Google limits the search data retention period

(Dieser Artikel ist auch in deutscher Sprache verfügbar)

After consultations with privacy groups in Europe and the US, Google has
decided to reduce to 18 – 24 months, the retention time for data related to
users and their searches.

Google is presently storing search information together with IP (Internet
Protocol) addresses which can be further on used to identify the person
behind a search. “When you search on Google, we collect information about
your search, such as the query itself, IP addresses and cookie details,”
said a Google blog post written by Peter Fleischer, the company’s privacy
lawyer in Europe, and its deputy general counsel Nicole Wong.

The company has announced that it will now limit this data retention period
by deleting the IP addresses related to searches after 18-24 months. The
search information itself will be still stored for as long as considered
necessary.

“(…)unless we’re legally required to retain log data for longer, we will
anonymize our server logs after a limited period of time. We will continue
to keep server log data but will make this data much more anonymous, so that
it can no longer be identified with individual users, after 18-24 months.”
said Fleischer and Wong.

This measure was considered by privacy advocates as a positive one. “It’s
the type of thing we have been advocating for a number of years” was Ari
Schwartz’s, deputy director of the CDT, statement to BBC.

Mr. Fleischer said that the company would keep the information for up to 24
months in order to be in agreement with the EU Data Retention Directive that
gave the member states mandate to pass laws that would force ISPs to retain
certain customer data for a period varying between 6 months and 2 years.

Privacy groups are still concerned about the fact that the data collected by
Google or other search engines or web companies could be used to monitor
people’s online habits.

Richard Clayton, a researcher at Cambridge University specialised in web
traceability, considers Google’s initiative as a good movement but still
insufficient as he considers that there is no real justification for
retaining the data for 2 years.

He believes that the company takes advantage of the European directive in
establishing the time limits to hold to the data and that the real reason is
actually a financial one related to the costs involved in anonymising the
searches.

“There is no sense of whether this directive even applies to web search
logs,” he said.

Google considers that by taking this measure it is “striking the right
balance between two goals: continuing to improve Google’s services for you,
while providing more transparency and certainty about our retention
practices,” as stated Fleischer and Wong. However they have also added that:
“In the future, it’s possible that data retention laws will obligate us to
retain logs for longer periods.”

Yahoo, on the other hand, stated it would keep the data for as long as the
EU directive requires but made no statement on what would happen after 24
months.

“We are reviewing the European Data Retention Directive as it comes into
force across Europe. Our services covered by the directive will comply with
the laws as they are enacted in each country that we have a presence.” was
Yahoo comment.

Taking steps to further improve our privacy practices (14.03.2007)
http://googleblog.blogspot.com/2007/03/taking-steps-to-further-improve-our.html

Privacy bodies back Google step (15.03.2007)
http://news.bbc.co.uk/1/hi/technology/6453137.stm

Google will delete search identifiers after two years (20.03.2007)
http://www.out-law.com/page-7888

Google Log Retention Policy FAQ (14.03.2007)
http://216.239.57.110/blog_resources/google_log_retention_policy_faq.pdf