Criminal Justice (International Cooperation on Electronic Evidence and Other Matters) Bill 2026: Committee and Remaining Stages
Dail Éireann — 2026-06-17
============================================================

Matt Carthy (SF), Cavan-Monaghan

I move amendment No. 2:
In page 15, between lines 14 and 15, to insert the following:
“(g) ensure minimal administrative burden is placed on small to medium sized service providers.”.
There is real concern about the administrative burden this legislation could place on small and medium enterprises, SMEs, particularly in the IT sector. The Government conducted an SME test and I will talk more about that later but it found that the legislative impact on the SME sector will be significantly greater than it will be on larger companies and that there will be administrative and compliance costs.
This amendment is simple but it will be incredibly useful. It is to put in a provision on page 15 of the Bill after line 14 to "ensure minimal administrative burden is placed on small to medium sized service providers”.
The amendment is aspirational in many respects but it also sets out a template. It is important to say the vast majority of requests that will come through due to this legislation will come to the largest companies in the world, in effect, which happen to be headquartered here. The SME test carried out by the Department is a very useful document. It estimated that the five largest service providers will receive about 95% of all current cross-border requests in Europe and that even if there are substantial changes, about 90% will go to those companies. I do not think anybody will feel much sympathy if those companies experience an additional administration or cost burden to fulfil their obligations. The irony is companies of that size are probably going to end up making savings as a result of the EU directive. Because they operate on such a global scale, having a unified framework across the EU will be of benefit to them. There are the big five, and you could even say big ten to include the vast majority, but 600 service providers are likely to be impacted as addressees in Ireland. A significant proportion of those are going to be small, Irish-based SMEs. When we are talking about, as I mentioned earlier, 300,000 requests annually, even a small proportion coming to those SMEs could be an important point.
The potential effect on SMEs has been identified by the Department in its analysis. It stated:
For SMEs in particular, the requirement under the e-Evidence Package for authorities to nominate an addressee as a single point of contact for law enforcement authorities seeking to access electronic evidence will make it easier and more affordable for service providers to authenticate production orders. [However] ... the most significant burden on SMEs identified by the Commission’s assessment is the obligation to designate (and empower) a legal representative ... For SMEs [and again, this is all taken directly from the Department's regulatory analysis] not already engaged in voluntary direct cooperation activities, the e-Evidence Package presents a new regulatory burden that comes with potential legal, administrative and technical costs. SMEs that do not designate an addressee, for example, or fail to comply with the e-Evidence Directive or Regulation will be exposed to administrative penalties.
Nobody is suggesting that should be a byball and that SMEs should be therefore exempt from having to comply with the directive, but when we talk about SMEs some people have the idea that we mean Enterprise Ireland companies, whereas in some cases we could be talking about companies with two or three employees, even though they may be operating in this area.
The e-evidence regulation requires the development of a centralised IT system. No one should know the potential costs of that better than this Government because every time it tries to do one, it has ended up spending clean fortunes. It is clear that "While many large service provides will create their own infrastructure to connect with the decentralised IT system, a requirement for SMEs to do the same would have a disproportionate impact." Again, those are not my words but those from the Department’s report. That report says "consideration is being given to the development of a web-based interface which will allow service providers to communicate securely with authorities without having to establish their own infrastructure." I would welcome an update on whether that has happened.
The really interesting thing about the SME test the Department conducted is that it asks very clear questions and gives yes-no answers, which is somewhat unique. One of the questions is "Is the new policy, primary or secondary legislation, or regulatory compliance requirement relevant for SMEs?" The answer given was "Yes". The test then asks, "Are SME impacts likely to be more substantial than on other companies, for example, in terms of adverse effects?" The answer was unequivocally "Yes". There is a whole section about the consultations that took place and it says "Department officials engaged bilaterally with relevant industry stakeholders and with the SME representative bodies to incorporate their views where appropriate." That is important, but nothing in the legislation puts an onus on the director of the new body to take into consideration all of that. This is going to impact large companies and medium companies but it is also going to impact micro companies, which have between one and nine employees. As I mentioned, some of these could be very small indeed. Again, the question the Department asked of itself was "Has an estimate been carried out of the numbers of micro, small and medium companies affected directly or indirectly by the measure?" The answer to that question was "No".
I would have thought that if the Department had gone to the effort of carrying out an analysis of whether this would have a disproportionate impact on smaller enterprises and it came to the conclusion that it would, the next thing it would do is ask precisely how many companies it was going to have an impact on and ask what the Department and the Government could do, within legislation, to provide supports. Another question is "Will the proposed changes result in any of the following impacts for SMEs?" With respect to additional administrative costs, the answer was "Yes", as it was with respect to additional compliance costs. Across the board there is recognition.
The Department's paper sets out a number of mitigation measures that will be put in place, including:
- A ‘one-stop-shop’ for e-Evidence international cooperation
- Development of a web portal ... [which I have asked for an update on]
- Consideration of the impact of penalties based on size and financial situation
- No requirement for service providers to collect, compile and report data to Member States or the Commission
However, none of that is an assurance efforts will be made to ensure a minimal administrative burden is placed on small to medium-sized service providers. That is why this is a very simple amendment, but it is crucial because these enterprises are Irish based in large part. They are not going to up and leave as a result of changes to tax policy or international regulatory frameworks. These are the people who could potentially become the next generation of IT powerhouses, and more important, they could be based in Ireland. We need to be supporting these companies to navigate their way to a point where perhaps some of them will be able to compete, I hope in a better-regulated world, with some of the other large multinational operations. I hope they will be based in Ireland and will be part of the Irish framework as opposed to the international framework, which can be a bit like the wild west.
I ask the Minister of State to support this amendment.

---

Source: Houses of the Oireachtas. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). The Official Report is revised after first publication; the fetch timestamp below identifies the version quoted.

Record URI: https://data.oireachtas.ie/akn/ie/debateRecord/dail/2026-06-17/debate/main
Retrieved: 2026-09-21T01:01:09+00:00
Sitting date: 2026-06-17