The Council of Europe Convention on Cybercrime (Budapest Convention) was the first international treaty to focus explicitly on cybercrime. Its aim is to function as an international framework for the harmonization of cybercrime-related legislation and to facilitate the fight against criminal offences making use of computer networks. One of the most important provisions of the Budapest Convention is Article 18. If implemented into the domestic law of the Parties to the Convention, Article 18(1)(b) provides a legal basis for competent authorities to issue orders for the production of subscriber information addressed to service providers which may be established outside their jurisdiction, but which are offering their services within their territory.

This document analyses the toolbox available to competent authorities under Article 18 of the Budapest Convention, including the interpretation of EU domestic courts of the notion of service providers “offering their services” within the territory of a specific country. It also includes excerpts from the legislation of some EU Member States implementing Article 18 into their domestic legal framework.

The document was prepared within the framework of the SIRIUS Project. The SIRIUS Project has received funding from the European Commission’s Service for Foreign Policy Instruments under Contribution Agreement No PI/2020/417-500.