Consider policy on informing people when we get requests for their personal information

[RichardTaylor]

Requests could be:

• Court orders
• Police requests under PACE
• Subject Access Requests by third parties, where third party data is mixed up with the requester's personal data.

We sometimes get notices of proposed requests/orders prior to the requests/orders themselves.

We may not legally be able to provide notice to those whose data is involved straight away.

[garethrees]

Somewhat related to #815.

[RichardTaylor]

Example of how Apple informed one of their users about a request from the FBI for their personal information:

https://twitter.com/ringo_ring/status/1390782451140767749

[RichardTaylor]

Section 47.8 of the The Criminal Procedure Rules 2020 states those who may apply to vary or discharge an investigation order (including a production order under the Police and Criminal Evidence Act 1984) are: an applicant; the respondent; or a person affected by the order.

If those affected by the order are not informed of it they can't avail themselves of their right to challenge it.

[RichardTaylor]

There was a previous case in 2015 where we received correspondence from a legal firm acting behalf of a private client seeking a user's personal information for the purpose of taking action in respect to an allegation of defamation.

We pointed the legal firm to the user-user messaging system and suggested they contact the user (this is something we often do in such cases as it often negates the need to request user data from us).

We alerted the user to what had happened, and what we'd done, and advising them on how the user-user messaging system worked.

That was a rare case of us alerting a user to a request for their personal information - handled under our policy of considering such requests on a case by case basis.

[HelenWDTK]

This issue is being closed due to a lack of discussion or resolution for over 12 months. Should we decide to revisit this issue in the future, it can be reopened.