Google handed user data to Hong Kong authorities despite pledge

Google has admitted that it provided the Hong Kong government with user data, making it the first US tech giant to disclose its compliance with requests from the authorities after a national security law that criminalises protests was brought into effect last June.

Google last year pledged to stop responding to any request for user information from the Hong Kong authorities, unless they came through the US Justice Department, as reported by the Hong Kong Free Press (HKFP).

However, Google has since revealed that it “produced some data” for three out of the 43 requests it received from local authorities for user information between July and December last year.

The company said one of the requests was for an emergency disclosure involving a credible threat to life, while the other two involved human trafficking. Google added that the two requests were unrelated to national security, were supported by search warrants signed by a magistrate as part of an investigation, and were processed according to the company’s global policy on government requests for user information.

Last year, Google said it would not respond to user data requests from the local government unless they were made through the bilateral Mutual Legal Assistance Treaty (MLAT) with the US Justice Department. The company said the three requests in Hong Kong were not made through the treaty and added that emergency requests involving threats to life are not required to go through the treaty. Although the requests were outside the MLAT protocol, according to Google they were processed according to standards, procedures and controls applied to all user data requests globally.

42 of the legal requests it received involved 46 user accounts, while the one emergency disclosure request involved a single account. Google added that it still requires the vast majority of Hong Kong government requests to be processed through diplomatic procedures, including any national security law-related requests. However, it did not confirm whether it had notified the three users in the requests that it had provided the authorities with their data.

According to Google, the majority of requests from Hong Kong authorities are required to be processed through diplomatic procedures like MLAT, authorities may continue to seek data needed for criminal investigations through these kind of procedures, and it carefully reviews all requests for user data and pushes back on overly broad ones to protect users' privacy.

In July last year, Microsoft, Google, Facebook and Twitter suspended the processing of user data requests from the Hong Kong government following the implementation of a new security law that criminalises protests. Google revealed at the time that the local government requested data from Google users 105 times in 2019 alone.