Google-DOJ Settlement Sends Message on Handling Third-Party Data

A settlement between Alphabet Inc.'s Google and the federal government could change how the Department of Justice tries to access data stored by third parties and what consequences companies face if they fail to furnish data related to a warrant or subpoena.

The stipulated agreement announced this week is related to a criminal investigation into BTC-e, a cryptocurrency exchange, and an associated search warrant issued to Google in 2016 for relevant data it was storing abroad. Legal wrangling followed, and by the time Congress clarified that a law it passed about access to private electronic records also applied to U.S. providers who stored data overseas, Google had lost the data.

The agreement requires Google to be better prepared to handle subpoenas and search warrants for stored data in a timely manner, including having a system in place to retain and retrieve data in response to legal requests, while an independent compliance professional makes sure that the company is complying with the agreement. The company told the court that it had spent over $90 million on additional resources so far to better comply with legal compliance requirements.

The agreement could be a signal to other third-party providers about compliance and the need to change the practices of third-party data providers, said Jennifer Beidel, a former assistant U.S. attorney in the Southern District of New York. If they don’t, they could face an outcome similar to Google, she said.

“What’s new here is the fact that they’re going after a third party custodian of records in a criminal case, which is fairly unusual,” said Beidel, now with Saul, Ewing, Arnstein & Lehr. “The fact that they even went after them on this issue shows a concern that’s larger than this particular case. This is an effort by the Department of Justice to try to say, you know, we’re trying to investigate crimes here and we’d like you to come to the table and help us with that.”

Face the Consequences

Less complex companies may not face the same data storage and loss challenges Google experienced in this case, but the agreement implies an expectation from the DOJ that organizations have the capacity to meet warrant requests in criminal investigations, said Brian Ray, who directs the Center for Cybersecurity and Privacy Protection at the Cleveland-Marshal College of Law.

In prior settlements related to the law, known as the Stored Communications Act, no explicit remedy was built in like it is in the Google case, Ray said. This gives companies direction on how to comply with legitimate warrants, he said.

With that precedent in mind, compliance officers now have an additional incentive to examine their company’s warrant response plan. Allocating additional resources to improve warrant request response may benefit the company long term by reducing the legal risk of inadvertently exposing extraneous private data and ensuring that requested information isn’t lost along the way, Ray added.

Installing an independent monitor would allow a company like Google to be pro-active and make well-tailored changes within the company, Beidel said. This means companies will be more on top of what’s required by the law, and how to be nimble as compared to waiting for a court order, she said.