1. The company commits to notify users when government entities (including courts or other judicial bodies) request their user data.
2. The company commits to notify users when non-government entities request their user data.
3. The company discloses situations when it might not notify users, including a description of the types of government requests it is prohibited by law from disclosing to users.
Guidance: We expect companies to disclose a commitment to notify users, when legally possible, in cases where third parties request data about users. We acknowledge that this notice may not be possible in legitimate cases of an ongoing investigation, however, companies should explain this to users.
Evaluation: This indicator is scored using a checklist, meaning companies can only receive full credit if their disclosure meets all elements in the checklist.
Potential sources:
For more information, click here for a glossary of terms.
