Cost recovery is the part of a data request programme most likely to be sitting unused. The legal entitlement is well established; the operational capacity to exercise it usually is not.
The statutory basis
Section 2706 provides that a governmental entity obtaining information under the relevant provisions shall pay the provider a fee for reasonable reimbursement of costs directly incurred in searching for, assembling, reproducing, or otherwise providing the information. The amount is as agreed between the parties, or as determined by a court where they disagree.
Exceptions apply, and the significant one for many providers concerns certain records of a provider’s own subscribers or customers sought by a government entity. Whether a given request is recoverable turns on its type and the records sought, so the analysis is per-request rather than global.
Why entitlement does not translate into recovery
| What the statute allows | What most programmes can do |
|---|
The obstacle is measurement. An invoice has to be substantiated, and substantiation requires knowing what a specific request actually cost. Teams handling requests through shared inboxes and ad hoc workflows have no per-request record of effort, so there is nothing to bill from. The entitlement is not disputed; it is simply unexercised.
What a recoverable programme needs
- Per-request time capture. Not estimates after the fact, but recorded effort at each stage.
- A defensible rate basis. Loaded cost of the roles doing the work, applied consistently.
- A record of what was done. Searches run, records reviewed, volume produced.
- A billing route. Agencies have processes for paying these invoices, and someone has to own submitting them.
Why it matters beyond the money
Cost recovery is often the mechanism by which a data request programme gets funded rather than tolerated. Legal and trust & safety teams handling growing request volumes usually compete for headcount against functions with clearer revenue stories. A programme that recovers its own costs changes that conversation, and the tracking that makes recovery possible is the same tracking that makes volume, response time, and staffing needs visible in the first place.