The Article 29 Working Party, a committee of Europe's data protection watchdogs, has been investigating Google's practice of retaining users' search queries along with information that could identify the user.
In an exchange of letters the Working Party and Google have outlined their differences, with the Working Party questioning Google over its need for any retention and Google saying that it would anonymise records after 24 months, then shortening that period to 18 months.
The Working Party has now said that it will widen the scope of its investigations to include all search engine companies and their data retention practices.
"Taking into account the current situation initiated by the "Google case", the Working Party will deal with search engines in general, and scrutinize their activities from a data protection point of view, because this issue affects an ever growing number of users," it said.
Every internet search engine query leaves a log of the query and results. Search engine companies keep these records, and many are believed to keep them indefinitely. Some search engines, including Google, allow users to personalise searches by registering and signing in to use the search engine.
In these cases the company knows many details about the person doing the search and can cross reference search queries with that data.
Even if a user is not signed in, however, the search company will be able to identify the internet address from which a search came. In many cases that can allow for subsequent identification in conjunction with information from an internet service provider (ISP).
Google announced that it would anonymise these search queries after two years, and later in a concession to the EU privacy chiefs said it would wipe identifying data after 18 months.
Other search companies have not come forward with proposals for anonymising searches. The Working Party will now investigate other major search companies and their data retention policies.
OUT-LAW.COM revealed earlier this month that one of the major legal bases for Google's actions does not apply to internet searches according to an official of the Working Party.
The EU's Data Retention Directive demands that service providers keep data for between six and 24 months, according to differing national laws. Google had used this as the basis for their retention of search logs.
"The Data Retention Directive requires all EU Member States to pass data retention laws by 2009 with retention for periods between 6 and 24 months," said Google global privacy counsel Peter Fleischer in a letter to the Working Party.
"Google is therefore potentially subject (both inside and outside the EU) to legal requirements to retain data for a certain period. Since not many member states have implemented the Directive thus far, it is too early to know the final retention time periods, the jurisdictional impact, and the scope of applicability. Because Google may be subject to the requirements of the Directive in some member states, under the principle of legality, we have no choice but to be prepared to retain log server data for up to 24 months," said Fleischer.
But a senior European data protection official told OUT-LAW.COM that the Directive did not apply to search logs.
"The Data Retention Directive applies only to providers of publicly available electronic communications services or of public communication networks and not to search engine systems," said Philippos Mitletton. Mitletton works for the European Commission's Data Protection Unit, which itself is represented on the Article 29 Working Party. "Accordingly, Google is not subject to this Directive as far as it concerns the search engine part of its applications and has no obligations thereof," he said.
