6 months is enough, Article 29 Working Group tells search engines

The Article 29 Working Group of EC data protection commissioners has given an Opinion on the handling of personal data by search engines. The headline grabber so far has been the statement that search engines should retain personal data about users for no more than 6 months.

The Opinion follows the Working Group's requests to Google and other search engines last year for information about their data retention policies. According to a BBC News report:

"The report issued a set of obligations to search engines firms, including:

• Search engines should get informed consent from users if they correlate personal data across different services, such as desktop search
• Search engine providers must delete or anonymise (in an irreversible and efficient way) personal data once they are no longer necessary for the purpose for which they were collected
• Personal data should not be held by search engines for longer than six months
• In case search engine providers retain personal data longer than six months, they must demonstrate comprehensively that it is strictly necessary for the service
• It is not necessary to collect additional personal data from individual users in order to be able to perform the service of delivering search results and advertisements
• If search engine providers use cookies, their lifetime should be no longer than demonstrably necessary
• Search engine providers must give users clear and intelligible information about their identity and location and about the data they intend to collect store or transmit, as well as the purpose for which they are collected"

The dominant search engine Google, retains user personal data for 18 to 24 months, anonymising it after 18 months. Perhaps unsurprisingly, it has already criticised the Working Group's opinion on its Public Policy Blog.

The Article 29 Working Group's views on data retention periods at the search engines are also unsurprising, given the concerns it voiced last year about current periods being too long - see our August 2007 analysis of Google's data protection policies against the Working Group's comments.

Next steps

It's going to be interesting seeing how the Working Group and the various data protection authorities of individual EU jurisdictions take this forward. Google and the other search engines are highly unlikely to accept without a fight any request from data protection authorities to reduce their data retention periods. The Opinion's other "obligations" may receive a warmer reception.

The Working Group's Opinion certainly isn't the end of its battle with the search engines over their use of personal data. Expect more developments in the next year.