In a marked departure from longstanding mutual legal assistance arrangements, UK investigators will soon have the power to compel foreign companies based outside the jurisdiction to disclose electronic data. Despite the relative lack of media attention that the Crime (Overseas Production Orders) Act 2019 has received, it represents a significant new enforcement tool.

Existing powers to secure data overseas

Whilst there are currently a number of ways in which the UK authorities can secure data held overseas, these usually require the material to be accessible from the UK or to be held by a company served with a relevant order in the UK. Absent those features, investigators are required to make use of mutual legal assistance (“MLA”) processes. These involve making a formal request to the target jurisdiction which must be approved by that country’s judicial authorities. Outside the European Union (where the introduction of European Investigation Orders has recently streamlined the process), such requests can take many months – or even years - to be executed.

Speeding up the process with Overseas Production Orders

Not so with the Overseas Productions Order (“OPO”). Once the Crime (Overseas Production Orders) Act 2019 (the “Act”) comes into force, the key investigating authorities (including the police, the SFO, the National Crime Agency and the Financial Conduct Authority) will be able to apply to the UK court for an order requiring an overseas company to produce specified electronic data. OPOs will be capable of service on the recipient company direct, without the need to involve the authorities in the target jurisdiction.

To make an OPO, the UK judge must be satisfied that there are reasonable grounds for believing that all or part of the data is likely to be of substantial value to the proceedings or investigation and that it is likely to be relevant evidence in respect of an indictable offence. There must also be reasonable grounds for believing that it is in the public interest for the data sought to be produced to or accessed by the investigators.

The court’s power to make an OPO will only be exercisable where a relevant international co-operation arrangement exists between the UK and the target jurisdiction. Significantly, however, any scrutiny by the judicial authorities in the target jurisdiction will be absent from the process, as will any requirement for the order physically to be served in the UK. Direct service under normal court rules, including via e-mail, is likely to be the norm. Companies can also be served at their principal office, nominated address or place of business.

Once an order is made the recipient company will ordinarily have seven days to comply, although the judge may specify an alternative timeframe. The recipient of an OPO, or any person affected by it, will have the right to apply to the UK court to have it varied or revoked. There are no restrictions on the admissibility in criminal proceedings of any evidence gathered via an OPO.

The consequences of non-compliance

Failure to comply with an OPO will be treated as a contempt of court. The penalties for contempt can include a fine, the sequestration of property and/or the imprisonment of relevant company officers. Whilst it is unclear how such penalties will be enforced where the company concerned has no presence in the UK, in practice we expect that few companies will choose to run the reputational risk of failing to comply with a court order. It is therefore unlikely, in our view, that the apparent lack of enforcement mechanism will materially dilute the effectiveness of OPOs.

The role of international co-operation

Although the Act has been approved by the UK Parliament, the UK Government has yet to announce when it will come into force. The international co-operation treaties required before OPOs can be granted are still to be finalised The UK Government has indicated that the first such treaty will be with the U.S. and that negotiations are ongoing. Once concluded, that treaty will be subject to Parliamentary scrutiny.

That the U.S. will be the first counterparty to such a treaty is unsurprising, and indeed was envisaged by the “CLOUD” Act enacted by the U.S. Congress in March 2018. In addition to expanding the obligations of U.S. electronic service providers to preserve and disclose customer data (even if stored abroad) pursuant to a warrant or subpoena, the CLOUD Act authorises the U.S. government to form bilateral agreements with other governments to facilitate cross-border electronic data access and exchange. It is expected that the UK/U.S. treaty will be reciprocal, meaning that U.S. law enforcement will be able to make the equivalent of an OPO against a UK company. Similar treaties with other jurisdictions will no doubt follow, particularly if the UK loses access to the European Investigation Order regime post-Brexit.

Comment

The Parliamentary debate around the Act has focused on communications service providers (such as Facebook, Twitter and Google) as the primary intended recipient of the new orders, largely in the context of criminal investigations into terrorism and sex offences. However, the applicability of OPOs is not restricted to such companies or investigations and we may eventually see them featuring significantly in business crime enforcement.

That said, there are important safeguards within the Act that make it possible to challenge the scope or even the legality of an OPO via the UK courts. Any company that finds itself subject to one should seek therefore seek advice without delay.