Without prejudice to data protection obligations, service providers should not be held liable in Member States for prejudice caused to their users or third parties exclusively resulting from compliance in good faith with an EPOC or an EPOC-PR. The responsibility for ensuring the legality of the order concerned, in particular its necessity and proportionality, should lie with the issuing authority.