Europe finds search data retention policies inadequate
The Article 29 Data Protection Working Party (an independent European Commission advisory body) has lately been much in the news, owning to their interest towards protecting European internet users from privacy breaches and the misuse of information regarding their internet use.
After making its opinion known to Facebook and other social-networking platforms, the party has turned to search engine giants like Google, Yahoo and Microsoft and expressed its disappointment regarding their data retention policies.
According to the party, these three search engines retain search data for too long and fail to make it anonymous after they finished with it. For two years now the party is repeating the same mantra: search records shouldn’t be kept for more that six months. And the companies have nodded in agreement, but they still haven’t effectuated the changes.
In a letter sent to Google, the party writes that “deleting the last octet of the IP-addresses is insufficient to guarantee adequate anonymisation. Such a partial deletion does not prevent identifiability of data subjects. In addition to this, you state you retain cookies for a period of 18 months. This would allow for the correlation of individual search queries for a considerable length of time. It also appears to allow for easy retrieval of IP-addresses, every time a user makes a new query within those 18 months. Therefore, WP29 cannot conclude your company complies with the European data protection directive.”
Computerworld reports that Google’s response to that was claiming that its policies are tailored to suit the users and to offer them the best experience possible.
Yahoo is looking to implement the policy of keeping the user log data for three months only. After that period, the data should be anonymized. Still, according to the party, it failed to provide adequate information about its policies regarding cookies and user identifiers.
Even Microsoft, who deletes complete IP addresses form search queries after six months, has been found wanting in the cookie handling and retention department.