Investigations
Can one state ask another to freeze data before it has decided whether to ask for it?
Yes, and the two steps can get different answers for the same data. The Convention expressly removes dual criminality as a condition of preservation, while allowing a Party that requires it for disclosure to refuse preservation where it foresees the condition failing.
In short
Freezing data and obtaining it are two steps domestically, and they stay two steps across a border — but the border adds something. Between States the two steps are governed by different conditions, so the same data can attract a yes at the freezing stage and a no at the disclosure stage.
Why it exists
AnalysisThe reason a separate freezing step exists internationally is the same reason it exists domestically, made worse by distance: the fuller process takes time, and data that matters may be gone before it finishes. Between States the fuller process takes considerably longer, because a second legal system has to evaluate the request under its own law.
How it works
Article 29(1) of the Convention on Cybercrime lets a Party request another "to order or otherwise obtain the expeditious preservation of data stored by means of a computer system, located within the territory of that other Party and in respect of which the requesting Party intends to submit a request for mutual assistance for the search or similar access, seizure or similar securing, or disclosure of the data". Article 29(2)(f) requires the request itself to state that intention.
Then comes the finding that makes the two steps genuinely different in law. Article 29(3) provides that "For the purposes of responding to a request, dual criminality shall not be required as a condition to providing such preservation". Article 29(4) then allows a Party that does require dual criminality for a mutual assistance request for search, seizure or disclosure to reserve the right to refuse preservation, for offences other than those the Convention establishes, "in cases where it has reasons to believe that at the time of disclosure the condition of dual criminality cannot be fulfilled".
Article 30 adds a narrow disclosure inside the preservation mechanism. Where, executing an Article 29 request to preserve traffic data, the requested Party discovers that a service provider in another State was involved in transmitting the communication, it must expeditiously disclose "a sufficient amount of traffic data to identify that service provider and the path through which the communication was transmitted". Article 30(2) permits that to be withheld only where the request concerns a political offence, or where execution is likely to prejudice the requested Party’s sovereignty, security, ordre public or other essential interests.
The disclosure step proper is Article 31: a Party may request another to search or similarly access, seize or similarly secure, and disclose data stored in the requested Party’s territory, "including data that has been preserved pursuant to Article 29". Article 31(3) requires an expedited response where there are grounds to believe the data is particularly vulnerable to loss or modification, or where the applicable instruments otherwise provide for expedited cooperation.
The European Union framework keeps the same two steps and states the relationship in the same place. Article 3(2) of Regulation (EU) 2023/1543 defines a European Preservation Order as a decision "which orders the preservation of electronic evidence for the purposes of a subsequent request for production".
Common misconceptions
Widely held beliefs that do not match how the system actually operates.
Common belief: If another state has preserved the data, the requesting state has it.
In practice: Article 29(1) requires the requesting Party to intend a separate mutual assistance request for disclosure, and Article 29(2)(f) requires the preservation request to say so. Article 31 is the request that actually obtains the data.
Common belief: Mutual legal assistance requests require dual criminality.
In practice: Not as a general rule, and not for this step. Article 29(3) provides that dual criminality shall not be required as a condition of providing preservation. Whether a State requires it for disclosure is a question about that State, and Article 29(4) is the provision that lets such a State look ahead.
Nothing here establishes what any particular State requires.
Common belief: A state that will preserve data will also disclose it.
In practice: The two decisions are governed differently. Article 29(4) expressly contemplates a Party preserving nothing precisely because it foresees that the disclosure condition will not be met.
Common belief: Article 30 gives the requesting state the preserved data.
In practice: It gives a sufficient amount of traffic data to identify the service provider involved and the path of transmission — enough to work out who else must be asked.
Common belief: Preservation across borders works the same way as preservation at home.
In practice: The mechanism is similar and the conditions are not. Domestically the question is whether the power exists and who may exercise it; internationally a second legal system evaluates the request under its own law, and dual criminality enters at one step and not the other.
The domestic question is answered separately in this section.
Common belief: Preservation is a way of holding material indefinitely.
In practice: It exists to keep a later question answerable. Both instruments read here define it by reference to the request that follows: the Convention requires the requesting Party to intend one, and the EU Regulation defines the order as being for the purposes of a subsequent request for production.
How this varies between jurisdictions
A required section on every guide. Arrangements differ between countries, and we say how.
Four distinct steps, kept in four provisions.
- A request to preserve, conditioned on an intention to request disclosure and requiring that intention to be stated — Convention Art. 29(1), (2)(f).
- Dual criminality expressly excluded as a condition of preservation — Art. 29(3) — with a reservation available to a Party that requires it for disclosure — Art. 29(4).
- A narrow onward disclosure of routing information sufficient to identify another provider and the path — Art. 30(1), withholdable only on the Art. 30(2) grounds.
- The request that actually obtains the data, expedited where it is particularly vulnerable to loss — Art. 31(1), (3).
- The same two-step relationship stated inside the definition of the order — Regulation (EU) 2023/1543, Art. 3(2).
Rights and accountability
AnalysisSeparating the steps is itself a safeguard, and not only a practical convenience. A State asked to freeze data has committed nothing about whether it will hand anything over, and the person whose data it is has not yet been the subject of a disclosure decision by anyone. Article 29(4) makes that explicit by letting a State decline even the lighter step where it can see the heavier one failing.
What we could not establish
- Two instruments were read. No national preservation legislation was read for any country, and no Party’s reservations under Article 29(4) were researched.
- Dual criminality is described only as these instruments treat it. Whether any State requires it, and for what, was not researched, and no general rule about it is stated here.
- Nothing here states a period a reader could use to anticipate when a measure lapses, and nothing describes how data is held, moved or preserved.
Where to go next
Related: preserving data and producing it, mutual legal assistance, and data categories across instruments.
Related topics
- How does one state ask another for evidence?
Through a channel each Party designates and a body of law that mostly is not the treaty being invoked. The Convention’s own procedure applies only where no assistance treaty is in force between the two Parties, and its cooperation articles require each Party to legislate first.
- If data has been "preserved", has anyone read it?
No. Preservation freezes material so that it still exists later; production hands it over. The Convention caps preservation at ninety days precisely because its purpose is to enable authorities to seek disclosure afterwards, by a separate power.
- What does the European Union framework for electronic evidence create, and does it operate yet?
Two orders addressed to a provider’s establishment in another Member State, under a Regulation applying from 18 August 2026. Who may issue one depends on the data category — and a prosecutor may order content preserved but not produced.
- Does "subscriber data" mean the same thing in every instrument?
No. The Convention draws three categories and the European Union Regulation draws four, and the extra one is not a sub-case — it carries its own authorisation rule and its own exemption from the duty to notify the other Member State.
Sources
Council of Europe; consulted in the official treaty database of the Government of the Netherlands (wetten.overheid.nl, BWBV0001839) · International organisation · 2001-11-23 · link verified 2026-09-05
WAVE 22 ADDITION. ACCESS NOTE: rm.coe.int and coe.int returned HTTP 403 to automated requests in this session, so the Convention was read from the official Dutch government treaty database, which publishes the authentic English text alongside the Dutch translation. The English text quoted below is the authentic one; English and French are the authentic languages. Supports Art. 14(1)–(2), that the procedural powers are established “for the purpose of specific criminal investigations or proceedings” and are applied to the offences established under Arts. 2–11, to other criminal offences committed by means of a computer system, and to “the collection of evidence in electronic form of a criminal offence”. Supports Art. 14(3)(a), that a Party restricting the Art. 20 power to specified offences must not restrict it more narrowly than the range to which it applies Art. 21. Supports Art. 15(1), that the powers are subject to conditions and safeguards under domestic law providing adequate protection of human rights, including rights under the 1950 European Convention and the 1966 Covenant, “and which shall incorporate the principle of proportionality”. Supports Art. 15(2), that such conditions and safeguards shall, as appropriate, “include judicial or other independent supervision, grounds justifying application, and limitation of the scope and the duration of such power or procedure”. Supports Art. 16(1)–(3): expedited preservation of specified stored computer data “including traffic data”, in particular where it is particularly vulnerable to loss or modification; where effected by order to a person, an obligation to preserve and maintain integrity “for a period of time as long as necessary, up to a maximum of ninety days, to enable the competent authorities to seek its disclosure”, renewable; and an obligation on the custodian to keep the undertaking of the procedure confidential. Supports Art. 17, expedited preservation and PARTIAL disclosure of traffic data sufficient to identify the service providers and the path through which the communication was transmitted. Supports Art. 18(1)(a)–(b), the production order: a person in the territory to submit specified stored computer data in that person’s possession or control, and a service provider offering services in the territory to submit subscriber information. Supports Art. 18(3), which defines “subscriber information” as information held by a service provider relating to subscribers of its services “OTHER THAN TRAFFIC OR CONTENT DATA” and by which the type of service, the subscriber’s identity, postal or geographic address, telephone and other access number, billing and payment information, and information on the site of installation of communication equipment can be established. Supports Art. 19(1)–(4): the power to search or similarly access a computer system or a computer-data storage medium; the power under 19(2) to EXTEND the search expeditiously to another system in the territory where the data sought is “lawfully accessible from or available to the initial system”; the power under 19(3) to seize or similarly secure, comprising the separate powers to “seize or similarly secure a computer system or part of it or a computer-data storage medium”, to “make and retain a copy of those computer data”, to “maintain the integrity of the relevant stored computer data”, and to “render inaccessible or remove those computer data in the accessed computer system”; and the power under 19(4) to order any person with knowledge about the functioning of the system to provide, as is reasonable, the necessary information. Supports Art. 20, real-time collection of TRAFFIC data, and Art. 21, interception of CONTENT data, the latter available only “in relation to a range of serious offences to be determined by domestic law”; both articles oblige a service provider to keep the execution confidential. Cited for the structural propositions that preservation is a distinct act from production, that traffic data and content data are distinct powers, that subscriber information is defined by exclusion from both, and that seizing, copying and accessing are separately enumerated. LIMITATIONS, and they are load-bearing: this is a TREATY. It obliges Parties to establish powers in domestic law; it is NOT evidence of what any particular Party has enacted, and no country claim on this platform rests on it. It describes no technique. STATUS: in force; the Convention has two additional protocols, of which the Second Additional Protocol on enhanced co-operation and disclosure of electronic evidence was located but NOT read for this wave. WAVE 23 ADDITION. That Protocol has now been read and is held separately as `coe-cybercrime-second-protocol`. Chapter III of the Convention, on international co-operation, was read from the same authentic English text, and it is a different subject from the domestic powers above. Supports Art. 23, that Parties co-operate “in accordance with the provisions of this chapter, and through the application of relevant international instruments on international co-operation in criminal matters, arrangements agreed on the basis of uniform or reciprocal legislation, and domestic laws”. Supports Art. 25(1)-(4), and in particular Art. 25(2), that “Each Party shall also adopt such legislative and other measures as may be necessary to carry out the obligations set forth in Articles 27 through 35” -- the Convention’s own statement that its co-operation articles are not self-executing -- and Art. 25(4), that except as specifically provided “mutual assistance shall be subject to the conditions provided for by the law of the requested Party or by applicable mutual assistance treaties, including the grounds on which the requested Party may refuse co-operation”. Supports Art. 27(1), that the Article applies only “where there is no mutual assistance treaty or arrangement on the basis of uniform or reciprocal legislation in force between the requesting and requested Parties”, and Art. 27(2)(a)-(d), that each Party designates a central authority “responsible for sending and answering requests for mutual assistance, the execution of such requests or their transmission to the authorities competent for their execution”, that central authorities communicate directly with each other, and that the Secretary General keeps a register of them. Supports Art. 29(1)-(4): a Party may request another to preserve data “located within the territory of that other Party and in respect of which the requesting Party intends to submit a request for mutual assistance”; the request must state that intention (29(2)(f)); “For the purposes of responding to a request, dual criminality shall not be required as a condition to providing such preservation” (29(3)); and a Party that requires dual criminality for disclosure may reserve the right to refuse preservation where it has reasons to believe the condition cannot be fulfilled at the time of disclosure (29(4)). Supports Art. 30(1)-(2), expedited disclosure of a sufficient amount of preserved traffic data to identify a service provider in another State and the path through which the communication was transmitted, withholdable only for a political offence or where execution is likely to prejudice sovereignty, security, ordre public or other essential interests. Supports Art. 31(1)-(3), mutual assistance to search, seize and disclose stored data “including data that has been preserved pursuant to Article 29”, responded to on an expedited basis where data is particularly vulnerable to loss. Supports Art. 32 IN FULL, and its narrowness is the point: “A Party may, without the authorisation of another Party: a) access publicly available (open source) stored computer data, regardless of where the data is located geographically; or b) access or receive, through a computer system in its territory, stored computer data located in another Party, if the Party obtains the lawful and voluntary consent of the person who has the lawful authority to disclose the data to the Party through that computer system.” There is no third limb and no unilateral remote-access provision. Supports Art. 33(1)-(2), mutual assistance in the real-time collection of traffic data, governed by the conditions and procedures of domestic law and available at least for offences for which such collection would be available in a similar domestic case; and Art. 34, mutual assistance regarding the interception of content data “to the extent permitted under their applicable treaties and domestic laws”. Supports Art. 35(1)-(2), that each Party designates a point of contact available twenty-four hours a day, seven days a week, to ensure immediate assistance -- facilitating or, if permitted by its domestic law and practice, directly carrying out technical advice, preservation under Arts. 29 and 30, and the collection of evidence, provision of legal information and locating of suspects -- and that where the point of contact is not part of the Party’s authority responsible for international mutual assistance, it must ensure co-ordination with that authority. LIMITATION ON CHAPTER III, restated because it is easy to lose: these are obligations on Parties to legislate and to co-operate. They are NOT evidence of what any Party has enacted. The Party list, signature dates and ratification counts were NOT RESEARCHED, because the Council of Europe Treaty Office returned HTTP 403 to three separate URL forms.
Publications Office of the European Union (EUR-Lex) · International organisation · 2023-07-12 · link verified 2026-09-05
WAVE 23 ADDITION. The Regulation read directly on EUR-Lex. TEMPORAL STATUS, verified from the instrument itself: Art. 34(1) provides that it enters into force on the twentieth day following publication in the Official Journal, and Art. 34(2) provides in terms “It shall apply from 18 August 2026.” Against the research date of 5 September 2026 the Regulation is therefore APPLICABLE, and had been for eighteen days. The SAME paragraph carries a separate and later trigger: “the obligation for competent authorities and service providers to use the decentralised IT system established in Article 19 for written communication under this Regulation shall apply from one year after the adoption of the implementing acts referred to in Article 25” -- whether those implementing acts have been adopted was NOT RESEARCHED, so that trigger date is NOT ESTABLISHED. Supports Art. 3(1), that a “European Production Order” is a decision ordering the production of electronic evidence, issued or validated by a judicial authority of a Member State, and “addressed to a designated establishment or to a legal representative of a service provider offering services in the Union, where that designated establishment or legal representative is located in another Member State bound by this Regulation”. Supports Art. 3(2), that a “European Preservation Order” orders preservation “for the purposes of a subsequent request for production”. Supports the four data definitions in Art. 3(9)-(12): subscriber data; “data requested for the sole purpose of identifying the user” as a DISTINCT category; traffic data; and content data, defined as any data in digital format “other than subscriber data or traffic data”. Supports Art. 4(1)-(3), the authorisation ladder: a production order for subscriber data or identification data may be issued by a judge, court, investigating judge OR PUBLIC PROSECUTOR, or by another competent investigating authority whose order is then validated by one of those; a production order for traffic data (other than identification data) or content data may be issued only by a judge, court or investigating judge -- NOT a public prosecutor -- or validated by one of those; and a PRESERVATION order for data of ANY category may be issued by a judge, court, investigating judge or public prosecutor. Supports Art. 8(1)-(4): where a production order seeks traffic data (other than identification data) or content data, the issuing authority shall notify the enforcing authority by transmitting the EPOC to it at the same time as to the addressee; that duty does not apply where the issuing authority has reasonable grounds to believe both that the offence was, is being or is likely to be committed in the issuing State and that the person whose data are requested resides there; and the notification “shall have a suspensive effect on the obligations of the addressee” except in emergency cases. Supports Art. 13(1)-(3): the issuing authority shall without undue delay inform the person whose data are being requested, may delay, restrict or omit that under the conditions of Art. 13(3) of Directive (EU) 2016/680 while recording reasons, and when informing shall include information about available remedies. Supports Art. 17(1)-(2), the reasoned-objection procedure where an addressee considers compliance would conflict with the law of a third country, and that the objection may not rest merely on the absence of similar provisions in that law. Supports Art. 18(1)-(2), that any person whose data were requested has the right to effective remedies, exercised “before a court in the issuing State” and including a challenge to legality, necessity and proportionality. Supports recital 8, which states why the instrument exists alongside the European Investigation Order: Directive 2014/41/EU and the Convention on Mutual Assistance in Criminal Matters provide for requesting evidence from another Member State, but “the procedures and timelines” they provide “might not be appropriate for electronic evidence, which is more volatile and could more easily and quickly be deleted”. LIMITATIONS: this is EU law binding the Member States bound by it. It is NOT evidence of the law of any non-EU country and NOT evidence that any particular Member State has any particular arrangement in place. Whether any Member State has designated addressees under Directive (EU) 2023/1544 was NOT RESEARCHED. Articles 5, 6, 7, 9, 10, 11, 12, 14, 15, 16 and 19-33 were not read in full.