Google announced earlier
this year that it would anonymise search engine logs after between
18 and 24 months, later reducing that period to 18 months. It had
previously kept the link between searches and the IP address of a
user indefinitely.
Though it was increasing the privacy protections afforded to
users, Google was criticised by data protection officials for
keeping the link between searches and a user's identity for as long
as 18 months.
Google's competitors have now said that they will change their
retention policies as well, and have called for industry consensus
on the issue. Microsoft and Ask.com have together called on the
search industry to create communal safeguards for user data.
Microsoft and Ask.com want academics, companies and activists to
jointly create guidelines on the duration for which user behaviour
can be saved. They want a single, standardised approach to replace
individual privacy policies.
"This is all about trust," said Peter Cullen, a chief privacy
strategist for Microsoft. "It's in the interest of the companies,
it's in the interest of consumers."
Microsoft said that it would match Google's pledge to anonymise
search logs after 18 months, while Yahoo! announced a cut off point
of 13 months. Ask.com said that it would produce a tool that would
allow users to delete their search history at any time.
When Google became the first major search engine to volunteer
the anonymising of data it gave the issue a higher than ever
profile. The company was attacked by privacy watchdogs in Europe
who said that the firm must conform to data protection
standards.
The Article 29 Working Party is a committee of Europe's data
protection officials which wrote to Google's global privacy counsel
Peter Fleischer after his announcement of the change.
"The Article 29 Working Party considers a reduced storage period
for server logs generated by the users of Google services as a
valuable step to improve Google's privacy policies," said the
letter. "However, it is of the opinion that the new storage period
of 18 to 24 months on the basis indicated by Google thus far, does
not seem to meet the requirements of the European legal data
protection framework."
The EU's Data Retention Directive says that countries must soon
pass laws mandating the retention of telecoms data for between six
and 18 months. Google claimed that this means that they must keep
search logs for that long.
The Article 29 Working Party, though, said that it believed that
the Directive does not apply to search logs.
Technology law podcast OUT-LAW Radio
revealed earlier this month that Fleischer rejected the Working
Party's opinion.
"Remember the Data Retention Directive comes out of the security
side of government, not the data protection side," said Fleischer.
"So it's interesting to me to hear what an official from the data
protection world thinks about data retention, but it's like asking
somebody who works for the railroad what they think of airline
regulation. It's just not their field."
