Summary

  • Article 9 of the Budapest Convention's Second Additional Protocol lets one Party's 24/7 contact point seek immediate help from another Party in obtaining specified stored data from a provider in the requested Party, without preparing a mutual-assistance request.
  • The request is only the opening record. The requested Party determines whether the emergency exists and handles the provider-facing step under its law; Article 14 also requires a case-specific record showing how personal data were accessed, used and disclosed.

A form carries the request across a border

The Cybercrime Convention Committee (T-CY) now lists a model request for expedited disclosure of stored computer data in an emergency, alongside its 2026 templates for other Second Additional Protocol procedures. The document gives investigators and contact points a shared starting format for a channel designed to move quickly. The T-CY plenary record identifies the model as T-CY(2026)9; the linked Article 9 template is an implementation aid.

The legal route comes from the Protocol. Article 9 permits a Party's point of contact in the Convention's 24/7 Network to request immediate help from another Party's contact point to obtain specified, stored computer data held by a service provider in the requested Party's territory. The request does not need to arrive as a mutual-assistance request. The Protocol applies between states that are Parties to both the Convention and the Protocol and concerns specific criminal investigations or proceedings.

“Emergency” has a defined boundary: a significant and imminent risk to the life or safety of a natural person. The Explanatory Report gives examples such as a credible imminent risk of death or serious injury, ongoing sexual abuse of a child, the immediate aftermath of an attack where officials are assessing the threat of further attacks, and a critical-infrastructure threat that places a person's life or safety at significant and imminent risk. It is a high-pressure procedure, but urgency alone does not establish that threshold.

The requested state still makes the decision

Article 9 sets out a chain with several distinct actors. The requesting Party's competent authority identifies the investigation and data sought. Its 24/7 point of contact carries the request to the corresponding point of contact in the requested Party. The requested Party's own authorities then approach a provider in their territory and transmit any data obtained to the requesting Party.

The request must identify the competent authority and date, invoke the Protocol, name the provider, specify the offence and relevant legal provisions and penalties, explain the facts that establish an emergency and connect the requested data to it, and describe the data in detail. It may also set out procedural instructions. The requested Party must accept electronic requests and can require appropriate security and authentication. These details help an official test whether the request is attributable and sufficiently bounded before the request moves further.

The receiving state also determines whether the emergency exists. Under Article 9(6), it must communicate its determination rapidly and state applicable conditions for providing the data. If the requesting Party cannot meet a condition, it must say so promptly; the requested Party then decides whether the material should still be provided. This makes the recipient state's domestic authority a decision point in the route, not a passive relay.

Article 9(2) makes the local implementation consequential. A Party must enable its authorities to seek data from a local provider after the cross-border request, the provider to disclose data to those authorities, and those authorities to pass the requested data to the other Party. The Protocol therefore depends on national law to allocate the provider-facing power and the officials who may exercise it. A 24/7 contact point may transmit and coordinate, while a separate authority may need to approve or execute the local request.

The intake record and the data record have different jobs

The request captures the basis for an urgent handoff: the authority, offence, emergency facts, relation between the emergency and the data, provider, and data sought. A complete accountability record has to follow the data after that handoff as well.

Article 13 makes the establishment, implementation and application of the Protocol's powers subject to each Party's domestic-law conditions and safeguards, which must adequately protect human rights and liberties. Article 14 adds a personal-data framework. In particular, Article 14(8) requires each Party to keep records or other appropriate means that demonstrate how an individual's data were accessed, used and disclosed in a specific case.

That record obligation reaches beyond the initial request. It concerns what happened after data entered the requested Party's systems and after the data crossed to the requesting Party. Article 14 also addresses purpose and use, retention, transparency, individual access and rectification, and redress. Notice may be restricted in defined circumstances under domestic law, but that does not erase the need to preserve a record that can support later review.

Operationally, a request form should therefore anchor a linked case trail. A stable reference should connect the requesting authority and contact point, the requested Party's emergency determination, its local authority, the provider-facing action, the response and any conditions on use. The two states need records that can show the data's later access, disclosure, retention and applicable notice or redress steps. The Protocol supplies record and safeguard duties; the exact system design remains for national implementation.

The faster channel does not erase the slower one

Article 10 offers a separate route: rapidly expedited mutual assistance when a Party considers an emergency to exist. The Explanatory Report explains the trade. Article 9 can avoid preparing and translating a formal mutual-assistance request and can use real-time exchanges through the 24/7 Network. Article 10 can obtain forms of assistance beyond computer data held by service providers and may make authentication easier. The report leaves channel choice to the Parties in light of the facts, law and experience.

That distinction matters for traceability. If the requested assistance expands beyond specified stored provider data, or if the evidentiary route needs a different form of authentication, officials need a clear point at which an Article 9 request gives way to another legal process. A clean handoff should preserve the case reference and record why the route changed. It should not make urgency an unexamined substitute for scope.

Implementation evidence suggests the operational work is unfinished. At a May 2026 CyberSPEX workshop, practitioners from EU Member States described different domestic arrangements: some could empower police or specialized prosecutors serving as 24/7 contact points, while others identified a need for legislative reform. Participants also raised provider responsiveness, particularly among smaller providers, and the absence of a uniform duty to act swiftly before national implementation. The workshop pointed to standard templates, secure digital channels and deconfliction as practical measures to develop.

Its account is evidence of implementation challenges, not a finding that a particular state or provider failed.

The Protocol's reach is also bounded by participation. The Council of Europe's current Second Additional Protocol page reports 52 signatories and four ratifications in its latest displayed update, dated 15 April 2026. Article 2 applies the mechanism between Parties to both instruments. The model request can be useful preparation for states building the route, while the actual channel remains treaty- and implementation-dependent.

Make the record survive the emergency

The value of a rapid disclosure procedure is easiest to see while a life or safety risk is unfolding. Its legitimacy is harder to sustain if the urgent decision cannot later be reconstructed: who assessed the threshold, what data were necessary, which domestic authority instructed the provider, what conditions applied, who used the result, and what review or notice became due.

The T-CY template can make the first message more consistent. A durable governance design should carry its identity forward, separate transmission from legal authorization where domestic systems require that separation, and let an authorized reviewer examine the complete record after the emergency. National procedures can also publish appropriately aggregated information about volumes, response intervals, conditions, route changes and later review, while protecting active investigations and individuals.

Those measures would let governments test whether the channel is fast enough, narrow enough and reviewable enough. Article 9 provides the urgent route; Article 13 and Article 14 provide continuing constraints. A request that crosses a border quickly still needs a record that can cross the same institutional distance.

Sources