Article
Electronic evidence in criminal proceedings
22 October 2026
 | Electronic evidence in criminal proceedings: the European legal framework and the Bulgarian legislative reform Author : Judge Marieta Nedelcheva, District Court – Sofia, member of the Board of Directors of the Bulgarian Judicial Association and national contact person in the National Judicial Network of Bulgaria, contact point in the European Judicial Network |
Summary:
The article examines the European legal framework for cross-border collection of electronic evidence, established by Regulation (EU) 2023/1543 and Directive (EU) 2023/1544, in comparison with the proposals set out in the explanatory memorandum to the draft Act amending and supplementing the Code of Criminal Procedure. The analysis covers the categories of data, the competence of the issuing authorities, the interaction with service providers and the protection of the persons concerned. It is argued that the effectiveness of the reform depends on combining rapid access to data with consistent procedural guarantees, technical reliability and a justified choice of the applicable legal instrument.
Keywords: electronic evidence, criminal proceedings, European Production Order, European Preservation Order, mutual recognition, judicial review.
I. Introduction
Digitalization is significantly changing both the ways in which crimes are committed and the possibilities for proving them. Electronic correspondence, data on the use of communication services, device recordings and information in the cloud environment can be crucial for establishing authorship, the mechanism of the act and the relationships between the participants. Electronic evidence encompasses a variety of sources, the collection of which requires a distinction between the applicable procedural methods.
The main challenge in collecting electronic evidence stems from the mismatch between the territorial organisation of criminal justice and the cross-border nature of digital services. The country of investigation, the place of establishment of the provider and the location of the data may be different, and there is a real risk that the information will be deleted or modified before traditional international legal assistance procedures are completed.
The European e-evidence package (Regulation (EU) 2023/1543 and Directive (EU) 2023/1544) offers a response to the challenges encountered through direct interaction between competent authorities and designated addressees of service providers. The adoption of common rules for the collection of e-evidence is an important step, but their successful implementation requires constant monitoring, control and cooperation. Therefore, speed of access cannot be the only criterion for effectiveness. The information obtained needs to be collected lawfully and be subject to verification in a fair criminal trial.
II. Negotiations and adoption of the e-evidence package
The legislative package proposed by the European Commission in 2018 was adopted after lengthy negotiations. Among the most contentious issues in the discussion of the regulations is the involvement of the state in which the order is addressed: when its authorities must be notified and on what grounds they can refuse execution. The final model combines direct transmission to the provider with control by the executing state in certain cases.
The two acts fulfil different but complementary functions. Regulation (EU) 2023/1543 regulates European Production and Preservation Orders, the conditions for their issuance and the procedures for their enforcement. Directive (EU) 2023/1544 lays down rules for determining the forms of establishment and representatives to receive and enforce the relevant acts. The Regulation applies from 18 August 2026, and the deadline for transposition of the Directive is 18 February 2026.
In the Bulgarian context, the motivations for the draft Law on Amendments and Supplements to the Criminal Procedure Code, published on 03.09.2026 on the Public Consultation Portal of the Council of Ministers, envisage simultaneously ensuring the implementation of the Regulation, transposing the Directive and preparing for ratification of the Second Additional Protocol to the Convention on Cybercrime of the Council of Europe (the so-called Budapest Convention).
III. Key elements of the European package and its national adaptation
1. The Electronic Evidence Regulation
a) Subject matter, scope and categories of data
The Regulation introduces a European Production Order and a European Preservation Order for electronic evidence. These instruments are defined as decisions issued or confirmed by a judicial authority of a Member State and addressed to a designated institution or legal representative of a service provider offering services in the Union and established in another Member State, for the purpose of producing electronic evidence or preserving electronic evidence with a view to a subsequent request for production. With the European Preservation Order, judicial authorities can prevent foreign service providers from erasing or modifying data, while the European Production Order enables authorities to request preserved information directly from service providers immediately or at a later stage.
To this end, the Regulation regulates the conditions for issuing these instruments, their execution by service providers, the notification and grounds for refusal to the executing Member State, the procedure for application and imposition of sanctions, the rights of the persons whose data are sought, the review procedure in the event of conflicting obligations with the laws of a third country, the provisions on standardised certificates and the decentralised information system and finally the rules governing costs.
However, the Regulation does not provide for a complete and exhaustive set of rules governing the application of the European Production Order and the European Preservation Order, but instead repeatedly refers to the rules provided for in national law.
In terms of personal and territorial scope, the Regulation focuses on service providers offering services in the Union. The determination of whether a service provider offers services in the Union is based on an assessment of two cumulative requirements. The first requirement concerns the availability of services in a Member State, while the second requires that there is a substantial connection, based on specific factual criteria, with that Member State or those Member States of the Union. The mechanism provided for in the Regulation covers information already held by or on behalf of a service provider. It is not a tool for continuous real-time surveillance or interception of future communications. In the event that the collection of such information in real time, which involves the use of specific intelligence means in an international context, is sought, a European Investigation Order should be issued, in accordance with the requirements of Directive 2014/41 on the European Investigation Order. Article 3, point 8 of the Regulation distinguishes electronic evidence as subscriber data, traffic data or content data stored by a service provider or on behalf of a service provider in electronic form at the time of receipt of a European Production Order certificate or an electronic preservation order certificate. The competent authority and the conditions for issuing the order depend on the category of electronic evidence the issuing authority needs to preserve or produce.
b) Competence and conditions for issuance
For the provision of subscriber data and data requested solely for the purpose of identifying the user, it is permissible to issue or confirm the order by a competent prosecutor. According to the definition given in Art. 3, point 10 of the Regulation, data requested solely for the purpose of identifying the user are "IP addresses and, where necessary, the relevant ports at the source and the time stamp, namely the date and time or the technical equivalent of these identifiers and the information related to them, when this is required by law enforcement or judicial authorities solely for the purpose of identifying the user in a specific criminal investigation". Thus, the reasons for the draft Act on Amendments and Supplements to the Criminal Procedure Code, which is published on the Public Consultation Portal, propose a new para.7 of Art. 159a of the Criminal Procedure Code. It is envisaged that for certain data required solely for the purpose of establishing the identity of the user and not related to making calls or transmitting messages, the general procedure under Art. 159 of the Code of Criminal Procedure is envisaged. The identification purpose must be explicitly stated in the request.
For other traffic data and content data, the issuance or validation of an Order for the provision of electronic evidence by a judge, a court, or an investigating judge is required, in accordance with Article 4, paragraph 2 of the Regulation. This distinction reflects the different intensity of the interference with the fundamental rights of the persons concerned. In view of the above, the draft Act on the Criminal Procedure Code provides for the creation of Article 159c, with paragraph 2 stating that for traffic data the request is sent by the court in the court proceedings or by the supervising prosecutor in the pre-trial proceedings on the basis of a reasoned order of a judge of the relevant court of first instance, issued in accordance with Article 159a, paragraphs 2-5 of the Criminal Procedure Code.
Despite the wording of the said provision, in this case, when issuing European orders for the provision of traffic data during pre-trial proceedings, the judgment in case C – 724/19 of the Court of Justice of the EU should be taken into account and the decision given in Art. 5, para. 1, letter “c” of the European Investigation Order Act (amended by SG, issue 36 of 2024) should be accepted as an EIO of traffic data should be issued by the relevant court of first instance on the basis of a reasoned request by the supervising prosecutor. This is so, since the only competent authority to order the specific action on the investigation in a national case, according to Art. 159a, para. 1 of the Criminal Procedure Code is the relevant court of first instance. This conclusion also follows from the norm of Art. 4, paragraph 2, letter “a” of the Regulation (personal opinion expressed by the author of the article) .
In all cases, the order must be necessary, proportionate and admissible under the same conditions in a similar national case, taking into account the rights of the suspect or accused. The provision of traffic data is generally subject to the requirement that the offence is punishable by a maximum term of imprisonment of at least three years, in the special cases provided for in the Regulation (Article 5(4) of the Regulation). This threshold does not override the other prerequisites for access. In this regard, the draft Amendment to the Criminal Procedure Code proposes the deletion of the word “intentional” in paragraph 2 of Article 159a of the Criminal Procedure Code (regarding the types of offences for the investigation of which traffic data may be collected). It is also stated that the requirement of “serious intent” goes beyond the provisions of Article 34, paragraph 2 of the Constitution, according to which an exception to the principle of inviolability of the secret of correspondence and other communications is allowed only with the permission of the judiciary, when this is necessary for the detection or prevention of serious crimes, without explicitly indicating the form of guilt. In this way, the competent authorities are deprived of the opportunity to gain access to traffic data, including location data, with a view to detecting serious crimes committed through negligence. The explanatory memorandum to the draft of the Criminal Procedure Code provides an example that in the Criminal Code there are a number of criminal offenses in which the result of the act committed through negligence is sufficiently significant, such as a traffic accident with a fatality or many injured persons.
This change requires careful delineation of the boundary between identification and investigation of communication activity. A formally stated goal should not be sufficient if the volume and combination of information allow for the reconstruction of contacts or behavior.
c) Implementation, deadlines and control
The general time limit for providing data on the basis of a received European Production Order is at the latest ten days, and in case of urgency – at the latest eight hours, taking into account the rules for notifying the executing authority. In the case of retention, the initial time limit is 60 days with the possibility of an extension of another 30 days. The timely confirmation of a subsequent request for production determines the retention for the necessary time until its execution.
For specific traffic data and content orders, pursuant to Article 8 of the Regulation, the issuing authority shall simultaneously notify the executing authority by transmitting the European Production Order certificate to that authority at the same time as transmitting the certificate to its addressee (the designated form of establishment or to the representative of the relevant service provider). The exception to not notifying the executing authority is related to the existence of grounds to assume both that the offence has a connection with the issuing State as provided for in the Regulation and that the person concerned resides in it. This assessment is essential, as it determines the executing State's ability to invoke the grounds for refusal.
Therefore, sending directly to the provider does not remove control, but changes its distribution. This significantly increases the responsibility of the issuing authority for the correct qualification of the data and the motivation of the order.
d) Notification and legal remedies
The Regulation provides for notification of the individual about the provision of his/her data and effective judicial protection against the European Production Order, including challenging its necessity and proportionality. Restriction or postponement of notification is permissible under established conditions and requires justification.
The explanatory memorandum to the draft of the Criminal Procedure Code Act links the national amendments to the case law of the Court of Justice of the EU in case C‑350/21 and of the ECtHR in the case of “Ekimdzhiev and Others v. Bulgaria”. It is proposed to create a new Art. 159e in the Criminal Procedure Code for notification of the affected person and amendments to the Law on liability of the state and municipalities for damages regarding the liability of the state in the event of unlawful access to traffic data.
These remedies should operate as a coherent mechanism. Notification enables challenge, judicial review establishes the lawfulness of the interference, and compensation provides protection in the event of harm. None of the elements can fully replace the others.
2. The Directive on the designation of addressees
Directive (EU) 2023/1544 requires providers to designate a form of establishment or representative with the necessary powers and resources to receive and execute relevant decisions and orders. This creates a predictable channel of communication and reduces legal uncertainty for both authorities and private parties. The functions of these addressees are not limited to the Regulation, but also cover other instruments referred to in the Directive.
The explanatory memorandum to the draft Law on Amendments to the Criminal Procedure Code provides for the transposition of the Directive by introducing amendments to the Electronic Communications Act and the Electronic Commerce Act, including sanctions for non-compliance.
According to the Regulation, all written communications between national authorities and designated entities or legal representatives of service providers shall be carried out through a secure and reliable decentralised information system. The annexes to the Regulation contain the forms to be used. In order to correctly complete the forms for issuing European Preservation Orders and European Production Orders under the Sirius project, manuals have been prepared, which indicate the data and information to be filled in.
The draft of the Criminal Procedure Code Act proposes that the Communications Regulation Commission, within 6 months of the law coming into force, establishes and maintains a separate e-CODEX access point, which enables digital connectivity within the EU and through which the addressees specified by the Electronic Communications Act and the Electronic Commerce Act will connect to the decentralized information system in order to receive a certificate for a European Production and Preservation Order for electronic evidence. This is a national organizational decision, justified in the reasoning by security requirements and the separation of access by private providers from the internal systems of judicial institutions.
IV. Consequences for stakeholders
1. Judicial and investigative authorities
The new regime requires not only knowledge of the forms, but also the ability to choose the appropriate legal instrument. The choice may be influenced by costs, convenience of communication channel or familiarity with a particular procedure, rather than a comprehensive assessment of the specific case.
Of additional importance for Bulgarian practice are the proposals in the draft Criminal Procedure Code Act for access to traffic data in the case of serious negligent crimes, as well as for updating the regime of electronic correspondence under Art. 165 of the Criminal Procedure Code. They aim to overcome restrictions that, according to the motives, make the investigation difficult and do not correspond to modern communication technologies.
However, the expanded capabilities require an individual assessment of the scope and urgency of the intervention. It is necessary to distinguish between securing a device against loss of information and access to protected content. The mere presence of a digital medium does not justify unlimited examination of all data stored on it.
2. Service providers
Providers must organize timely processing of orders, protection of confidentiality and integrity of information, and communication in case of legal or factual obstacles. Direct interaction assigns significant responsibilities to the private sector without making the provider a substitute for the judicial authority.
Cases of conflict with obligations under the law of a third country are particularly complex. For these, a special review procedure is foreseen, including a judicial review when maintaining the order. This shows that independence from the physical location of the data does not eliminate all possible conflicts between jurisdictions.
3. Affected persons and protection
The possibility for the suspect, the accused or his lawyer to request the issuance of a warrant is also important for the collection of evidence relevant to the defense of the accused. It must be practically usable, especially when the information is fragile and delay may lead to its loss.
Lawful receipt does not prejudge the probative value. The court must assess the reliability, context and connection of the information with the rest of the evidence . The European mechanism facilitates access but does not exempt national authorities from verifying the evidence while respecting the right to a fair trial and the rights of the defence.
V. Relationships with international instruments and choice of legal basis
Article 32(1) of the Regulation preserves the applicability of other instruments, agreements and arrangements for gathering evidence. European Production and Preservation Orders do not automatically replace the European Investigation Order or the applicable international legal assistance mechanisms. In this case, the advantage is flexibility. In an investigation requiring different actions, the European Investigation Order may be a more appropriate instrument, covering not only information from a provider but also other sources of evidence, respectively the performance of other investigative measures . A combination of mechanisms is also permissible - for example, a European Preservation Order followed by a request for production under another applicable procedure with a European Investigation Order.
In view of the introduction of the new regime for collecting electronic evidence in criminal proceedings, the following conclusions should be drawn:
First of all, a precise distinction is needed between the categories of data, in particular between the identification of the user and the investigation of his communication activity, for which European orders for the production of electronic evidence will be issued in the future. The distinction should be determined by the actual content and scope of the interference, and not only by the wording of the request.
Second, expanding access to electronic information must be accompanied by effective mechanisms for notification, redress, and redress. Procedural speed cannot compensate for the lack of effective protection.
Last but not least, the regulatory framework, digital infrastructure and professional training must develop in a coherent manner. Otherwise, the choice of instrument may be determined by organisational difficulties rather than the legal specificities of the case. The success of the reform in the field of collecting electronic evidence is therefore not measured solely by obtaining information more quickly. Its criterion is the ability of the criminal justice system to transform the digital data collected in a timely manner into reliable and verifiable evidence=
Sources used:
1. Regulation ( EU ) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences resulting from criminal proceedings
2. Directive ( EU ) 2023/1544 of the European Parliament and of the Council of 12 July 2023 establishing harmonised rules on the determination of certain forms of establishment and the designation of representatives for the purposes of collecting electronic evidence in criminal proceedings
3. EUR-Lex website – section “Electronic evidence in criminal proceedings” https://eur-lex.europa.eu/BG/legal-content/summary/electronic-evidence-in-criminal-proceedings.html
4. The Council of the EU website, section "Better access to electronic evidence in the fight against crime" - https://www.consilium.europa.eu/bg/policies/e-evidence/#e-evidence
5. Draft Law on Amendments and Supplements to the Criminal Procedure Code and the Motives thereto, published on 03.09.2026 on the Public Consultations Portal of the Council of Ministers
6. The E-evidence Package, The Happy Ending of the Long Negotiation Saga, Gianluca Forlani , eucrim , Issue 2/2023 , pp 174-181
7. The Use of Electronic Evidence in European Area of Freedom, Security and Justice /An Introduction to the New EU Package of E-evidence/, Adam Juszczak and Elisa Sason , eucrim , Vol.18/2/ , pp 182-200
8. European Preservation and Production orders A Non-Exclusive approach to E-Evidence within the EU, Jorge A. Espina Ramos, eucrim , Issue 3/2025, pp 216-220
9. European Judicial Network website, E-Evidence section https://www.ejn-crimjust.europa.eu/ejn2021/ContentDetail/BG/6/88
10. Eurojust website , E-Evidence section https://www.eurojust.europa.eu/judicial-cooperation/instruments/electronic-evidence
11. Guidelines for completing the form for issuing a European Production Order, prepared under the Sirius project https://www.ejn-crimjust.europa.eu/ejnupload/CMT/TopicsInFocus/SIRIUS-Guidelines-for-Completing-the-European-Production-Order-Certificate-EPOC-en.pdf
12. Guidelines for completing the form for issuing a European Preservation Order, prepared under the Sirius project https://www.ejn-crimjust.europa.eu/ejnupload/CMT/TopicsInFocus/SIRIUS-Guidelines-for-Completing-the-European-preservation-Order-certificate-EPOC-PR-en.pdf