Editor’s Note: Estonia’s justice ministry wants to end what its own minister calls a “completely abnormal” practice: police demanding years of email correspondence from service providers with no scope limits. The timing gives the story weight well beyond the Baltics. Estonia’s Supreme Court ruled June 8 that provider-held email content requires a court warrant, echoing the Court of Justice of the European Union’s 2024 Landeck judgment, just as Regulation (EU) 2023/1543 prepares to route cross-border production orders directly to service providers beginning Aug. 18.

For cybersecurity teams, the framework introduces authenticated inbound order channels that must be secured. For information governance professionals, it creates a new category of compelled disclosure to map into retention and hold procedures. For eDiscovery providers, judicial insistence on proportionate, targeted collection rewards defensible methodology.

Watch the Estonian consultation closing in mid-June and the fall bill in the Riigikogu; the definitional choices made in Tallinn may preview how other member states reconcile court-imposed scope discipline with regulation-imposed speed.


Content Assessment: Estonia rewrites its digital evidence rules as the EU E-Evidence deadline nears

Information - 93%
Insight - 93%
Relevance - 91%
Objectivity - 91%
Authority - 90%

92%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Estonia tightens digital evidence rules just as the EU speeds them up."


Industry News – eDiscovery Beat

Estonia tightens digital evidence rules just as the EU speeds them up

ComplexDiscovery Staff

Estonia’s justice minister has a blunt assessment of how police in her country collect email evidence: the practice has no limits, and the situation is “completely abnormal.” Her ministry now wants to rewrite the rules just 10 weeks before the European Union gives competent judicial authorities across participating member states a faster route to electronic evidence held by service providers.

The collision of those two timelines, a national reform prompted by concerns over overbroad collection and a continental framework built for speed, frames the summer for many cybersecurity, information governance, and eDiscovery providers serving clients in Europe.

A practice with no limits

The Estonian Ministry of Justice and Digital Affairs published a draft legislative proposal in early June that would clarify when investigators may pull data from smart devices and email accounts in criminal proceedings. The trigger, the ministry said in the proposal, is a pattern of investigators going to email providers for years of a person’s correspondence at a time, pulling in material that has nothing to do with the case at hand.

“Unfortunately, we know of cases where police have asked for all email accounts belonging to all employees of a company, covering, for example, the previous three years. There are currently no limits. The situation is completely abnormal,” Liisa-Ly Pakosta, Estonia’s minister of justice and digital affairs, told Estonian public broadcaster ERR on June 2.

The scale of the practice is documented. Estonia’s Central Criminal Police digital forensics unit copied data from 1,591 smartphones, 353 laptops, 120 tablets, and 118 desktop computers in 2025, according to Ministry of the Interior figures reported by ERR. The statistics do not distinguish between consensual extractions and devices seized under warrant.

The discretion has produced results, and investigators have defended it. Broad authority to collect digital evidence has aided investigations of child sexual abuse and drug trafficking, ERR reported, citing investigative coverage by the newspaper Eesti Ekspress, and Estonian police continued gathering digital evidence under existing practice even after the 2024 ruling from the EU’s top court raised questions about its legal footing.

The ministry’s proposal sketches two paths. One option would expand what counts as a search under the criminal procedure code, expressly bringing phones, computers, and other data storage devices within its reach. The other would stand up a dedicated legal regime for device evidence and server data, an approach the ministry said would better fit how electronic evidence actually behaves. Stakeholder feedback closes in mid-June, with a bill expected to reach the Riigikogu, Estonia’s parliament, in the fall.

Courts forced the issue

The reform did not arrive in a vacuum. On June 8, Estonia’s Supreme Court ruled that investigators need a court warrant before they can compel a service provider to hand over what sits in a suspect’s email account. In the underlying fraud case, the Internal Security Service had obtained nearly four years of a defendant’s correspondence, from 2015 through 2018, directly from telecommunications provider Telia. The court held the evidence inadmissible in case 1-22-7314/268, criticizing investigators for taking everything in the account when the suspicion justified only a slice of it. The prosecution, the court said in its announcement of the decision, could not logically justify the need for almost four years of correspondence.

The Court of Justice of the European Union set the broader standard in October 2024. In Bezirkshauptmannschaft Landeck, Case C-548/21, the court held that police access to data stored on a mobile phone can constitute a serious, or even particularly serious, interference with fundamental rights and requires prior authorization by a court or an independent authority, except in duly substantiated cases of urgency. Estonian law, the ministry’s draft proposal acknowledges, still gives investigators no procedural route for asking a court to authorize unlocking a device.

August deadline meets unfinished homework

The Estonian debate is unfolding inside a much larger one. Regulation (EU) 2023/1543, the centerpiece of the EU’s E-Evidence package, applies from Aug. 18, 2026, in every member state except Denmark, which sits outside the package under its EU justice opt-out. It allows a judicial authority in one member state to serve European Production Orders and European Preservation Orders directly on service providers in another, compressing response times to 10 days for standard orders and eight hours for orders that qualify as emergencies under the regulation’s criteria.

Member state preparation has lagged badly. The companion Directive (EU) 2023/1544 required national transposition by Feb. 18, 2026, yet as of February 2026 only four bound member states had adopted implementing legislation, according to a Bird & Bird analysis tracking the rollout. On March 27, the European Commission sent letters of formal notice to 22 member states, Estonia among them, for failing to communicate complete transposition.

That dual posture defines Estonia’s moment: a member state tightening domestic safeguards on digital evidence while simultaneously late on the EU framework that will route foreign production orders into its service providers. The same tension surfaced in Pakosta’s own framing. Other member states updated their legislation some time ago, she told ERR, while Estonian police may retrieve email only from servers physically inside the country. Pakosta said that gap has pushed businesses toward foreign hosting services and placed Estonian hosting providers at a competitive disadvantage.

Where providers feel the squeeze

For service providers, the challenges stack up quickly. Covered service providers offering services in the EU, a scope that reaches electronic communications services, domain name and IP numbering services, and information society services that store or process user data, must designate an establishment or appoint a legal representative in a member state by Aug. 18 to receive and execute orders. Under the directive, providers and their designated representatives bear joint and several liability for noncompliance, with penalties reaching up to 2 percent of annual global turnover. Providers must also prepare secure procedures and technical interfaces for receiving legally binding orders through the EU’s decentralized IT system, an inbound channel that carries its own authentication and spoofing risks for security teams to manage. Global providers face an added wrinkle: absent a current EU-U.S. cross-border data access agreement, many transatlantic evidence requests continue to depend on mutual legal assistance channels, leaving some providers to manage the same dataset under overlapping legal regimes.

The opportunities are just as concrete. Forensic and eDiscovery providers that can execute narrowly scoped, court-authorized collections will be positioned for a market in which proportionality is the operative word. Estonia’s Supreme Court did not bar collection of provider-held email; it barred unscoped collection without judicial oversight. That distinction rewards providers with defensible targeting, documented methodology, and audit-ready chains of custody. Consultancies and law firms face a season of demand for legal representative services, data mapping, retention policy revisions, and response playbooks tuned to 10-day and eight-hour clocks. And if Estonia’s amendment lets investigators reach servers under clear judicial rules, the competitive penalty on hosting data in Estonia could ease, a point with direct revenue consequences for Baltic infrastructure providers.

Oversight pressure will not relent. Ülle Madise, Estonia’s chancellor of justice, said in a May interview with ERR that society must resist mass surveillance. “The coercive power of the state must not be used to collect too much data; it must not be aggregated,” she said.

Considerations before the bill arrives

Providers serving European clients should treat the next 90 days as a planning window. Map where client data sits relative to the four E-Evidence data categories, from subscriber data to content. Confirm who will serve as the designated establishment or legal representative, and verify that the entity has real authority and staffing, not just a mailing address. Build validation procedures for inbound orders before the emergency timeline forces improvisation. Track Estonia’s stakeholder consultation, because the definitional choice between treating devices as search objects and creating a standalone electronic evidence framework will shape collection practice, admissibility challenges, and vendor selection criteria in one of Europe’s most digitized jurisdictions.

The deeper signal runs past Estonia. Courts in Luxembourg and Tartu have now pointed in the same direction within 20 months: digital evidence collection requires judicial authorization and proportionate scope. Legislators are racing to catch up, and providers sit in the middle, holding the data both sides want handled correctly.

When production orders start arriving in August under one legal regime while national courts keep tightening another, which standard will providers build their compliance programs around: the speed the regulation demands, or the scope discipline the courts now require?

News sources



Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.