The Python Software Foundation (PSF) received three subpoenas for PyPI user data in March and April 2023, all of which were issued by the United States Department of Justice. Although no context was provided, the subpoenas requested user data related to five PyPI usernames, including names, addresses, connection records, length of service, and type of services utilized. The privacy of PyPI users is a priority for the PSF, but they fulfilled the data request after consulting with counsel. The PSF is now developing new data retention and disclosure policies and will announce them through its blog.
https://blog.pypi.org/posts/2023-05-24-pypi-was-subpoenaed/