Legal Research

Search engines still in breach of EU data protection laws

By scott

The EU’s Article 29 Data Protection Working Party has sent public letters to the three major search engines ? Google , Microsoft  and Yahoo!  saying that although it welcomes their efforts to bring their data retention policies in line with the law, they are all still in breach of the EU’s data protection directive.

The Working party tells Google that it should reduce the period at which it ?anonymizes? IP addresses in it’s server logs to 6 months instead of the 9 months it agreed to reduce them to. It also states that Google’s method of anonymisation is not adequate ? Google deletes the last octet of the IP-addresses.

According to the Working Party ’such a partial deletion does not prevent identifiability of data subjects.’ In addition to this, They were not happy with Google’s cookie retention practices, where Google retains cookies for a period of 18 months. ‘This would allow for the correlation of individual search queries for a considerable length of time. It also appears to allow for easy retrieval of IP-addresses, every time a user makes a new query within those 18 months.’ The Working party letter states.

The Working party is bit more gentle on Microsoft and applauded its willingness to reduce the retention period of cookies and IP addresses to 6 months, pending on the willingness of other search engines to follow suit. However, like Google, Microsoft retains Cookie date for 18 months, which again still left room for ‘the cross-matching of search queries for a considerable length of time.’ The Working party also questioned the effectiveness of Microsoft’s anonymisation claims.

Yahoo! had pledged to reduce their retention time to 90 days with limited exceptions for fraud, security, and legal obligations, which pleased the Working party, who welcomed the move to deleting the full IP-address from the first full dataset after 90 days instead of just deleting the last octet, but again there were concerns. ‘a partial deletion of the personal data contained in search logs does not constitute true anonymisation.’ the Working party points out. Also,as with Google and Microsoft it says they were not provided with enough information to technically assess the quality of their anonymisation policy.

Here there was a clear call to all three search engines to review their anonymisation claims and make the process verifiable, preferably by developing a credible audit process involving an external and independent auditing entity. ‘The actual techniques of anonymisation deserve an open debate, open to  public scrutiny, in light of the expanding body of research on the failures of anonymisation.’, states the Working party.

The Working party also recognises the transatlantic of the issue and states that it has forwarded its concerns to the Federal Trade Commission (FTC), and asked the FTC to use its authority to examine the compatibility of this behaviour with section 5 of the Federal Trade Commission Act.

It’s good how long you can get away with breaking the law isn’t it. Look forward to the responses from Google and Co.

Full post as published by Information Overload on May 27, 2010 (boomark / email).