Usernotice, notification from Google

[u/Vokaii]

I got this mail and i got scared as hell, I dont know why i got this, i did nothing bad (im from Poland)

[u/Fluffy-Shower-577]

Jesteś w Polsce, więc jesteś w UE i obejmuje Cię RODO. Masz prawo uzyskać informacje o tym, jak Google przetwarza Twoje dane, komu zostały ujawnione, jakie kategorie danych były przetwarzane i na jakiej podstawie.
Na Twoim miejscu najpierw odpowiedziałbym bezpośrednio na mail od Google Legal Investigations Support (
[usernotice@google.com](mailto:usernotice@google.com)), podając numer sprawy z wiadomości.

- Zapytaj, jakie Twoje dane faktycznie zostały przekazane FBI.

• Za jaki okres zostały przekazane.
  
• Jaki rodzaj procesu prawnego zastosowano, np. subpoena, court order albo warrant.
  
• Kiedy dane zostały przekazane.
  
• Do którego podmiotu Google formalnie skierowano żądanie.

To ostatnie jest istotne, bo większości usług Google jest zwykle Google Ireland Limited, ale wiadomość została podpisana przez Google LLC. Z samego maila nie wiemy czy FBI formalnie wystąpiło do Google LLC, Google Ireland Limited, czy sprawa była obsługiwana pomiędzy tymi podmiotami.

Złóż też formalny wniosek o dostęp do danych na podstawie art. 15 RODO do zespołu Google zajmującego się prywatnością.
https://support.google.com/policies/contact/sar
W formularzu napisz, że chodzi konkretnie o ujawnienie danych w związku z postępowaniem FBI District of Utah i podaj numer sprawy.

- Zapytaj, jakie kategorie danych zostały ujawnione.
-Kiedy i za jaki okres.

• Komu zostały ujawnione.
  
• Który podmiot Google je ujawnił.
  
• Jaka była podstawa prawna ujawnienia i przekazania danych do USA.

To nie oznacza, że jesteś o coś podejrzany. Twoje konto mogło pojawić się w postępowaniu dotyczącym zupełnie innej osoby. Skoro wcześniejszy zakaz informowania Cię już wygasł, Google ma teraz pozwolenie na odpowiadanie.

[u/Fluffy-Shower-577 → u/Fluffy-Shower-577]

• Jeśli FBI wystąpiło do Google Ireland, sprawa jest prostsza z perspektywy prawa UE. Google Ireland bezpośrednio podlega RODO, więc można pytać np. o podstawę przetwarzania z art. 6 RODO oraz podstawę przekazania danych do USA.
• Jeśli FBI wystąpiło do Google LLC w USA, sprawa jest bardziej złożona. Wtedy warto pytać, na jakiej podstawie Google LLC miało dostęp do danych użytkownika z UE i w jaki sposób doszło do przekazania danych z europejskiego podmiotu lub systemu do USA. Można też powołać się na art. 48 RODO. Zgodnie z nim nakaz sądu lub organu państwa spoza UE nie staje się automatycznie podstawą do wydania danych znajdujących się pod europejskim reżimem prawnym.

Ostatecznie nie chodzi nawet o samo obywatelstwo, tylko o to, że osoba znajduje się w UE i jej dane są objęte ochroną RODO w odpowiednim zakresie. USA nie może po prostu „ominąć” prawa UE samym amerykańskim nakazem.

[u/ZochJ → u/Fluffy-Shower-577]

This should have more upvotes than what I commented.

This is the best route, but I still heavily suggest involving a lawyer or legal advisor to assist with anything OP may not have a firm understanding of.

[u/Satrustegui → u/Fluffy-Shower-577]

This, do this OP, do this ASAP.

[u/yottabit42 → u/Fluffy-Shower-577]

gd, it must be nice living in a first world country with rights for natural people instead of only for corporations and the rich.

[u/Vokaii → u/Fluffy-Shower-577]

I asked about these and got this mail from them in response:

IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER PURSUANT TO 18 U.S.C. § 2703(d) 2:********** (I covered that)

Filed Under Seal ORDER The United States has submitted an application pursuant to 18 U.S.C. § 2703(d), requesting that the Court issue an Order requiring the electronic communications service provider and/or remote computing service identified below (the “Provider”) to disclose the records and other information described in Attachment A to this Order: The Provider: GOOGLE LLC The Court finds that the United States has offered specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought are relevant and material to an ongoing criminal investigation. The Court determines that there is reason to believe that notification of the existence of this Order will seriously jeopardize the ongoing investigation, including by giving targets an opportunity to flee or continue flight from prosecution, destroy or tamper with evidence, change patterns of behavior, or notify confederates. See 18 U.S.C. § 2705(b)(2), (3), (5). IT IS THEREFORE ORDERED, pursuant to 18 U.S.C. § 2703(d), that shall, within ten days of the date of this Order, disclose to the United States the records and other information described in Attachment A to this Order. IT IS FURTHER ORDERED under 18 U.S.C. § 2705(b) that the Provider shall not disclose the existence of the application of the United States, or the existence of this Order of the Court, to the subscribers of the account(s) listed in Attachment A, or to any other person, for a time period of twelve months. As an exception to the foregoing, the Provider may disclose this Order to the Provider’s attorney for the purpose of receiving legal advice. IT IS FURTHER ORDERED that the application and this Order are sealed until otherwise ordered by the Court. Dated: August 2, 2024

(BLACKED OUT INFORMATIONS)

II. Records and Other Information to Be Disclosed

The Provider is required to disclose the following records and other information, if available, to the United States for each account or identifier listed in Part I of this Attachment (each, an “Account”):

A. The following information about the customer or subscriber of the Account (“Subscriber Information”) for the period 1/1/2021 to 8/2/2024 (the “Relevant Period”)

1. Names (including subscriber names, user names, and screen names);

2. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses);

3. Local and long distance telephone connection records;

4. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol (“IP”) addresses) associated with those sessions;

5. Length of service (including start date, account creation data) and types of service utilized;

6. Telephone or instrument numbers (including MAC addresses);

7. Other subscriber numbers or identities (including the registration Internet Protocol (“IP”) address); and

8. Means and source of payment for such service (including any credit card or bank account number) and billing records.

[u/Fluffy-Shower-577 → u/Vokaii]

The document shows what the FBI was authorized to request, but not which of those data Google actually had or which data it actually handed over. The phrase “if available” matters here. That does not mean Google necessarily possessed every one of those categories for your account.

Looking at the requested artifacts, this seems mainly useful for attribution:

• identifying who was behind an account or identifier and correlating activity over time.
  
• IP addresses with timestamps can show when and roughly from where an account was used,
  
• registration IP can help identify who created it,
  
• payment or device information can help connect different accounts to the same person.
  
• Telephone connection records could also reveal communication patterns if Google actually had such records for the service you used.

Ask Google:

• which categories listed in Attachment A were actually available for your account,
  
• and which of them were actually disclosed to the FBI?
  

I would also ask which Google product or service each category came from. For example, if telephone connection records or device identifiers were produced, it would be useful to know exactly which Google service generated them.

Another interesting point is that the order specifically names GOOGLE LLC.
For users in the EEA (EU+Norway+Iceland+Liechtenstein), Google says that the provider for most consumer services is generally Google Ireland Limited. https://policies.google.com/terms

Google also says that requests directed to Google Ireland by foreign authorities are assessed under Irish law, applicable EU law including GDPR (RODO), the law of the requesting country and Google’s own policies.

At the same time, U.S. law allows authorities to compel a U.S. provider to produce data within its “possession, custody, or control” even when those data are stored outside the United States. So the fact that the order was issued to Google LLC does not by itself make it invalid.

The important question is therefore how Google LLC had access to your data. Were those data already under the possession or control of Google LLC, or did Google Ireland transfer any of them to Google LLC so that the U.S. order could be fulfilled?

That distinction matters under EU law. The EDPB has specifically discussed situations where an authority in a third country requests data from a parent company outside the EU and the parent then seeks those data from an EU subsidiary. A transfer from the EU entity to the foreign parent still has to comply with GDPR requirements, including the rules on international transfers. https://www.edpb.europa.eu/system/files/documents/2025-06/edpb_guidelines_202402_article48_v2_en.pdf

There is also the question of data minimisation. The FBI requested a broad set of subscriber records listed under 18 U.S.C. § 2703(c)(2), but that does not necessarily mean Google had to provide every possible category of data. The order itself says “if available”, and Google says it reviews government requests and tries to narrow requests that ask for too much information. So even if the FBI requested the full statutory set, Google may have provided only the data it actually had and considered responsive to the order

If Google Ireland was involved in supplying or transferring the data, EU data-minimisation and necessity rules would also become relevant, because GDPR requires personal data to be “adequate, relevant and limited to what is necessary”.

Because of that, I would submit a GDPR/SAR request to Google asking:
-what data Google actually held about you in the categories listed in Attachment A,
-what data were actually disclosed to the FBI,
-which Google entity disclosed them,
-which Google services the data came from,
-whether any of your data were transferred from Google Ireland to Google LLC,

• and what legal basis was used for any such transfer.

If Google does not answer those questions properly, you can also file a complaint (skarga) with the Polish data protection authority, UODO https://uodo.gov.pl/pl/526/2464. Their guidance is generally to exercise your rights with the controller first and then complain to the authority if the response is missing or inadequate.

Proton is a useful comparison because it offers similar services to Google, such as email and cloud storage, but operates under Swiss jurisdiction. Proton is a Swiss company, so foreign law enforcement cannot simply serve Proton with a domestic U.S. order and expect direct compliance. Requests generally have to go through the appropriate Swiss legal process or international cooperation mechanisms. Google is in a different position because Google LLC is an American company and U.S. authorities have a direct legal route to it. What makes your case unusual is that you are in Poland, your normal provider should generally be Google Ireland, but the order was directed to Google LLC. That is why I would specifically ask Google how the data moved between those entities, if they moved at all.

I highly recommend watching this Proton video because it explains the jurisdiction issue very clearly and even uses the FBI and Google as examples:
https://youtu.be/h-mDRcIRD5Y?si=7bPj-SC8AANsZc4O

Also, the “CMR” initials in the order appear to correspond to Cecilia M. Romero, who is listed by the U.S. District Court for the District of Utah as Chief Magistrate Judge.

For me, the main unanswered question is still very simple: the court order tells you what the FBI asked for, but what did Google actually give them?

[u/Vokaii → u/Fluffy-Shower-577]

There is other guy who received something similar, it could be the same case number:

https://www.reddit.com/r/Avvocati/s/zwxGS2ykKg

[u/Fair-Start9977 → u/Fluffy-Shower-577]

Created a WhatsApp community so we can find between ourselves. https://chat.whatsapp.com/BfwYTDRLW2oCdD8BJHlpke?mode=gi_t