance, reduced regulatory risk, and a constructive relationship with the law enforcement authorities that rely on operator cooperation.<\/p>\n\n\n The e-Evidence Regulation also introduces requirements for the establishment of a decentralised IT system to facilitate the transmission of e-Evidence orders between member states and service providers. Since 18 August 2026, orders and responses must go through the EU’s decentralised IT system (built on e-CODEX), where the Member State concerned has connected it. Providers access it through their Member State’s national system, either through the web-based interface or an API based on ETSI TS 104 144. Where the national components are not yet live, orders arrive by secure alternative means, and providers must handle both. The IT system provides a secure, standardised channel for the exchange of orders and responses, and aligning internal processes with its technical requirements avoids compliance challenges as more Member States connect.<\/p>\n\n\n\n Now that the EU e-Evidence Regulation applies, the volume of EPOC and EPOC-PR requests will increase significantly. Operators must ensure their processes can handle EPOC and EPOC-PR requests within the mandated timelines.<\/p>\n\n\n\n Pour en savoir plus sur des sujets connexes, consultez les articles suivants :<\/p>\n\n\n\n Les ressources externes suivantes fournissent un contexte suppl\u00e9mentaire et une documentation officielle :<\/p>\n\n\n\nUnderstanding EPOC and EPOC-PR<\/h2>\n\n\n\n
The European Preservation Order (EPOC-PR)<\/h2>\n\n\n\n
Principales diff\u00e9rences entre l'EPOC et l'EPOC-PR<\/h2>\n\n\n\n
Cons\u00e9quences pour les op\u00e9rateurs de t\u00e9l\u00e9communications<\/h2>\n\n\n\n
Lien avec l'interception l\u00e9gale<\/h2>\n\n\n\n
Se pr\u00e9parer \u00e0 la conformit\u00e9 en mati\u00e8re de preuves \u00e9lectroniques<\/h2>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
Articles connexes<\/h2>\n\n\n\n
Ressources externes<\/h2>\n\n\n\n