Google data retention policy battered by EU

Davey Winder
Tuesday, 09 September 2008 19:51

Your IT - Home IT

It looks like Google has caved in to the growing pressure from the EU to reduce the amount of time it retains personal search data. Actually, it is more of an avalanche than anything else...

When it comes to privacy issues, Google has been badly bruised in the last couple of years. Much of the verbal media battering coming as a result of its policies over data retention.

Personal search data retention and anonymisation to be specific. A little over a year ago Google gave way a little and announced it would reduce the storage before anonymisation period from 24 months to 'just' 18 months.

Hardly surprising that this did little to satisfy the privacy watchdogs and activists. After all, that's a whole year and a half where search data is connected to the IP addresses within server logs before that connection is broken and the data properly anonymised.

The in April, the EU Article 29 Working Body recommended that Google, and other search engines, should not hold this data for any longer than six months.

This EU data protection advisory body made a point of writing to Google and directly questioning the privacy practise and policies it has.

The response it got was not enough, and they went on record to say that Google had no sufficiently explained the requirement for storing and processing personal search data for so long.

Then, in July, we had the notorious 'All your YouTube viewing data are belong to us' controversy after a judge order Google to hand over server logs containing the personal data of millions of YouTube users to Viacom.

Finally, it would seem, Google has had enough of the bad press and decided to move a little further along the road to doing the decent thing. It is now going to cut the storage period before anonymisation of personal search data by half to nine months.

This, apparently, being as a result of understanding that user privacy is fundamental to earning and keeping user trust.

Well, duh!

The next fundamental step will be explaining, in terms non-marketing droids can understand, just why it needs to keep IP data, search queries and related information in a way that identifies the user at all.

And I am afraid that the usual rubbish about improving services and fighting terrorism will not do...