Understanding the EPOC and EPOC-PR request types is essential for operators subject to the EU e-Evidence Regulation. The EU e-Evidence Regulation (Regulation 2023/1543) represents one of the most significant developments in cross-border digital evidence gathering within the European Union. At its core, the regulation introduces two new orders, the European Production Order and the European Preservation Order, which reach the provider as standardised certificates (EPOC and EPOC-PR) and enable judicial authorities in one EU member state to order data directly from the designated establishment or legal representative of a provider in another Member State, wherever the provider is headquartered. For telecommunications operators and other service providers, understanding the distinction between these two instruments is essential for building compliant response processes.
本文对EPOC和EPOC-PR进行了详细探讨，阐述了每种工具的功能、哪些机构有权签发、对服务提供商有哪些要求、它们之间有何区别，以及它们与现有 合法拦截 义务。.
Understanding EPOC and EPOC-PR
The EPOC is an order requiring a service provider to produce specific electronic evidence to the issuing authority. It is the more consequential of the two instruments, as it compels the actual disclosure of data. EPOCs can be issued for subscriber data, for data requested for the sole purpose of identifying the user (such as an IP address with source port and timestamp), for traffic data, and for content data. The authorisation requirements depend on the category. In this article, ‘EPOC’ and ‘EPOC-PR’ are used as shorthand for the orders they transmit.
For subscriber data and user-identification data — which include basic registration information and IP addresses with source port and timestamp — an EPOC can be issued by a judge, a court, an investigating judge, or a prosecutor (or by another competent investigating authority, subject to validation). For traffic data and content data — which include communication metadata such as connection logs and the actual content of communications — an EPOC must be issued or validated by a judge, a court or an investigating judge, reflecting the higher privacy impact of these data categories. For these categories the issuing authority usually notifies the enforcing authority at the same time; outside emergencies, the provider then transmits at the end of the 10-day period unless a ground for refusal is raised.
When a service provider receives an EPOC, it must produce the requested data within ten days, or within eight hours in emergency cases. Any problem with an order (an incomplete form, manifest errors, de facto impossibility, immunities or privileges) is reported on the Annex III form to the issuing authority and, where it was notified, to the enforcing authority of the Member State where the provider’s designated establishment or legal representative is located. Potential conflicts with the law of a third (non-EU) country are raised by the provider through a reasoned objection within 10 days (Article 17). However, the provider cannot simply refuse to comply; the regulation obliges the addressee to execute the order within the deadline unless one of these specific procedures applies.
《电子证据条例》（EPOC）与传统的司法互助（MLA）程序有着显著不同，后者要求请求必须通过中央机关转交，处理过程可能需要数月甚至数年。通过允许司法机关直接向服务提供商发出命令，《电子证据条例》大幅缩短了获取跨境数字证据所需的时间。 对于服务提供商而言，这意味着它们必须做好准备，在紧迫的时间期限内接收、验证并回应EPOC。.
The European Preservation Order (EPOC-PR)
EPOC-PR 是一种侵入性较小的措施，要求服务提供商在后续收到调取请求之前保留特定的电子证据。与 EPOC 不同，EPOC-PR 并不要求服务提供商披露任何数据——它仅要求服务提供商确保指定数据不被删除、篡改或以其他方式导致无法获取。 EPOC-PR 作为一项暂存措施，可在签发机构准备数据调取令或其他法律程序以获取数据期间，防止证据丢失。.
Prosecutors can issue an EPOC-PR for any data category, whereas EPOCs for traffic or content data require a judge, a court or an investigating judge. This broader issuing authority reflects the lower privacy impact of preservation (the data is retained but not disclosed) compared to production (the data is actually disclosed to the requesting authority).
When a service provider receives an EPOC-PR, it must take immediate steps to preserve the specified data. The preservation obligation ends after 60 days. Within that period the issuing authority can extend it once by 30 days if it needs more time to issue a production request. If it confirms (Annex V) that a production request has been issued, the provider must keep preserving the data until it is produced. Without either, the obligation lapses, and the data fall back under the provider’s normal retention rules.
在证据可能面临被删除风险的情况下，EPOC-PR 尤其有用——例如，当嫌疑人知晓调查情况并可能试图销毁证据时，或者当数据根据服务提供商的保留政策将被自动删除时。 通过迅速确保数据的保全，EPOC-PR 既防止了证据的丢失，又为签发调取令所需的更严格的授权程序留出了时间。.
EPOC 与 EPOC-PR 之间的主要区别
EPOC 与 EPOC-PR 之间的差异是根本性的，涉及多个方面。目的是最基本的区别：EPOC 强制要求提供（披露）数据，而 EPOC-PR 仅强制要求保存（保留）数据。 EPOC 对隐私的影响远大于 EPOC-PR，这体现在不同的授权要求和程序性保障措施上。.
Issuing authority requirements differ between the two instruments. EPOCs for traffic and content data must be issued or validated by a judge, a court or an investigating judge, while EPOC-PRs can be issued by prosecutors without judicial validation. This difference reflects the proportionality principle — the more invasive the measure, the higher the level of judicial oversight required.
Response timescales also differ. EPOCs require production within ten days (or eight hours in emergencies), while EPOC-PRs require immediate preservation with the obligation lasting 60 days (extendable by a further 30 days, and until the data is produced once the authority confirms that a production request has been issued). The EPOC-PR is designed to be a rapid, temporary measure, while the EPOC is a definitive order requiring substantive compliance.
The grounds for refusal differ between the two instruments. For EPOCs that require notification, the enforcing authority can refuse on limited grounds (immunities and privileges, a manifest breach of fundamental rights, ne bis in idem, dual criminality). The provider itself can flag immunities or privileges on the Annex III form, file a reasoned objection on third-country law, and object to enforcement only on the grounds in Article 16(4), points (a) to (f). For EPOC-PRs there is no notification and no ground for refusal by the enforcing authority, and no third-country objection procedure. The provider can report problems on the Annex III form and, if enforcement is sought, object on the grounds in Article 16(5).
对电信运营商的影响
鉴于电信运营商掌握着大量用户数据、流量数据和内容数据，它们是最有可能收到EPOC和EPOC-PR的机构之一。 运营商必须建立处理这两类命令的流程和系统，包括接收和验证传入命令、在系统中识别相关数据、根据EPOC-PRs保留数据、根据EPOCs提供数据、跟踪每项命令的状态和时间线，以及维护相关文档和审计追踪记录，以便 监管合规.
EPOC的10天响应时限（紧急情况为8小时）要求尤为严格。运营商必须建立相应的流程，以确保能够快速识别和提取所请求的数据，由具备资质的法律和合规人员进行审核，并安全地交付给请求机构。 依赖个人操作的手动流程可能无法始终如一地满足这些时限要求，因此运营商应考虑投资于自动化或半自动化系统，以处理电子证据请求。.
与合法截获的关系
必须将电子证据调取令与合法截取区分开来。合法截取是指在通信发生时对其进行实时捕获和传输。 相比之下，电子证据令则涉及存储数据——即已经生成并由服务提供商保留的数据。电子证据令（EPOC）可要求提供历史流量数据、用户记录或存储内容，但并不授权进行实时截取。.
然而，这两个框架是相辅相成的。执法部门可以利用电子证据令获取目标通信模式的历史数据，然后通过合法截获来监控目标的当前通信。运营商必须能够支持这两个框架，并为每个框架配备相应的系统和流程。该 数据保留 运营商的政策也与此相关，因为历史数据的可用性取决于运营商保留不同类别数据的时间长短。.
为电子证据合规做准备
运营商应开始为……做准备 电子证据合规性 by designating a designated establishment (if established in the EU) or appointing a 法定代表人 in a Member State where they offer services (if not) to receive and handle e-Evidence orders. This was due by 18 August 2026. They should map which data they actually hold and for how long under existing law and business need, so they can find it quickly. The e-Evidence Regulation does not require them to keep data longer than they already do. They should also develop internal procedures for receiving, validating, and responding to both EPOCs and EPOC-PRs, train relevant staff on the requirements and timescales, and implement technical systems to support the rapid identification, preservation, and extraction of requested data.
结论
The EPOC and EPOC-PR are the two pillars of the EU e-Evidence framework, each serving a distinct purpose in the cross-border evidence-gathering process. The EPOC compels the production of specified data, while the EPOC-PR requires its preservation. Together, they provide law enforcement with a faster, more direct mechanism for obtaining digital evidence across EU borders, complementing the slower EIO and MLA channels, which remain available. For telecommunications operators, compliance with both instruments requires investment in processes, systems, and trained personnel — but providers that set this up properly gain smoother compliance, reduced regulatory risk, and a constructive relationship with the law enforcement authorities that rely on operator cooperation.
The e-Evidence Regulation also introduces requirements for the establishment of a decentralised IT system to facilitate the transmission of e-Evidence orders between member states and service providers. Since 18 August 2026, orders and responses must go through the EU’s decentralised IT system (built on e-CODEX), where the Member State concerned has connected it. Providers access it through their Member State’s national system, either through the web-based interface or an API based on ETSI TS 104 144. Where the national components are not yet live, orders arrive by secure alternative means, and providers must handle both. The IT system provides a secure, standardised channel for the exchange of orders and responses, and aligning internal processes with its technical requirements avoids compliance challenges as more Member States connect.
Now that the EU e-Evidence Regulation applies, the volume of EPOC and EPOC-PR requests will increase significantly. Operators must ensure their processes can handle EPOC and EPOC-PR requests within the mandated timelines.
相关文章
如需进一步了解相关主题，请浏览这些文章：
- 电子证据与合法截取的区别及重叠之处
- EU E-Evidence Regulation: What Service Providers Must Do Now
- 电信行业的法律保留义务：运营商必须保留哪些信息以及保留多长时间
外部资源
以下外部资源提供了更多背景资料和官方文件：
