Editor’s Note: Estonia’s justice ministry wants to end what its own minister calls a “completely abnormal” practice: police demanding years of email correspondence from service providers with no scope limits. The timing gives the story weight well beyond the Baltics. Estonia’s Supreme Court ruled June 8 that provider-held email content requires a court warrant, echoing the Court of Justice of the European Union’s 2024 Landeck judgment, just as Regulation (EU) 2023/1543 prepares to route cross-border production orders directly to service providers beginning Aug. 18.
For cybersecurity teams, the framework introduces authenticated inbound order channels that must be secured. For information governance professionals, it creates a new category of compelled disclosure to map into retention and hold procedures. For eDiscovery providers, judicial insistence on proportionate, targeted collection rewards defensible methodology.
Watch the Estonian consultation closing in mid-June and the fall bill in the Riigikogu; the definitional choices made in Tallinn may preview how other member states reconcile court-imposed scope discipline with regulation-imposed speed.
Content Assessment: Estonia rewrites its digital evidence rules as the EU E-Evidence deadline nears
Information - 93%
Insight - 93%
Relevance - 91%
Objectivity - 91%
Authority - 90%
92%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Estonia tightens digital evidence rules just as the EU speeds them up."
Industry News – eDiscovery Beat
Estonia tightens digital evidence rules just as the EU speeds them up
ComplexDiscovery Staff
Estonia’s justice minister has a blunt assessment of how police in her country collect email evidence: the practice has no limits, and the situation is “completely abnormal.” Her ministry now wants to rewrite the rules just 10 weeks before the European Union gives competent judicial authorities across participating member states a faster route to electronic evidence held by service providers.
The collision of those two timelines, a national reform prompted by concerns over overbroad collection and a continental framework built for speed, frames the summer for many cybersecurity, information governance, and eDiscovery providers serving clients in Europe.
A practice with no limits
The Estonian Ministry of Justice and Digital Affairs published a draft legislative proposal in early June that would clarify when investigators may pull data from smart devices and email accounts in criminal proceedings. The trigger, the ministry said in the proposal, is a pattern of investigators going to email providers for years of a person’s correspondence at a time, pulling in material that has nothing to do with the case at hand.
“Unfortunately, we know of cases where police have asked for all email accounts belonging to all employees of a company, covering, for example, the previous three years. There are currently no limits. The situation is completely abnormal,” Liisa-Ly Pakosta, Estonia’s minister of justice and digital affairs, told Estonian public broadcaster ERR on June 2.
The scale of the practice is documented. Estonia’s Central Criminal Police digital forensics unit copied data from 1,591 smartphones, 353 laptops, 120 tablets, and 118 desktop computers in 2025, according to Ministry of the Interior figures reported by ERR. The statistics do not distinguish between consensual extractions and devices seized under warrant.
The discretion has produced results, and investigators have defended it. Broad authority to collect digital evidence has aided investigations of child sexual abuse and drug trafficking, ERR reported, citing investigative coverage by the newspaper Eesti Ekspress, and Estonian police continued gathering digital evidence under existing practice even after the 2024 ruling from the EU’s top court raised questions about its legal footing.
The ministry’s proposal sketches two paths. One option would expand what counts as a search under the criminal procedure code, expressly bringing phones, computers, and other data storage devices within its reach. The other would stand up a dedicated legal regime for device evidence and server data, an approach the ministry said would better fit how electronic evidence actually behaves. Stakeholder feedback closes in mid-June, with a bill expected to reach the Riigikogu, Estonia’s parliament, in the fall.
Courts forced the issue
The reform did not arrive in a vacuum. On June 8, Estonia’s Supreme Court ruled that investigators need a court warrant before they can compel a service provider to hand over what sits in a suspect’s email account. In the underlying fraud case, the Internal Security Service had obtained nearly four years of a defendant’s correspondence, from 2015 through 2018, directly from telecommunications provider Telia. The court held the evidence inadmissible in case 1-22-7314/268, criticizing investigators for taking everything in the account when the suspicion justified only a slice of it. The prosecution, the court said in its announcement of the decision, could not logically justify the need for almost four years of correspondence.
The Court of Justice of the European Union set the broader standard in October 2024. In Bezirkshauptmannschaft Landeck, Case C-548/21, the court held that police access to data stored on a mobile phone can constitute a serious, or even particularly serious, interference with fundamental rights and requires prior authorization by a court or an independent authority, except in duly substantiated cases of urgency. Estonian law, the ministry’s draft proposal acknowledges, still gives investigators no procedural route for asking a court to authorize unlocking a device.
August deadline meets unfinished homework
The Estonian debate is unfolding inside a much larger one. Regulation (EU) 2023/1543, the centerpiece of the EU’s E-Evidence package, applies from Aug. 18, 2026, in every member state except Denmark, which sits outside the package under its EU justice opt-out. It allows a judicial authority in one member state to serve European Production Orders and European Preservation Orders directly on service providers in another, compressing response times to 10 days for standard orders and eight hours for orders that qualify as emergencies under the regulation’s criteria.
Member state preparation has lagged badly. The companion Directive (EU) 2023/1544 required national transposition by Feb. 18, 2026, yet as of February 2026 only four bound member states had adopted implementing legislation, according to a Bird & Bird analysis tracking the rollout. On March 27, the European Commission sent letters of formal notice to 22 member states, Estonia among them, for failing to communicate complete transposition.
That dual posture defines Estonia’s moment: a member state tightening domestic safeguards on digital evidence while simultaneously late on the EU framework that will route foreign production orders into its service providers. The same tension surfaced in Pakosta’s own framing. Other member states updated their legislation some time ago, she told ERR, while Estonian police may retrieve email only from servers physically inside the country. Pakosta said that gap has pushed businesses toward foreign hosting services and placed Estonian hosting providers at a competitive disadvantage.
Where providers feel the squeeze
For service providers, the challenges stack up quickly. Covered service providers offering services in the EU, a scope that reaches electronic communications services, domain name and IP numbering services, and information society services that store or process user data, must designate an establishment or appoint a legal representative in a member state by Aug. 18 to receive and execute orders. Under the directive, providers and their designated representatives bear joint and several liability for noncompliance, with penalties reaching up to 2 percent of annual global turnover. Providers must also prepare secure procedures and technical interfaces for receiving legally binding orders through the EU’s decentralized IT system, an inbound channel that carries its own authentication and spoofing risks for security teams to manage. Global providers face an added wrinkle: absent a current EU-U.S. cross-border data access agreement, many transatlantic evidence requests continue to depend on mutual legal assistance channels, leaving some providers to manage the same dataset under overlapping legal regimes.
The opportunities are just as concrete. Forensic and eDiscovery providers that can execute narrowly scoped, court-authorized collections will be positioned for a market in which proportionality is the operative word. Estonia’s Supreme Court did not bar collection of provider-held email; it barred unscoped collection without judicial oversight. That distinction rewards providers with defensible targeting, documented methodology, and audit-ready chains of custody. Consultancies and law firms face a season of demand for legal representative services, data mapping, retention policy revisions, and response playbooks tuned to 10-day and eight-hour clocks. And if Estonia’s amendment lets investigators reach servers under clear judicial rules, the competitive penalty on hosting data in Estonia could ease, a point with direct revenue consequences for Baltic infrastructure providers.
Oversight pressure will not relent. Ülle Madise, Estonia’s chancellor of justice, said in a May interview with ERR that society must resist mass surveillance. “The coercive power of the state must not be used to collect too much data; it must not be aggregated,” she said.
Considerations before the bill arrives
Providers serving European clients should treat the next 90 days as a planning window. Map where client data sits relative to the four E-Evidence data categories, from subscriber data to content. Confirm who will serve as the designated establishment or legal representative, and verify that the entity has real authority and staffing, not just a mailing address. Build validation procedures for inbound orders before the emergency timeline forces improvisation. Track Estonia’s stakeholder consultation, because the definitional choice between treating devices as search objects and creating a standalone electronic evidence framework will shape collection practice, admissibility challenges, and vendor selection criteria in one of Europe’s most digitized jurisdictions.
The deeper signal runs past Estonia. Courts in Luxembourg and Tartu have now pointed in the same direction within 20 months: digital evidence collection requires judicial authorization and proportionate scope. Legislators are racing to catch up, and providers sit in the middle, holding the data both sides want handled correctly.
When production orders start arriving in August under one legal regime while national courts keep tightening another, which standard will providers build their compliance programs around: the speed the regulation demands, or the scope discipline the courts now require?
News sources
- Justice minister wants limits to scouring emails for evidence in criminal matters (ERR News)
- Supreme Court: Email content may be requested only with court authorization (ERR News)
- Riigikohus selgitas e-kirjade väljanõudmist kuritegude uurimisel (Supreme Court press release) (Riigikohus)
- Judgment of the Court in Case C-548/21, Press Release No 171/24 (Court of Justice of the European Union)
- The EU’s E-Evidence Framework Goes Live in August and Most of Europe Isn’t Ready (ComplexDiscovery OÜ)
- eEvidence Regulation Key Compliance Takeaways for Service Providers by 2026 (Bird & Bird)
- Chancellor of Justice: The coercive power of the state must not be used to collect too much data (ERR News)
- Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders (EUR-Lex)
Assisted by GAI and LLM Technologies
Additional Reading
- When you can’t trust the evidence: deepfakes force a forensic reckoning in Dublin
- Ireland’s AI regulator role gets a hard look at Dublin Tech Summit
- HaystackID brings AI privacy and discovery stack to Dublin as European compliance pressure mounts
- Latitude59 final day in Tallinn: AI sovereignty, a driverless permit and €450,000 to three startups
- Bold Stage opens Latitude59 2026 with AI, missiles and the New Nordics bet
- Estonia opens Latitude59 with sandbox framework for legal exemptions
- Seven startups from four nations compete for Latitude59’s nearly half-million-euro investment prize
- Big tech, defense and climate to share the main stage at Latitude59 2026
- Latitude59 pitch competition draws 465 startups from 53 countries as prize pool grows to €400,000
- Baltic and Nordic Angel Networks Pool €300,000 for Latitude59 Pitch Competition as Cross-Border Startup Investing Deepens
- Latitude59 Opens Pitch Applications as Investors Raise the Bar on Operational Readiness
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.






























