The Article 29 Working Party, a committee of Europe's data
protection watchdogs, has been investigating Google's practice of
retaining users' search queries along with information that could
identify the user.
In an exchange of letters the Working Party and Google have
outlined their differences, with the Working Party questioning
Google over its need for any retention and Google saying that it
would anonymise records after 24 months, then shortening that
period to 18 months.
The Working Party has now said that it will widen the scope of
its investigations to include all search engine companies and their
data retention practices.
"Taking into account the current situation initiated by the
"Google case", the Working Party will deal with search engines in
general, and scrutinize their activities from a data protection
point of view, because this issue affects an ever growing number of
users," it said.
Every internet search engine query leaves a log of the query and
results. Search engine companies keep these records, and many are
believed to keep them indefinitely. Some search engines, including
Google, allow users to personalise searches by registering and
signing in to use the search engine.
In these cases the company knows many details about the
person doing the search and can cross reference search queries with
that data.
Even if a user is not signed in, however, the search company
will be able to identify the internet address from which a search
came. In many cases that can allow for subsequent identification in
conjunction with information from an internet service provider
(ISP).
Google announced that it would anonymise these search queries
after two years, and later in a concession to the EU privacy chiefs
said it would wipe identifying data after 18 months.
Other search companies have not come forward with proposals for
anonymising searches. The Working Party will now investigate other
major search companies and their data retention policies.
OUT-LAW.COM revealed earlier this month that one of the major
legal bases for Google's actions does not apply to internet
searches according to an official of the Working Party.
The EU's Data Retention Directive demands that service providers
keep data for between six and 24 months, according to differing
national laws. Google had used this as the basis for their
retention of search logs.
"The Data Retention Directive requires all EU Member States to
pass data retention laws by 2009 with retention for periods between
6 and 24 months," said Google global privacy counsel Peter
Fleischer in a letter to the Working Party.
"Google is therefore potentially subject (both inside and
outside the EU) to legal requirements to retain data for a certain
period. Since not many member states have implemented the Directive
thus far, it is too early to know the final retention time periods,
the jurisdictional impact, and the scope of applicability. Because
Google may be subject to the requirements of the Directive in some
member states, under the principle of legality, we have no choice
but to be prepared to retain log server data for up to 24 months,"
said Fleischer.
But a senior European data protection official told OUT-LAW.COM
that the Directive did not apply to search logs.
"The Data Retention Directive applies only to providers of
publicly available electronic communications services or of public
communication networks and not to search engine systems," said
Philippos Mitletton. Mitletton works for the European Commission's
Data Protection Unit, which itself is represented on the Article 29
Working Party. "Accordingly, Google is not subject to this
Directive as far as it concerns the search engine part of its
applications and has no obligations thereof," he said.
