Takedown Guidance Policy

Guidance on Requesting User Information or “Takedown” of User Data

Overview

MEGA is ‘The Privacy Company’ and values the privacy of the users of its services. MEGA is committed to maintaining industry-leading levels of security and confidentiality of user information and data. However, privacy is not an absolute right and is subject to limitations.

This guidance describes how MEGA will achieve that balance and the approach it will generally take to requests in criminal and civil actions against or involving its users. This guidance is aimed at providing transparency to everyone interested in MEGA’s services and consistency in its actions.

THIS GUIDANCE DOES NOT CREATE ANY LEGALLY BINDING OBLIGATIONS ON MEGA AND MEGA BEARS NO LIABILITY WHATSOEVER FOR COMPLYING OR NOT COMPLYING WITH IT, AS IT SEES FIT, AT ANY TIME. ALL LIMITATIONS AND EXCLUSIONS OF LIABILITY SET OUT IN MEGA’S TERMS OF SERVICE APPLY EQUALLY TO THIS GUIDANCE. MEGA MAY AMEND, REPLACE OR WITHDRAW THIS GUIDANCE AS IT SEES FIT. WHERE THERE IS ANY INCONSISTENCY BETWEEN THIS GUIDANCE, MEGA’S TERMS OF SERVICE, MEGA’S COOKIE POLICY AND MEGA’S PRIVACY AND DATA POLICY, THE TERMS OF SERVICE WILL PREVAIL.

MEGA reserves the right, unless required otherwise by applicable law, to provide differing levels and categories of information in response to different requests.

Important: Persons making a request should first check with MEGA what information may be available, particularly before applying for a criminal law production order or using civil law procedures to obtain user information or data. For law enforcement, checking first is also important, since in some circumstances, such as particular urgency, MEGA may not require a court order for release of information and may be prepared (but shall not be obligated to) retain information while disabling user access to it, for evidential purposes.

MEGA may amend, replace or withdraw this guidance temporarily or permanently from time to time as it sees fit. MEGA will generally try to give advance notice if possible, before changes to this guidance come into effect.

This guidance will be publicly available, including by publication on MEGA’s website. MEGA may also periodically publish a summary of requests received and actions taken under this guidance.

Guiding principles

In considering any request for user data, user information or action involving a MEGA user, MEGA starts from the position that user data and account information is private, so disclosure is only warranted in cases of clearly illegal activity. MEGA notes that all stored files and all chats are user-encrypted so they are unreadable to any other party unless the user has created and shared a folder/file link, shared a folder to a contact, shared the account password or included another party in a chat.

Applicable law for the purposes of this guidance is New Zealand law. However, MEGA may, at its sole discretion and without submitting itself to any other jurisdiction’s law or courts or tribunals, consider requests made by non-New Zealand law enforcement authorities and civil claimants, on such basis and to such degree as MEGA sees fit.

Even if the decryption key is provided to staff or otherwise publicly available, MEGA generally will not view, or attempt to view, files against which action is requested but it reserves the right to do so where the file decryption key has been provided if it considers review is necessary or appropriate. MEGA is not obliged to take action unless required to do so by applicable law but any action will be undertaken objectively, based only on the information provided by third parties, this guidance, its Terms of Service its Cookie Policy and its Privacy and Data Policy. Where there is any inconsistency between those MEGA documents, the Terms of Service prevail.

MEGA will promptly inform the user of any action taken where practicable, provided it considers it appropriate or is required to do so by applicable law, and provided it is not legally prevented from doing so by a court or other authority with appropriate jurisdiction. Action taken might not be disclosed in cases where an appropriate law enforcement agency requests non-disclosure because the case is under active investigation.

Emergency response

This is defined as a situation where, in the expert judgement of a senior officer of the New Zealand Police or similar law enforcement officer or authority acceptable to MEGA, MEGA has written assurance that the person making the request has valid reasons to believe that disclosure or action is necessary to prevent or lessen a serious threat (as defined in section 7(1) of the Privacy Act 2020) to

• public health or public safety; or
• the life or health of an individual or individuals;

and where the person giving such assurance confirms in writing that the threat is of such urgency that there is not time to obtain a production order or other court order.

If satisfied as to the above, MEGA may, in its discretion, accept a request in such situations in good faith. In doing so, MEGA will be relying on the assurances given by the person making such request and will look to them and their organisation to cover any costs, damages, penalties, compensation or other liability should that assurance turn out to be incorrect or wrongly given for any reason.

The information to be provided or action to be taken by MEGA shall be as specified by, and agreed with, the appropriately designated officer.

MEGA will provide the New Zealand Police and other agencies approved by MEGA with the mobile phone number and email address of contact person(s) who will act on behalf of MEGA in an emergency response situation.

Objectionable material – child exploitation material, violent extremism, bestiality, zoophilia, gore, malware, hacked/stolen data, passwords

MEGA does not condone, authorise, support or facilitate the storage or sharing of Child Exploitation Material (CEM), also known as Child Sexual Abuse Material (CSAM) or other objectionable material as defined in section 3 of the Films, Videos, and Publications Classification Act 1993 or other seriously harmful material.

As The Privacy Company, MEGA does not condone spreading of viruses/malware or hacking and leaking of private data, passwords, or confidential information or other internet-harming material.

MEGA may (but shall not be obligated to) take down or disable access to such material, close the user’s account and provide account details and other data to the appropriate authorities as it sees fit.

Allegations of copyright infringement (“notice and takedown”)

MEGA will act on copyright infringement “takedown” notices in accordance with its Terms of Service.

Users are advised in MEGA’s Terms of Service, and when using the service, that they must comply with all laws including copyright and other intellectual property laws. This includes, but is not limited to, a warning when generating a link for sharing files/folders.

MEGA will publish on its website the information to be provided and statements to be made by copyright owners or their duly authorised agents/representatives, to notify MEGA of an alleged copyright infringement.

All copyright infringement “takedown” notices should be made via the specific webform at https://mega.io/copyright or by email to copyright@mega.nz with all the information specified at https://mega.io/copyright.

The notifier of alleged copyright infringement will be given the option of requesting either removal of link(s) to an allegedly infringing file or removal of all file(s) relating to a specific link/URL.

For file links, the submitter is able to choose one of three options:

1. Disable the reported link – the file will remain in the user’s account;
2. Disable all links pointing to the same byte sequence – the file will remain in the user’s account;
3. Disable all links and remove all files from all accounts referencing the same byte sequence – there is no user permitted to store this under any circumstance worldwide.

Folder links can refer to a large number of files, of which only some are claimed to be infringing. If the submitter doesn’t provide identification of the individual copyrighted works and files within the folder that are claimed to have been infringed, MEGA disables the reported folder link consistent with option (1) above. Rights-holders can submit type (3) takedown requests for specific files within a folder by obtaining the handles for specific files within a folder (select file(s) and use the right-click Get link(s) function).

You can read more about our Copyright Notice process here. For information on responding to a Copyright Notice you have received from MEGA, go here.

Allegations of other intellectual property infringement (“notice and takedown”)

MEGA will act in response to allegations of other forms of intellectual property infringement (e.g. trade mark infringement) in broadly similar fashion as for copyright infringement, reserving to itself the same discretions, rights and protections.

Notices of alleged intellectual property infringement, setting out full details similar to those required for copyright infringement “takedown” notices should be sent to ip@mega.nz

Civil court action for alleged copyright or other intellectual property infringement

Where a third party initiates court action against a MEGA user for alleged copyright or intellectual property infringement and wishes to access information held by MEGA for that purpose, the General Guidance above applies, i.e. this generally means a non-party discovery order or, if that is not available, a witness summons, subpoena or agreed affidavit or statement of facts. Persons making civil requests should strictly comply with the New Zealand District Court or High Court Rules.

Other cases

Other than as set out above in those specific situations, MEGA will generally only take action when required to do so by applicable New Zealand law or a court or law enforcement authority with appropriate jurisdiction, although it reserves the right to do so at any time and for any reason or no reason, as set out in its Terms of Service.

For criminal matters, this generally means a New Zealand ‘production order’ as per Subpart 2 of Part 3 of the Search and Surveillance Act 2012 is required rather than simply a formal or informal request for information and/or action.

For civil matters, this generally means a New Zealand court non-party discovery order or, if that is not available, a witness summons, subpoena or agreed affidavit or statement of facts. Persons making civil requests should strictly comply with the New Zealand District Court or High Court Rules.

The information to be provided or action to be taken by MEGA shall be as specified in the relevant law or order, subject to MEGA being technically able to provide that information or take that action. As noted above, persons making criminal or civil information requests should contact MEGA first to see what information may be able to be provided.