On September 16, 2008, the Article 29 Working Party published a brief status report on its ongoing dialogue with Google regarding how Google is protecting the privacy rights of its search engine users in Europe. The dialogue with Google emerged from a previous Working Party opinion (published on April 4, 2008), in which the Working Party examined the responsibilities and duties of search engine providers under European data protection law.

In reaction to that opinion, Google recently confirmed its willingness to cooperate with the Working Party to enhance Internet users’ privacy protection. Google also announced two modifications to its existing data protection practice.

First, the retention period for users’ personal data will be reduced from 18 to nine months. After nine months, IP addresses associated with requests carried out via the search engine will be anonymized, at which time they will no longer be considered personal data under the EU Data Protection Directive.

Second, a link to Google’s privacy policy will appear on its homepage.

The Working Party applauded these changes in its September 16, 2008, press release, but emphasized that Google’s data retention period is still too long (the Working Party does not see a basis for a retention period beyond six months).

Also, the parties strongly disagree about other important issues, such as the applicability of European data protection law. Google believes that the European rules on data protection are not applicable to the company, even though it has servers and establishments in Europe.

The Working Party’s position, on the other hand, is that the EU Data Protection Directive generally applies to the processing of personal data by search engines, even if they are headquartered outside Europe. The Working Party intends to organize hearings with Google to address the outstanding points of dissension.

TAKE A LOOK BACK

Search Engine Activity and Data Storage Scrutinized by EU Data Privacy Authority (April 2008)