Headline Feeds
An Opinion issued by the influential European Commission Article 29 Data Protection Working Party could have a major impact on the way search engines do business.
The group's recommendations include discarding personal search data after six months, giving consumers the right to see data that search engines have collected about them, and making Internet protocol addresses personally identifiable information.
The group's recommendations do not have the force of law -- but they could very well make their way into EU legislation.
"The impact will be significant," predicted Marc Rotenberg, executive director of the Electronic Privacy Information Center. "Over the last 10 years, we have had many instances where European privacy officials have pushed back against U.S. businesses and the government," he told the E-Commerce Times.
While the Article 29 Working Group is an independent advisory body, "it is still extraordinarily important," noted Pam Dixon, executive director of the World Privacy Forum.
"There is no equivalent to it in the United States," she told the E-Commerce Times. "Usually what they recommend gets put into law."
The Good Fight
If that should happen in this case, then Google (Nasdaq: GOOG) and other search companies will have to revamp many of their behind-the-scenes business processes to comply. First, though, there's likely to be a lot of hand-wringing, foot-dragging -- and most of all, fierce lobbying against the recommendations.
Indeed, it has already begun. In a blog post on Monday, Google attorney Peter Fleischer wrote, "We believe that data retention requirements have to take into account the need to provide quality products and services for users, like accurate search results, as well as system security and integrity concerns."
To be sure, there are legitimate competitive reasons why Google and other search engines may balk at implementing the recommendations.
For one thing, there is no appreciable difference -- assuming a system is secure -- between an 18-month hold period and a six-month hold period, pointed out Peter S. Vogel, a partner with Gardere.
Google may well challenge the arbitrary time frame, he told the E-Commerce Times, especially if it believes that keeping data for a shorter period will affect its competitiveness.
Another problem for Google is that it cannot clearly delineate a user in Europe from one in the United States, Vogel added, "so theoretically this recommendation could impact all users."
That is not necessarily a bad thing, in the view of privacy advocates. Nor is it an impossible mandate for search engines to meet. The search engine Ixquick, for instance, is already in compliance with the recommendations, Dixon noted.
"This paper was a very thoughtful, comprehensive approach to real privacy problems," commented EPIC's Rotenberg. "Until it was published, there had not been much serious discussion at this level on privacy in Internet searches."
The Opinion debunks a myth that EU data retention laws call for search engines to keep personal information for at least a year for law enforcement purposes. The recommendations make a point of stating that this is not the case.
Google is the author of this common misconception, according to Rotenberg. In a number of remarks on public forums, the company's representatives explained that Google was required to keep personal information on search requests in order to comply with EU law.
Google has made a number of other arguments relating to security issues and optimization of search technology -- many of which Rotenberg says are reasonable -- for maintaining such data.
IP Addresses Go Dark
Another provision in the Opinion that search engines will not like is the finding that IP addresses are personally identifiable information. This issue came up when the EC evaluated Google's DoubleClick acquisition, but that point was not definitively settled during the hearings.
Perhaps the most uncomfortable recommendation for the search engines will be the one that gives consumers access to the information being kept about their searches, WPF's Dixon said.
"They have a lot of profiling data on the consumer," she observed.
Outraged reactions to the level and depth of the data may indeed lead to more onerous regulations, Dixon suggested -- not to mention a backlash against using search technology.
Talkback: 
