De impact van eEvidence op digitale soevereiniteit - Webinar Comex BV

Summary

The webinar examines how the EU’s eEvidence regulation may affect digital sovereignty and data-storage decisions. The presenter’s central point is that organizations should consider not only where data is stored, but also who provides the service, who can access the data, and which jurisdiction applies.

eEvidence: Scope and process

• The regulation applies to digital service providers and is described as covering EU member states.
• The presenter says providers must register with the EU by March 2026, and that the regulation takes effect on 18 August 2026.
• Under the process described, an investigative authority obtains a court order and sends it to a service provider. The provider must supply the requested data within 10 days, or 8 hours in emergencies.
• The authority in the country where the provider is established may intervene to stop disclosure, but the presenter says its prior approval is not required.
• The data owner may not be notified before the data is provided. As a result, organizations may not know that data has been requested until afterward.
• The presenter describes eEvidence as a tool to help investigate crime, while advising organizations to understand its implications and decide which data they are comfortable placing with providers.

Implications for storage and sovereignty

The speaker says that storing data in Europe alone does not guarantee control. Organizations should assess three kinds of control:

1. Legal: Which jurisdiction governs the data and provider?
2. Technical: Which hardware, software, and infrastructure are used?
3. Operational: Who can access or handle the data, and what happens during incidents?

The presenter notes that the US Cloud Act and FISA Section 702 remain relevant considerations alongside eEvidence. He also cautions that using external providers can create dependencies beyond primary storage, including managed backups, logging, monitoring, metadata, synchronization, vendor support, and recovery services.

Practical guidance

The webinar recommends that organizations:

• Adopt a hybrid storage approach, rather than assuming everything should be moved on-premises.
• Classify data by sensitivity and assess where each category should be stored.
• Review backups as carefully as primary data, including backups held by managed service providers.
• Check where restores take place and whether recovery depends on an external provider.
• Maintain an on-premises layer where appropriate, allowing local control and recovery without external dependencies.
• Revisit storage and service-provider choices as legal and geopolitical conditions change.

The speaker distinguishes using software from outsourcing data storage and processing, identifying the latter as the area organizations should scrutinize. He says data managed directly by an organization is not covered by eEvidence in the same way as data held by a service provider, though it remains subject to other lawful investigative procedures.

Products and session format

The presenter briefly promotes European storage products, described in the subtitles as systems for archiving, file storage and backup, and a developing locally run AI offering. The AI example is presented as a way to reduce the risk of data being sent to an external chatbot service. Product names are unclear in the auto-generated subtitles, and the webinar does not include a detailed product demonstration.

This is an informational webinar, not a step-by-step technical tutorial or product review. It ends with an invitation to ask questions in chat and follow up with the presenter or colleagues.

Main speaker and sources

• Axel Boltink, identified as CEO of COMEX, delivers the presentation and answers questions.
• The presentation refers to Computable and a Dutch government publication as sources or examples; the subtitles do not provide full citations.