|
In the first half of 2023, Microsoft received 172 requests from law enforcement around the world for accounts associated with enterprise cloud customers. In 107 cases, these requests were rejected, withdrawn, there was no data, or law enforcement was successfully redirected to the customer. In 65 cases, Microsoft was compelled to provide responsive information: 28 of these cases required the disclosure of some customer content and in 37 of the cases we were compelled to disclose non-content information only. Of the 28 instances that required disclosure of content data, 22 of those requests were associated with U.S. law enforcement.
In the second half of 2022, Microsoft received 147 requests from law enforcement around the world for accounts associated with enterprise cloud customers. In 76 cases, these requests were rejected, withdrawn, no data, or law enforcement was successfully redirected to the customer. In 71 cases, Microsoft was compelled to provide responsive information: 38 of these cases required the disclosure of some customer content and in 33 of the cases we were compelled to disclose non-content information only. Of the 38 instances that required disclosure of content data, 33 of those requests were associated with U.S. law enforcement.
A consumer service is generally one subscribed to and used by an individual in their personal capacity. Some examples include Hotmail/Outlook.com, OneDrive, Xbox Live and Skype. For purposes of this report, “enterprise customer” generally includes those organizations or entities (commercial, government or educational) that purchase more than 50 “seats” for one of our commercial cloud offerings, such as Microsoft 365, Exchange Online, and CRM Online. Those organizations, in turn, may provide services, such as email, to individual employees, students or others.
No. The CLOUD Act amends USlaw to make clear that law enforcement may compel US-based service providers to disclose data that is in their “possession, custody, or control” regardless of where the data is located. This law, however, does not change any of the legal and privacy protections that previously applied to law enforcement requests for data – and those protections continue to apply. Microsoft adheres to the same principles and customer commitments related to government demands for user data.
In the second half of 2022, Microsoft received 4,908 legal demands for consumer data from law enforcement in the United States. Of those, 53 warrants sought content data which was stored outside of the United States.
In the same time frame, Microsoft received 62 legal demands from law enforcement in the United States for commercial enterprise customers who purchased more than 50 seats. Of those demands, there were content data disclosures related to 4 non-US enterprise customers whose data was stored outside of the United States.
In the first half of 2023, Microsoft received 58 legal demands from law enforcement in the United States for commercial enterprise customers who purchased more than 50 seats. Of those demands, there were content data disclosures related to 4 non-US enterprise customers whose data was stored outside of the United States.
In the first half of 2023, there were zero disclosures of Dynamics 365 data belonging to a commercial, public sector, or educational customer.
In the second half of 2022, there were zero disclosures of Dynamics 365 data belonging to a commercial, public sector, or educational customer.
In the first half of 2023, there were zero disclosures of Azure content data belonging to a commercial, public sector, or educational customer.
In the second half of 2022, there were zero disclosures of Azure content data belonging to a commercial, public sector, or educational customer.
Yes. Microsoft gives prior notice to its enterprise customers of any third-party requests for their data, except where prohibited by law. We also provide our enterprise customers with notice upon expiration of a valid and applicable nondisclosure order. Except in the most limited circ*mstances, we believe governments can obtain information directly from our enterprise customers without jeopardizing investigations or risking harm to individuals, just as they did before the customer moved to the cloud. For the same reason, we believe that our enterprise customers can, except in the most exceptional circ*mstances, be notified about government requests for their data.
