The U.K.'s recently approved Crime (Overseas Production Orders) Act 2019 will give U.K. investigators the power to compel foreign companies outside the jurisdiction to disclose electronic data, in a marked departure from longstanding mutual legal assistance (MLA) arrangements.
The act is a significant new enforcement tool. Currently, U.K. authorities can secure data held overseas in various ways, but these generally require the material to be accessible from the U.K. or to be held by a company served with an order in the U.K.
Investigators must otherwise make use of MLA processes—making a formal request to the target jurisdiction, which must be approved by that country’s judicial authorities. Outside the EU (where the introduction of European Investigation Orders has streamlined the process), these requests can take months—sometimes even years—to be executed.
Speeding Up the Process
The new powers are part of a recent trend towards dispensing with traditional and clunky MLA processes. In a controversial ruling in September last year, the High Court affirmed the extra-territorial reach of the compulsory document production powers available to the Serious Fraud Office (SFO).
However, despite the significance of that ruling, the SFO’s exercise of its so-called “section 2 powers” across borders remains restricted in two important respects: the recipient company must have a “sufficient connection” to the U.K., and it must be physically present in the U.K. (e.g. through one of its officers) to be served with the relevant notice.
Overseas Production Orders (OPOs) remove these obstacles. Once the act comes into force, investigating authorities including the police, the SFO, the National Crime Agency, and the Financial Conduct Authority, will be able to apply to the U.K. court for an order requiring overseas companies to produce specified electronic data. OPOs will be capable of compelling companies directly, without involving the judicial (or indeed the executive) authorities in the target jurisdiction.
The U.K. judge must be satisfied that there are reasonable grounds for believing all or part of the data is likely to be both of substantial value to the proceedings or investigation and relevant evidence in respect of an indictable offense. There must also be reasonable grounds for believing it is in the public interest for the data sought to be produced to or accessed by the investigators.
The court’s power to make an OPO will only be exercisable where a relevant international co-operation arrangement exists between the U.K. and the target jurisdiction. Significantly, however, any scrutiny by the judicial authorities in the target jurisdiction will be absent from the process, as will any requirement for the order physically to be served in the U.K.
The company will ordinarily have seven days to comply, though the judge will have a discretion to specify an alternative time frame. Any company that receives an OPO, or any person affected by it, will have the right to apply to the U.K. court to have it varied or revoked. There are no restrictions on the admissibility in criminal proceedings of any evidence gathered via an OPO.
The Role of International Cooperation
Although the act is approved by the U.K. Parliament, the U.K. government has yet to announce when it will come into force. Attention is now on the negotiation of the international co-operation treaties required before OPOs can be granted. The U.K. government has indicated that the first treaty will be with the U.S. and that negotiations are ongoing.
It is unsurprising that the U.S. will be the first counterparty. This was envisaged by the CLOUD Act, enacted by U.S. Congress in March 2018, which authorizes the U.S. government to form bilateral agreements with other governments to facilitate cross-border electronic data access and exchange.
It is expected that the U.K./U.S. treaty will be reciprocal so that U.S. law enforcement will be able to make the equivalent of an OPO against a U.K. company. Similar treaties with other jurisdictions will follow, particularly if the U.K. loses access to the European Investigation Order regime post-Brexit.
The Consequences of Noncompliance
Failure to comply with an OPO will be treated as a contempt of court. Penalties for contempt can include a fine, the sequestration of property and/or the imprisonment of relevant company officers.
While it is unclear how such penalties will be enforced where the company concerned has no presence in the U.K., in practice this may not dilute the effectiveness of OPOs because few companies will run the reputational risk of failing to comply with a court order.
The parliamentary debate has focused on communications service providers, such as Twitter and Google, as the primary intended recipient of the new orders, largely in the context of criminal investigations into terrorism and sex offenses. However, the applicability of OPOs is not restricted to such companies or investigations—it is potentially far broader and we may eventually see them featuring significantly in business crime enforcement.
That said, there are important safeguards within the act that make it possible to challenge the scope or even the legality of an OPO via the U.K. courts. Any company subject to one should seek advice without delay.
This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.
Elly Proudlock is a counsel at Linklaters with a focus on business crime. She acts in criminal investigations involving the SFO and other authorities.