User data requests FAQs
What is a user data request?
What is a preservation request?
Is this data comprehensive?
Why do some of the older reporting periods have fewer data than newer reporting periods?
Do your statistics cover all categories of data requests from governments?
Who are the 'users/accounts' being specified by user data requests, and is Google the only company that governments ask for user data?
Is the number of 'users/accounts' a comprehensive count of the total number of users about whom governments have requested data?
How many of these requests result in Google producing some data?
We report percentages for criminal requests from July 2010 onward. Those percentages reflect the number of requests that we responded to by producing some information.When we receive a request for user information, we review it carefully and only provide information within the scope and authority of the request. The privacy and security of the data that users store with Google is central to our approach. Before producing data in response to a government request, we make sure that it follows the law and Google's policies. We notify users about legal demands when appropriate, unless prohibited by law or court order. And if we believe a request is overly broad, we seek to narrow it – like when we persuaded a court to drastically limit a US government request for two months' of user search queries.
Are the observations that you make about the data comprehensive and do they all relate to the same topics?
What is a National Security Letter (NSL)?
It’s a request for information that the Federal Bureau of Investigation (FBI) can make when they or other agencies in the Executive Branch of the US government are conducting national security investigations. An NSL can’t be used in ordinary criminal, civil or administrative matters.
You can read more about NSLs in this publication by the Congressional Research Service. The FBI is required to report how they use NSLs to Congress biannually. The US Department of Justice also regularly audits how the FBI uses NSLs.
What does an NSL compel Google to disclose?
What process must the FBI follow to issue an NSL?
Can non-US governments obtain information through investigative processes and laws similar to NSLs and FISA?
What is the Foreign Intelligence Surveillance Act (FISA)?
The Foreign Intelligence Surveillance Act is a US law, originally enacted in 1978, to govern how the US government collects foreign intelligence for national security. This Act created the Foreign Intelligence Surveillance Court, which consists of 11 federal district court judges who review government applications for electronic surveillance and other types of intelligence collection. It also created the Foreign Intelligence Court of Review, to which appeals from the FISC can be made. These courts have the power to require companies or other private organisations to hand over information in foreign intelligence investigations.
The Department of Justice oversees the agencies involved in carrying out FISA-authorised activities. FISA requires these agencies to brief Congress on a regular basis and present all pertinent FISA court documents. You can read more about FISA in these publications by the Congressional Research Service: 15 February 2007 CRS Report, 7 July 2008 CRS Report.
What does a FISA request compel Google to disclose?
Under the Foreign Intelligence Surveillance Act (FISA), the government may apply for court orders from the FISA Court to, among other actions, require US companies to hand over users’ personal information and the content of their communications.
The FISA Amendments Act, passed in 2008, authorises the government to require US companies to provide information and content of communications associated with accounts of non-US citizens or non-lawful permanent residents who are located outside the United States. You can read more about the FISA Amendments Act in this publication by the Congressional Research Service: 8 April 2013 CRS Report.
If Google were to receive a FISA request, what would it do?
What are the reporting delays imposed by the US Department of Justice?
If you receive an NSL or a FISA request concerning my account, will you tell me about it?
If Google receives an NSL or FISA request for a user's account, we would apply the same policy that we use when responding to ECPA legal process.
In the case of NSLs, the FBI has the power, under 18 USC. section 2709(c)(1), to prohibit the recipient of an NSL from disclosing the fact that it has received an NSL, by certifying that disclosure may result in 'a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations or danger to the life or physical safety of any person'. In the case of FISA requests, current law prohibits recipients of FISA requests from disclosing the existence of the request.