Voluntary Disclosure of Data to Law Enforcement: The Curious Case of US Internet Firms, their Irish Subsidiaries and European Legal Standards

Voluntary disclosure of data by online service providers is by some distance the most common form of cross-border access to data for law enforcement purposes. Irish law is particularly important for this issue due to the number of providers headquartered in the state. Despite this, there has been almost no assessment of the Irish practice by which providers can give user data directly to foreign authorities for criminal investigations, without either a Mutual Legal Assistance (MLA) request or other mandatory requirement under Irish law. This chapter provides the first detailed scrutiny of this system. It outlines the legal environment which encouraged its use, including the state’s failure to legislate for cross-border data access, and describe how it transplanted standards from the US Electronic Communications Privacy Act into an Irish setting. It assesses the requirements of the General Data Protection Regulation (GDPR) in relation to voluntary disclosure and argues that the stated policies of several large providers fail to meet those requirements. It develops the case that the permissive Irish approach to voluntary disclosure violates the European Convention on Human Rights (ECHR) on legality grounds given its lack of safeguards against arbitrary interference with individual rights. It concludes by assessing the future of voluntary disclosure in light of wider developments including the European Electronic Communications Code (EECC) and the proposed E-Evidence Package.