EC: Search data should be deleted after 6 months

April 8, 2008 (Computerworld) European regulators are recommending that search engines delete personal search data after six months. However, most search companies keep the data much longer.

A report (download PDF) from the European Commission's Article 29 Data Protection Working Party found that search engines from companies such as Google, Yahoo and Microsoft violate European data-protection rules because they keep users' personal search data far too long. The length of time the data is kept differs, but it ranges from 18 months to indefinitely.

The report also found that those companies don't tell users that their stored search queries and clicks help create advertising that is targeted to them.

The report looked at whether the data-handling policies of search companies complied with European regulations, such as the Data Protection Directive. An individual's privacy, the report noted, is at the heart of European data protection laws.

"An individual's search history contains a footprint of that person's interests, relations and intentions," the report said. "These data can be subsequently used both for commercial purposes and [for] fishing operations and/or data mining by law enforcement authorities or national security services."

The report recommended that search engines either delete personal search data or make it anonymous after no more than six months.

"In case search-engine providers retain personal data longer than six months, they will have to demonstrate comprehensively that it is strictly necessary for the service," the report said.

The report said some search engines retain the data indefinitely, which is prohibited under European regulations.

Google Inc. said today that it has responded to concerns about retention of search data and that it was the first company to make its search logs anonymous. The company also changed the expiration times of its cookies -- the small data files that Web sites place on PCs so they can remember users' preferences.

"Protecting users' privacy is at the heart of all our products," said Peter Fleischer, Google's global privacy counsel, in a statement.

Yahoo Inc. said it was reviewing the working party's report but noted that it is committed to providing clear and comprehensive privacy policies. Microsoft Corp. could not be immediately reached for comment.

The working party report will be used by the commission as it studies data-protection practices.

Information from the IDG News Service was included in this story.