Google Limits Data Retention in Compromise with EU
Google is scaling back how long it keeps personally identifiable data accumulated from its Web users, seeking to mollify a European Union watchdog that has questioned its privacy policies.
The world's top provider of Web search services said late Monday that it is ready to curtail the time it stores user data to a year-and-a-half, the low end of an 18 to 24 month period it had originally proposed to regulators in March.
But Peter Fleischer, Google's global privacy counsel said in a letter addressed to the Article 29 Data Protection Working Party in Brussels that any regulatory requirement to keep data for less than 18 months would undermine Google's services.
"After considering the Working Party's concerns, we are announcing a new policy: to anonymize our search server logs after 18 months, rather than the previously established period of 18 to 24 months," he said in the letter dated June 10. The server logs refer to software that stores Web search histories.
"We believe that we can still address our legitimate interests in security, innovation and anti-fraud efforts with this shorter period," Fleischer added.
Google is seeking to ease the concerns of regulators in Europe and the United States, as well as a small, but vocal, chorus of privacy activists, who see the scope of Google's Web services as posing unprecedented threats to consumer privacy.
Each time a Google user searches the Web, the company gathers information about that customer's tastes, interests and beliefs that could potentially be used by third parties such as advertisers. Google shares general user statistics but is adamant it never shares personal data outside the company.
The European Union body, made up of national protection supervisors of the bloc's 27 member states, said in May that Google seemed to be failing to respect EU privacy rules and asked for clarification before its next meeting in mid-June.
Google has sought to take the lead in defining a global standard for rules governing online retention of consumer data. Other household Internet names -- including Amazon.com , AOL, Apple, eBay, Microsoft and MySpace -- have yet to disclose any limits on how long they retain consumer data, according to a recent report by Privacy International.
Thinking Up a New Cookie Recipe
In the May letter, the Working Party also expressed concern about the length of time Google retains Web surfing tracking data known as "cookies" and other details on users' searches.
Google said it was studying how it can meet the concerns of European regulators over cookies, a widely-used consumer tracking technology that Web sites rely on to customize what users see and advertisers use to target ads.
"We are exploring ways to redesign cookies and to reduce their expiration," Fleischer states. "We plan to make an announcement about privacy improvements for our cookies in the coming months.
In his six-page letter, Fleischer details the trade-offs involved in limiting how long Google stores its users' data before "anonymizing" it, industry lingo that refers to the cleansing of computer databases of personal information.
The Google privacy official notes that the national data retention policies of individual European nations vary from six months to 24 months, depending on the country.
Meanwhile, the U.S. Department of Justice has called for a 24-month data retention period, he notes. And post-Enron corporate reforms call for U.S. businesses to retain data for substantial periods.
Google's aim is to seek out a single agreed-upon level of privacy protection to users worldwide. Fleischer underscored that it is "extraordinarily difficult" to operate a global Internet business according to different national standards.
Google has more than 60% of the world's Web search business, market research groups estimate.
A preliminary report released over the weekend by Privacy International of London accused Google of being the most hostile to data protections of any major Internet company, a charge that the company is seeking aggressively to rebut. (Additional reporting by Ingrid Melander in Brussels)