P12. User notification about third-party requests for user information
The company should notify users to the extent legally possible when their user information has been requested by governments and other third parties.
Elements
- Does the company clearly disclose that it notifies users when government entities (including courts or other judicial bodies) request their user information?
- Does the company clearly disclose that it notifies users when private parties request their user information?
- Does the company clearly disclose situations when it might not notify users, including a description of the types of government requests it is prohibited by law from disclosing to users?
Research guidance
We expect companies to clearly disclose a commitment to notifying users when governments and private parties request data about users. We acknowledge that this notice may not be possible in legitimate cases of an ongoing investigation; however, we expect companies to specify what types of government requests they are prohibited by law from disclosing.
Potential sources:
- Company transparency report
- Company law enforcement guidelines
