Federal and state agencies traditionally obtain information for law enforcement purposes using a variety of methods including:

• court issued subpoenas,
• grand jury subpoenas,
• search warrants,
• litigation discovery requests, and
• administrative subpoenas.¹

A request by a government agency for personal information about one, or more, consumers may conflict with consumers’ expectations of privacy, and, in some instances, may arguably conflict with legal obligations imposed upon an organization not to produce information.  For example, if an organization promises within its privacy policy that it will never share the information that it collects with a “third party” and does not include an exception for requests from law enforcement, or government agencies, a consumer could argue that by producing information pursuant to a government request, an organization has violated its privacy policy and committed an unfair or deceptive practice in violation of federal or state law. 

If you receive a government request for personal information, consider the following steps and questions:

1. Does your organization maintain an internal procedure or protocol for how to respond to a government information request?
2. Has your organization made any representations to consumers that might be interpreted as indicating that information will not be provided to the government?
3. Was the information request actually issued by the agency that purported to issue it (independently confirm with the issuing agency that the request is authentic)?
4. Confirm that the issuing agency does, in fact, want you to produce personal information.
5. Has the government agency provided notice of the request to the people about whom the information relates?
6. Does the request include a legal basis (an authorizing statute) for making the information request? If so, does the authorizing statute permit the agency to obtain the type of information requested?
7. Does the authorizing statute require the agency to comply with a specific procedural process prior to requesting the information? If so, has the agency complied?
8. Will complying with the information request pose an undue burden on your organization?
9. Has the request been issued, or reviewed, by a court?
10. What opportunities does your organization have to negotiate with the agency to limit the quantity of personal information produced and/or to seek administrative or judicial review concerning the agency’s need to obtain personal information?

Did you know? 335: Number of federal authorities that permit various federal agencies to issue administrative subpoenas²

 [1]  We use administrative subpoenas here to refer to “all powers, regardless of name, that Congress has granted to federal agencies to make an administrative or civil investigatory demand compelling document production or testimony.” U.S. Department of Justice Office of Legal Policy, Report to Congress on the Use of Administrative Subpoena Authorities by Executive Branch Agencies and Entities Pursuant to Public Law 106-544, [hereinafter DoJ Report] available at http://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=4078&context=flr.

[2]  Id.