Ethical Managerial Practice in Dealing with Government Data Requests

No matter the purpose of the use of data, companies constantly collect rapidly growing amounts of data, in particular personal metrics, for instance via patterns of online behaviour and/or self-tracking devices (cf. Neff/Nafus 2016). This data and societal ›datafication‹ process allows in-depth insights into users’ private and professional life, political opinions, social and professional circles, patterns of consumption, and geographic location (cf. Cukier/Mayer-Schoenberger 2013). Also, data profiling of individuals has become easier, cheaper, and widespread: As a consequence, a new information phenomenon emerges (cf. Gasser/Almeida 2017: 59f.). The granularity and scalability of the gathered data can be used for various interests once accessed by a government. During recent years, government requests for user data from internet and telecommunication companies have been documented in elevated numbers – an evident rise that can be seen in transparency reports from Google (2019) and Telefonica (2018) as well as the Ranking Digital Rights’ Corporate Accountability Index (cf. Ranking Digital Rights 2018). Once disclosed, such data can be used by governments to abuse citizens’ rights. It should be ensured that disclosure requests for law enforcement are targeted, appropriate in their scope and compliant with applicable legal frameworks. Furthermore, requests could be required, for instance, to be related to criminal cases.
This dilemma raises the question about how responsible business conduct could look like in such a setting, in particular where a company draws the line between legal necessity to comply with a request or corporate responsibility to protect their users’ rights.