Lawful access to data

As announced in the ProtectEU internal security strategy, on 24 June 2025, the European Commission presented a Roadmap for lawful and effective access to data for law enforcement. 

In fact, terrorism, organised crime, online fraud, drug trafficking, child sexual abuse, online sexual extortion, ransomware and many other crimes have something in common: they can leave digital traces. As Europol observes in its Serious and Organised Crime Threat Assessment (SOCTA) for 2025, nearly all forms of serious and organised crime have a digital footprint. Around 85% of criminal investigations rely on electronic evidence. Requests for data addressed to service providers have tripled between 2017 and 2022, and the need for these data is only increasing.

Critical criminal evidence remains inaccessible because it:

• is deleted by service providers within days, in line with their obligations for the protection of personal data and privacy or their business needs;
• cannot be obtained, due to conflicts of laws between jurisdictions, as different countries have varying laws and regulations regarding data access, making it difficult to obtain data stored abroad;
• cannot be retrieved from devices seized in criminal investigations because digital forensics is difficult if not entirely impracticable;
• cannot be read because the data are encrypted;
• cannot be effectively and lawfully analysed because of the lack of suitable technologies or sufficient human resources to effectively filter and analyse large quantities of seized data without impinging on the EU and Member States’ legal frameworks.

To be lawful, access to data needs to be necessary and proportionate and respect fundamental rights, ensuring that privacy and personal data are adequately protected. It must be based on clear, precise and accessible rules set out in law, subject to independent oversight mechanisms, and with effective remedies available to the individuals who may be affected by the access to their data. Ensuring that digital systems remain cybersecure from unauthorised access is equally important to protect against cybersecurity threats.