Google has revealed that it complied with 5525 out of 6335 requests from Australian authorities to disclose user information related to 7183 accounts in the past year. The disclosure is part of Google’s biannual transparency reports on user information disclosures. Earlier this year, the company had released data on government content removal requests, indicating that the eSafety Commissioner’s actions led to the de-indexing of thousands of sites from Google’s search engine in 2022.
While Google is more transparent about government takedown requests, it provides limited information about the agencies requesting user data and the purpose behind the requests. Meta and TikTok have similar transparency reports, with Meta complying with 3563 Australian agencies’ requests and TikTok with 91, but the identities of the agencies making these requests remain undisclosed.
The information available about agencies obtaining end-user information from digital service providers comes from the agencies themselves. Some authorities publish the number of requests they make for end-user information to service providers under relevant Acts. For instance, the eSafety Commissioner’s annual report for 2021-2022 stated that it used the Online Safety Act four times to obtain end-user identity or contact details during investigations into crimes involving non-consensually shared images. The Australian Federal Police also used account-takeover powers twice to investigate child abuse during the same period.
However, there is a lack of detailed breakdown regarding actions taken against digital service providers by company when it comes to requests for user data. In the US, Google and Meta have faced increased scrutiny for their compliance with authorities’ requests for user data, with the FBI using geofence warrants to obtain location data during investigations into the January 6 riots, and Facebook messages being used in abortion-related cases.
Threats to a child’s safety or life
Google received 62 ’emergency requests’ related to Australia in 2022, which may not have the same processing safeguards as regular requests. Normally, Google informs users about requests from authorities to access their account data, except during “statutory or court-ordered gag periods.” However, in emergencies such as threats to a child’s safety or life, notice might not be given initially, but provided later if the emergency has passed, in line with applicable laws and Google’s policies.
Australia also made seven diplomatic legal requests to the US for information related to Google in 2022, currently processed through Mutual Legal Assistance Treaties (MLATs). When the CLOUD Act treaty is ratified, formal requests for data related to serious crimes like ransomware attacks will be approved by US-based companies without going through the MLAT process.
