Article 29 Data Protection Working Party reacts to Google's reply to the Opinion on data protection issues related to search engines

In reaction to the opinion of the Article 29 Working Party on search engines, Google reaffirmed its wish to collaborate with European data protectionauthorities and announced that it will reduce its retention period to 9 months. But in substance, Google refuses for the moment to submit to the Europeandata protection law.
__________________

On April 4, 2008, the Article 29 Working Party published an opinion on search engines,reaffirming the applicability of the European data protection law, recommending a maximumretention period of 6 months and indicating that web users must be able to provide consent to the exploitation of their data in particular for profiling purposes.Google answered to this opinion on September 8, 2008, by reaffirming its interest for a better consideration of data protection. Two significant modifications were announced on thisoccasion:
1. From now on, IP addresses associated with the requests carried out on the searchengine will be anonymized after 9 months (instead of 18 as it is now the case) ;
2. A link to Google’s privacy policy appears on its homepage.

Alex TÜRK, Chairman of the Article 29 Working Party and the French Data Protection Authority (CNIL), takes note of this improvement with satisfaction. M. TÜRK also notes thecommitment of Google to collaborate with data protection authorities and its efforts to inform its users about data protection issues using clear and innovative tools.

However, he considers that strong disagreements remain. In particular, Google:
- considers that the European law on data protection is not applicable to itself, even though Google has servers and establishments in Europe;
- wishes to retain personal data of users beyond the 6 months period requested by the Article 29 Working Party, without any justification;
- does not make any improvement to its anonymization mechanisms, which are still insufficient;
- considers that IP addresses are confidential data but not personal data, which prevents granting certain rights to its users,
- does not express the willingness to improve and clarify the methods that are used to gather the consent of its users.

In conclusion, despite some progress, significant work must still be carried out to guarantee the rights of internet users and to ensure the respect of their privacy. In this perspective, theArticle 29 Working Party will lead hearings with Google to discuss the points of dissension.

For the press release, go to: http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_16_09_08_en.pdf
For more on EU data protection, go to: http://ec.europa.eu/justice_home/fsj/privacy/news/index_en.htm