Search Engines Must Delete Data Within Six Months

A European Commission advisory body on data protection has said that search engines should delete data held about their users within six months reports the BBC.

The proposed rule specifieds that "Search engine providers must delete or irreversibly anonymise personal data once they no longer serve the specified and legitimate purpose they were collected for."

Google and Yahoo anonymise user data after 18 months and MSN does the same after 13 months. The body said search companies were not "clear enough" on their data protection policy and the recommendation is likely to be accepted by the European Commission and could possibly lead to a clash with search companies. The recommendation could have broader implications such as getting user consent before serving them personalized advertisements.

Peter Fleischer, Google's global privacy counsel, said in a statement: "Google takes privacy incredibly seriously; protecting our users' privacy is at the heart of all our products. It is the reason we were the first company to commit to anonymising our search logs, and also why we dramatically shortened our preference cookie lifetime."

Search engines presently collect and store information every search query such as search term, IP address, browser type, time, and number of clicks. The search engines say this information it required to better serve the user. The advisory body said search engine providers had "insufficiently explained" why they were storing and processing personal data to their users and that personal data of users should not be stored or processed "beyond providing search results". The report also said search engines did not need to gather additional personal data, beyond the IP address of a machine being used, in order to deliver basic search results and advertisements.

The advisory body said, "Search engine providers mention many different purposes for the processing, it is not clear to what extent data are reprocessed for another purpose that is incompatible with the purpose for which they were originally collected". Thus search engines should not use personally identifiable data to improve their services or for accountancy purposes. Nor should personal data stored for security purposes be used to improve services and if search engines enriched personal data about users from third parties they could be breaking the law unless customers had given explicit consent. It said users should have the right to access, inspect and correct all the personal data about themselves held by search engines, including their profiles and search history.

The report issued a set of obligations to search engines firms, including:

• Search engines should get informed consent from users if they correlate personal data across different services, such as desktop search
• Search engine providers must delete or anonymise (in an irreversible and efficient way) personal data once they are no longer necessary for the purpose for which they were collected
• Personal data should not be held by search engines for longer than six months
• In case search engine providers retain personal data longer than six months, they must demonstrate comprehensively that it is strictly necessary for the service
• It is not necessary to collect additional personal data from individual users in order to be able to perform the service of delivering search results and advertisements
• If search engine providers use cookies, their lifetime should be no longer than demonstrably necessary
• Search engine providers must give users clear and intelligible information about their identity and location and about the data they intend to collect store or transmit, as well as the purpose for which they are collected