The Article 29 Data Protection Working Party of the EU has turned its attention to the retention of search data by the search engine providers. It has put forward its opinion that all such data should be stripped of personally identifiable information after six months. It is now meeting to consider the replies of the industry, and negotiations are likely to go on for some months. The issue highlights the clash between commercial interests and personal privacy, and the difficulty of making privacy a competitive differentiator.
This question needs to be settled by compromise
If European governments try to enforce the working partys opinion they are likely to encounter a long legal argument over whether it is practical to implement it. Internet search engines are global operations that do not differentiate users in different countries. It would be technically difficult to operate multiple privacy policies. The most reliable indicator of where a user is located is their IP address, but IP address allocations do not fully adhere to national boundaries. For example, in the dispute between the French government and Yahoo over the advertisement of Nazi memorabilia in 2000, it was said that IP addresses gave 90% accuracy in determining whether a user was in France. However, if the issue were to be addressed on a European scale this accuracy would rise as borderline cases would be less significant.
The Article 29 Working Party consists of the data protection officials of the EU member states. Although it does not have any legal powers of its own, its members do have power to enforce data protection legislation in their own countries, and its opinions are based on legal argument. It is in dispute with the search engine companies over both the length of time that elapses before user search data is made anonymous and the effectiveness of the measures used to strip personal identification from the data at this time.
Google has about 80 per cent of the European search market and so its position is pivotal. By comparison, Microsofts Live Search has only 2 per cent. Microsoft has offered to implement the working partys recommendations in full but only if the other players also do so. It cites the need to be competitive as the reason for refusing to go it alone. At present it strips out the users name and email address immediately, but retains data relating a series of searches to the same entity for 18 months.
Users should vote with their mice
User pressure is the best way to change search company policy, but this is unlikely to happen while few users understand how their data is used. A search engine operator retains user search data for several reasons:
- to build a profile of each user so that it can make its responses to future queries more relevant to the users interests
- to use this same profile to target advertisements to users. All search engines rely on this revenue to pay for the service
- to detect click fraud and investigate complaints from websites about being charged for fraudulent clicks
- to detect other misuse of the search engine, such as denial of service attacks.
Sign up for Computerworld eNewsletters.