Suppose the following example (but I'd be grateful for clarifying comments and exceptions that make the rule):
An app named Twombly is made by a company registered in the United Kingdom.
Users can download the app in 3 ways:
- Apple App Store
- Google Play Store
- Google Chrome Web Store
All user data is encrypted on the user's device, and a backup of the user's encryption key is also held by Twobly (the key itself is encrypted to a public key; Twombly keeps the secret part of the key offline for added security).
Twombly can recover the user's encryption key if needed to help them recover their account data in case of lost device(s), and is likewise willing to comply with legal requests for the data.
John Philips is an Australian who created an account using a French email address service firstname.lastname@example.org downloads the app while on holiday in Tunisia, adds data whilst there before continuing to holiday in to Poland. Whilst in Poland, John is arrested on suspicion of murder, and Poland sends a legal request for John's data to Twombly.
Jane Simpson is an American journalist who has Twombly app. She visits Saudi Arabia, uses Twombly there and returns back to the United States. Saudi Arabia makes a legal request for Jane Simpson's data.
Is there a consistent policy that Twombly can use to ensure it abides by the law and does not fight reasonable legal requests, but also not turn over user data to authoritarian regimes too liberally?
Bonus: where does the responsibility lie in proving the identity of the user (and if necessary location at point in time), given 3rd party email services and potentially VPN usage?
[Thanks for reading all this! If the question doesn't comply with rules I'd be grateful for edits to help make it compliant]