Transposes Directive (EU) 2023/1544 and establishes the sanctions regime applicable to infringements of the rules laid down in that Directive and Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings.
Introduction
On 25 August 2023, we had the opportunity to publish the Legal Alert on the “E-evidence Package” – concerning European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings –, highlighting the main changes introduced by Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 (Regulation (EU) 2023/1543), and by Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 (Directive (EU) 2023/1544).
It is worth recalling that Regulation (EU) 2023/1543 established the rules under which an authority of a Member State may, in criminal proceedings, issue a European Production Order or a European Preservation Order and thereby order a service provider offering services in the Union and established in another Member State or, if the provider is not established in the Union, represented by a legal representative in another Member State, to produce or preserve electronic evidence, regardless of the location of the data.
Directive (EU) 2023/154, on the other hand, established harmonised rules applicable to the designation of designated establishments and the appointment of legal representatives of certain service providers offering services in the European Union, to receive, comply with and enforce decisions and orders issued by the central authorities of the Member States, for the purposes of gathering electronic evidence in criminal proceedings.
Three years later, Law No. 55/2026, of 20 August (Law No. 55/2026) now transposes Directive (EU) 2023/1544 and establishes the sanctions regime applicable to infringements of the rules laid down in that Directive and in Regulation (EU) 2023/1543.
I. Scope of application of Law No. 55/2026
Under Law No. 55/2026, and in line with European legislation, the concept of “electronic evidence” covers subscriber data, traffic data or content data stored in electronic form by or on behalf of a service provider at the time of receipt of a European Production Order Certificate (EPOC) or a European Preservation Order Certificate (EPOC-PR).
For its part, “service provider” means any natural or legal person, with the exception of financial services, that provides electronic communications services, Internet domain name and IP numbering services and other information society services that enable their users to communicate with one another or that enable the storage or other processing of data on behalf of the users to whom the service is provided, where data storage is a defining component of the service provided to the user.
Pursuant to Article 2, Law No. 55/2026 applies to decisions and European Production Orders and European Preservation Orders for electronic evidence based on (i) Regulation (EU) 2023/1543; (ii) Directive 2014/41/EU, transposed into domestic law by Law No. 88/2017, of 21 August; and (iii) the Convention on Mutual Assistance in Criminal Matters between Member States of the European Union. By adopting this approach, it clarifies that, regardless of the legal instrument serving as the basis for issuing the decision or order, the response procedures laid down in the Law, read in combination with Regulation (EU) 2023/1543, always apply, thereby ensuring standardised procedures and shorter response times for obtaining and preserving electronic evidence, and enhancing the speed and effectiveness of judicial cooperation in criminal matters.
In addition, Law No. 55/2026 applies (i) to decisions and European Production Orders and European Preservation Orders for electronic evidence addressed by the judicial authority to a natural or legal person acting as a designated establishment or legal representative of a service provider in Portugal; and (ii) to direct communications between judicial authorities and service providers established in Portugal, for the purposes of preserving and producing electronic evidence in criminal proceedings.
Law No. 55/2026 does not, however, apply to service providers established only in Portugal and that offer services exclusively within the national territory.
II. Obligation to designate designated establishments and appoint legal representatives
Under Article 6(1) of Law No. 55/2026, service providers with legal personality established in Portugal or offering services in Portugal are subject to specific obligations to designate recipients for decisions and European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings:
- Service providers established in Portugal and offering services in the European Union: must designate, in writing, at least one designated establishment in Portugal as the recipient for receiving, complying with and enforcing decisions and European Production Orders and European Preservation Orders for electronic evidence issued by central authorities of other Member States (cf.Article 6(1) of Law No. 55/2026).
- Service providers offering services in Portugal but not established in the European Union: must appoint, in writing, at least one legal representative, with identical functions of receiving, complying with and enforcing those decisions and European Production Orders and European Preservation Orders (cf.Article 6(2) of Law No. 55/2026).
- Service providers offering services in Portugal but established in Member States that do not participate in the legislative instruments of the e-evidence package: must likewise appoint, in writing, at least one legal representative to receive, comply with and enforce decisions and European Production Orders and European Preservation Orders for electronic evidence issued under Regulation (EU) 2023/1543, Directive 2014/41/EU and the Convention on Mutual Assistance in Criminal Matters between Member States of the European Union (cf. Article 6(3) of Law No. 55/2026).
Article 6(4) clarifies that only natural or legal persons who are resident or established in a Member State in which the service provider offers services and who may be subject to enforcement proceedings may be designated establishments or appointed as legal representatives.
Under paragraph 5 of the same Article, the designation or appointment of an entity as a designated establishment or of a natural or legal person as a legal representative entails that the service provider must confer on them the powers and resources necessary to comply with European Production Orders or European Preservation Orders for electronic evidence received from other Member States.
Article 10 also provides for reporting obligations to the central national authority, which, in Portugal, is the National Communications Authority (ANACOM). Accordingly, service providers established in Portugal or offering services in the national territory must notify, in writing, the designation and contact details of the designated establishment or legal representative:
- To the national authority responsible in Portugal, where the designated establishment is established or the legal representative resides in the national territory.
Or - To the national authority responsible in the Member State in which the designated establishment is established or where the legal representative resides.
Any change to the contact details must be notified immediately, and in no event later than 48 hours, and the notifications must identify the official language(s) of the European Union to be used in interactions with the designated establishment or legal representative, including at least one official language of the Member State in which they are established or reside (cf. Article 10(2) and (3)).
Where the service provider designates several establishments or appoints several legal representatives, it must specify in each notification the precise territorial scope of each designation or appointment and the official language(s) of the European Union or of the Member State to be used to communicate with each recipient (cf. Article 10(4)).
III. Time limits applicable to compliance with the obligation
Under Article 25 of Law No. 55/2026, service providers must indicate designated establishments or appoint legal representatives and make the corresponding notification to the competent central authority: (i) within six months of the entry into force of that Law, if they were already offering services in the European Union on 18 February 2026; (ii) within six months of the date on which they begin offering services in the European Union, if they began offering services after 18 February 2026.
IV. Responsibility for executing decisions and European Production Orders or European Preservation Orders for electronic evidence
Article 8 establishes a duty to cooperate, requiring designated establishments and legal representatives to cooperate with the central authorities in the enforcement of Law No. 55/2026.
Under Article 9, service providers and their respective designated establishments or legal representatives are jointly and severally liable for compliance with the obligations associated with the execution of decisions and European Production Orders or European Preservation Orders for electronic evidence in criminal proceedings, with the exception of criminal offences. The Law clarifies that the absence of adequate internal procedures between the service provider and the designated establishment or legal representative may not be invoked as justification for non-compliance with those obligations.
V. Sanctions regime
Article 11 of Law No. 55/2026 classifies various instances of non-compliance with the obligations imposed on service providers and addressees of European Production Order Certificates (EPOCs) and European Preservation Order Certificates (EPOC-PR’s) for electronic evidence as very serious administrative offences. Specifically, each of the following constitutes a very serious administrative offence:
(i) Failure to designate an establishment or appoint a legal representative within the legally prescribed time limit, as well as failure to notify ANACOM of that designation or appointment, or of any subsequent change to the relevant contact details.
(ii) Failure to confer the necessary powers and resources on the designated establishments or legal representatives.
(iii) Failure by the addressee of an EPOC to preserve the requested data, in breach of the obligation to preserve the data expeditiously following receipt of the certificate (cf. Article 10(1) of Regulation (EU) 2023/1543).
(iv) Failure by the addressee of an EPOC to transmit the requested data to the issuing authority or, where applicable, the enforcing authority within the 10-day period (cf. Article 10(2) and (3) of Regulation (EU) 2023/1543).
(v) Failure, in emergency situations, to transmit the requested data without undue delay and, in any event, no later than eight hours after receipt of the EPOC (cf. Article 10(4) of Regulation (EU) 2023/1543).
(vi) Failure to provide, within the legally prescribed time limits (10 days or eight hours, as applicable), reasons why the data were not provided, were provided incompletely or were provided late, where the addressee fails to inform the issuing authority and, where applicable, the enforcing authority of those reasons (cf. Article 10(8) of Regulation (EU) 2023/1543).
(vii) Failure, after receipt of an EPOC-PR, to preserve the requested data during the initial period of 60 days, or during the additional period of 30 days where that period is extended to allow a subsequent request for production to be issued (cf. Article 11(1) of Regulation (EU) 2023/1543).
(viii) Failure, where the issuing authority confirms that a subsequent request for production has been issued, to preserve the data for the entire period necessary to enable those data to be produced following that request (cf. Article 11(2) of Regulation (EU) 2023/1543).
The administrative offences arising from failure to designate an establishment or appoint a legal representative, as well as from failure to grant them the necessary powers and resources are sanctioned by a fine of between EUR 250.00 and EUR 20,000.00 in the case of a natural person, between EUR 500.00 and EUR 50,000.00 in the case of a micro-enterprise, between EUR 1,250.00 and EUR 150,000.00 in the case of a small enterprise, between €2,500.00 and €450,000.00 in the case of a medium-sized enterprise, and between EUR 5,000.00 and EUR 5,000,000.00 in the case of a large enterprise.
The administrative offences arising from failure to preserve and transmit the requested data (points (c) to (i) of Article 11(1) of Law No. 55/2026) are santioned by a minimum fine of EUR 250.00 and a maximum fine of EUR 20,000.00 in the case of a natural person and, in the case of a legal person, by a fine of up to 2% of the total worldwide turnover generated in the financial year immediately preceding the year in which the offence was committed. Where it is not possible to determine the turnover, the fine ranges from EUR 500,000.00 to EUR 1,000,000.00.
In addition, failure by addressees of an EPOC or an EPOC-PR, and by service providers referred to in Article 3(3) of Regulation (EU) 2023/1543, to adopt technical and operational security measures to ensure the confidentiality, secrecy and integrity of the EPOC or EPOC-PR and of the data produced or preserved constitutes a serious administrative offence. This offence is sanctioned by a minimum fine of EUR 100.00 and a maximum fine of EUR 7,500.00 where committed by a natural person and, in the case of a legal person, by a fine of up to 1% of the total worldwide turnover generated in the financial year immediately preceding the year in which the offence was committed. Where it is not possible to determine the turnover, the fine ranges from EUR 1,000,000.00 to EUR 5,000,000.00.
In the case of very serious administrative offences, provision is also made for the possibility of imposing an ancillary sanction consisting of prohibiting the exercise of the activity of a service provider in the national territory, for a maximum period of two years.
Article 14 of Law No. 55/2026 provides for negligence to be sanctioned, with the minimum and maximum limits of the relevant fine being reduced by half.
Under Article 15, and irrespective of whether an administrative offence has been committed, it is also possible to issue an injunction requiring compliance with the duty that has not been performed, subject to the imposition of a coercive fine, for which the service providers and the designated and responsible entities are jointly and severally liable.
The daily amount of the coercive fine may range from EUR 100.00 to EUR 500.00 in the case of a natural person and from EUR 2,000.00 to EUR 100,000.00 in the case of a legal person; provision may be made for the amount to increase over a period of 30 days, up to a maximum of EUR 150,000.00 in the case of a natural person and EUR 3,000,000.00 in the case of a legal person.
VI. Administrative offence proceedings and supervision
The initiation of administrative offence proceedings and the issuing of administrative decisions fall within the competence of ANACOM, as the regulatory authority responsible for enforcing Law No. 55/2026. ANACOM is likewise responsible for supervising compliance with the legal obligations imposed on service providers and their respective designated establishments or legal representatives. The proceeds of fines are divided between the State and ANACOM, with 60% allocated to the State and 40% to ANACOM.
