Suppose the following example (but I'd be grateful for clarifying comments and exceptions that make the rule):

An app named Twombly is made by a company registered in the United Kingdom.

Users can download the app in 3 ways:

  • Apple App Store
  • Google Play Store
  • Google Chrome Web Store

All user data is encrypted on the user's device, and a backup of the user's encryption key is also held by Twobly (the key itself is encrypted to a public key; Twombly keeps the secret part of the key offline for added security).

Twombly can recover the user's encryption key if needed to help them recover their account data in case of lost device(s), and is likewise willing to comply with legal requests for the data.

Scenario A

John Philips is an Australian who created an account using a French email address service throwaway820@mon-adresse-email.fr downloads the app while on holiday in Tunisia, adds data whilst there before continuing to holiday in to Poland. Whilst in Poland, John is arrested on suspicion of murder, and Poland sends a legal request for John's data to Twombly.

Scenario B

Jane Simpson is an American journalist who has Twombly app. She visits Saudi Arabia, uses Twombly there and returns back to the United States. Saudi Arabia makes a legal request for Jane Simpson's data.


Is there a consistent policy that Twombly can use to ensure it abides by the law and does not fight reasonable legal requests, but also not turn over user data to authoritarian regimes too liberally?

Bonus: where does the responsibility lie in proving the identity of the user (and if necessary location at point in time), given 3rd party email services and potentially VPN usage?

[Thanks for reading all this! If the question doesn't comply with rules I'd be grateful for edits to help make it compliant]

  • As an aside, in the case of Twombly, can also assume that all of the user's data is held unencrypted on each device where the user has the app, if that helps. So an argument could be made that authorities have that avenue to retrieve necessary evidence, assuming the device has not been destroyed. Dec 5 '20 at 10:54
  • This is...probably a bit broad and opinion-based for Law.SE, but it's an interesting question. Ultimately it's going to depend on where that individual company decides to draw the line based on their values.
    – Ryan M
    Dec 9 '20 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.