New EU Toy: Your Emails, Messages and IPs Now Travel Faster Than Your Rights

As of 18 August 2026 the EU’s e-Evidence package is live. Two new instruments - the European Production Order and the European Preservation Order - let a judicial authority in one Member State reach straight into a service provider in another and demand data. No more waiting months for mutual legal assistance. No more polite requests that can be ignored.

The numbers are concrete:

• Production of data: 10 days normal, 8 hours in “emergency”.
• Preservation (freeze the data so it can’t be deleted): 60 days.

What can they demand?

Subscriber data, IP addresses and timestamps used to identify a user, traffic data, and content data - the actual emails, chat messages, and app content.

How it used to work vs how it works now

Previously, cross-border requests usually went through the European Investigation Order or classic mutual legal assistance. Both required authorities in the receiving country to examine the request. That dual look was slow and occasionally annoying for investigators. It has been largely replaced by a system designed for speed.

Now the order goes directly to the provider (or its mandatory EU legal representative). For traffic and content data the authorities of the provider’s Member State are notified and can raise limited grounds for refusal. They have a short window. If they stay silent, the data flows. Automatic execution is the default.

Service providers face penalties of up to 2 % of worldwide annual turnover for non-compliance. That concentrates the mind. Most will hand the data over first and argue later - if they argue at all.

The part about “your rights”

The Regulation contains the usual Brussels poetry about fundamental rights, necessity, proportionality, and effective remedies. Let’s look at the actual machinery:

• You are supposed to be informed “without undue delay” that your data has been produced. Except the issuing authority can delay, restrict, or completely omit that notification if it might endanger the investigation. A short justification is enough. In practice this means you often find out after the fact — or not at all until it is useful for the prosecution.
• Your main legal remedy is in the issuing Member State. Not necessarily the country you live in. Not the country where the data was held. The place that wanted the data in the first place.
• For the more intrusive categories (traffic and content data) a judge is usually required on the issuing side. The second state’s role is reactive and time-limited. The old dual judicial control has been thinned out in the name of efficiency.

This is not a minor procedural tweak. It is a structural change: private digital communications stored by companies in one EU country can be compelled by authorities in another with far less intermediate friction than before.

The practical result for the citizen

Your email provider, messaging service, or cloud host can now be ordered — under threat of massive fines — to hand over your correspondence and connection data to foreign investigators on short notice. The system is built so that the default path is production, not protection.

Brussels will say this is necessary to fight crime in a digital age. That is not false. Digital evidence is everywhere. The question is whether the new architecture treats the citizen’s private data as something to be carefully protected or as something to be efficiently extracted.

The deadlines are hard. The notification can be soft. The remedies are geographically inconvenient. The pressure on providers is financial and severe.

Welcome to the new normal. Your data just became more portable than your ability to stop it.