Google Shared User Data With Hong Kong Government Despite Pledging Otherwise

Google provided the Hong Kong government with user data in response to three requests made between July and December of last year, after promising to stop processing data requests from foreign authorities. This happened after the National Security Law was imposed in Hong Kong.

In 2020, the company announced, along with other tech and social media behemoths, that it would no longer respond to any requests for user information from city authorities unless they were made through the bilateral Mutual Legal Assistance Treaty (MLAT) with the United States Justice Department.

But the most recent disclosure indicates a shift in the company's position from last year. According to the company's transparency report, Hong Kong officials sent Google 43 requests for user information in 2020. In response to three of the requests, Google generated data, reported Hong Kong Free Press.

A request for information disclosure was made in response to a credible threat to a person's life. The other two requests concerned a human trafficking investigation and were backed up by a warrant signed by a federal magistrate. Google is permitted to provide information in such instances, according to the company's Terms of Service.

As per the policies in terms of user data requests, Google is permitted to share the metadata, including names, related emails, phone numbers, IP addresses, billing details, timestamps and email headers.

However, as reported, the American tech giant has clarified that none of the responses included information about users' content data. The company also stated that the three Hong Kong requests that Google agreed with, were not made in accordance with the treaty.

Details of the controversial National Security Law, which went into force just before midnight on 1 July, the anniversary of the Hong Kong's handover from British to Chinese authority, were revealed by Beijing, making anything it considers to be a subversion, secession, terrorism or collusion with foreign forces punishable by up to life in prison.

As soon as the law came into effect, over 300 individuals got arrested by police as demonstrators took to the streets on 1 July, and 10 people were taken into custody under the new regulation—and it was just the beginning.

The law handed a major setback to Hong Kong's pro-democracy movement, sparking widespread outrage among citizens and pro-democracy campaigners who saw it as a clear infringement of their liberties. For the first time in Hong Kong's history, China established a formal presence of mainland national security agencies as part of the law.

Meanwhile, along with Google, social media companies like Facebook and Twitter said that they suspended processing government requests for user data from Hong Kong authorities upon further assessment of the new law. Later, the Alphabet company said that it would no longer reply directly to city authorities' demands for user data.

Google also informed Hong Kong police that their demands would have to go through the US Justice Department to be processed under the MLAT, which the corporation described as a "complicated process" that may take months, according to a report by The Washington Post. Other American companies, including Apple, Facebook and Microsoft, announced at the time that they had halted handling requests for user data from the Hong Kong government while they assessed the new law.

However, the Hong Kong Free Press previously reported that the authorities made almost 1,400 requests for user data from the tech giants—Goggle, Apple, Facebook and Twitter between July 2019-June 2020, before the security law came into force. It was also reported that according to Facebook's transparency report from June this year, the company turned down all 202 requests for user data from Hong Kong authorities in the second half of 2020, including an emergency request, while Twitter also denied responding to one request from the authorities during the same time.

Apple gave non-content information in response to 19 to 50 per cent of Hong Kong government requests for user data, according to an earlier report covering the six months before the law was passed. During the same period, Microsoft also released non-content data in response to around 60 per cent of Hong Kong law enforcement demands.

As reported in June this year, Hong Kong authorities were told that if privacy regulations are changed, companies like Google, Facebook and Twitter may no longer be able to offer their services in the region. The warning was issued in a letter from the Asia Internet Coalition (AIC), which includes all three companies, as well as Apple, LinkedIn and others as the members.

However, Eric Fan, who is an online privacy and security expert, told Hong Kong Free Press that the revelations made by Google regarding user data requests were "surprising" because they appear to contradict its own public declaration from last year, with no explanation as to why it chose not to follow it.

While referring to the 2019 Hong Kong protest, he said: "Many people have higher [standards] for personal privacy in the wake of the national security law and social movement."

In terms of privacy, Eric said that while there is a global movement against the usage of Google products or services due to privacy concerns—"DeGoogle"—some people may prefer to use Protonmail or search engine DuckDuckGo instead of Google. But Eric claimed that he couldn't say why the Alphabet company answered some requests but not others.

Hong Kong Free Press has highlighted the fact that since May, the government has been considering broadening the powers of Hong Kong's privacy watchdog.

The city's Office of the Privacy Commissioner for Personal Data, under proposed legislative modifications, would be able to request information from anybody to aid investigations into doxxing acts (such as malicious publishing of private or identifying data), which the authorities intend to criminalise. If suspects do not comply with requests, officials may be able to search and arrest them without a warrant under the new law.