EU scrutinizing Google's data retention policy

By Kevin O'Brien and Thomas Crampton
NY TIMES NEWS SERVICE , BERLIN
Monday, May 28, 2007, Page 9

Google been warned that it may be violating EU privacy laws by storing search data from its users for up to two years, the latest example of a US technology giant whose practices face a collision with European standards.

An panel of data protection chiefs from the 27 countries in the EU sent a letter last week to Google asking it to justify its policy of retaining data on Internet addresses and individual search habits, Friso Roscam Abbing, a spokesman for EU Justice Commissioner Franco Frattini, said on Friday.

Privacy said the letter was the first salvo in what could become a determined effort by the European Commission to force Google to change how it does business in Europe, whose 400 million consumers outnumber those in the US.

Any to impose limits on Google, which operates under US law, would be the latest in a series of increasingly aggressive actions taken by European policy makers to rein in global technology firms.

Frattini the working group's query to Google "pertinent, appropriate and legitimate," Abbing said.

According to one member, who spoke on the condition of anonymity because he was not authorized to speak for the group, the panel is concerned that Google's retention period is too long and is designed to serve commercial interests. The data is often used to direct advertising to users.

"The discussion is only just beginning," said Christoph Gusy, a privacy law expert at the University of Bielefeld in Germany. "The pressure to regulate this type of business activity, which is still in its infancy, is building, and what you are seeing is the beginning of a serious effort in Europe."

Google the committee's request as reasonable. It noted that the company itself raised the issue with European officials in March by announcing that it was shortening the retention of customer data, which had previously been unlimited, to up to two years.

Other search engines like Yahoo and MSN Search have not disclosed how long they keep data.

`REASONABLE' PERIOD

"There can be reasonable arguments for and against keeping server logs for this length of time," said Peter Fleischer, Google's global privacy counsel. "But we believe that between 18 and 24 months is a reasonable length of time to balance privacy issues with business concerns."

In a letter to be sent to the EU panel, Google will argue that the retention periods are necessary to ward off hackers and prevent Internet advertising fraud, and to improve Google's search algorithm, Fleischer said.

The panel plans to meet on June 19 in Brussels to consider Google's response.

The most prominent European case against a US technology giant focused on Microsoft, which the European Commission found in 2004 to have violated antitrust laws for using its de facto monopoly Windows operating system to promote its own server software and desktop media players. The company settled a similar case with US antitrust regulators in 1994.

Microsoft appealing the commission's decision. In the meantime, the commission and European competition officials have fined the company nearly US$1 billion for failing to comply with the terms of its original order.

Some European nations are also challenging the operating practices of global technology companies, with success. In Britain, eBay this year agreed to modify its service after British Information Commissioner Richard Thomas complained that customers were not able to easily close accounts and wipe out trading logs.

Simon Davies, the director of Privacy International, a London-based advocacy group, said that Google was a leading target of complaints received by his organization last year.

Of the 10,000 complaints made to the group last year, 2,000 involved Internet-related activities. And of those, 96 percent were about Google and its practice of retaining customer data, Davies said.

PROTRACTED BATTLE

"The EU's action is the first shot in a long, potentially bloody battle with Google," he said. "There is definitely a perception that something is amiss with Google."

How far European officials can go to force Google to change its data retention policies remains unclear.

The EU's Data Retention Directive, which takes effect Sept. 1, requires all telecommunications companies and Internet service providers to retain traffic data on users for up to two years.

But European law, according to Gusy, the German data retention expert, is silent on whether to apply the same limits, which are intended to combat terrorism, to content providers or search engines.

Abbing the commission could compel members to enforce the law.

How that could be used to challenge Google, whose business takes place largely in the Internet universe, was unclear. The data retention panel member said his group was hoping with its letter to persuade Google to voluntarily narrow its retention periods.

But Francois Bourdoncle, the chief executive of the French search engine Exalead, said European countries had the right to impose their own standards on the collection of Internet data.

"I think it is fair for the state to place boundaries around what a company may do with your private data," Bourdoncle said.

"We follow the very strict French privacy law that prevents us from storing any personal information that can be traced back to the individual," he said.

Bourdoncle that the growing range of services offered by Google and other portals posed an increasing threat to privacy.

"By offering services from e-mail to search, they can easily build a complete profile of your entire digital life," he said. "It is worrisome how much they can know simply by correlating all the information they collect on you."

Yahoo to comment on the working group but said user trust is of high importance to the company.

Alex Laity, a spokesman, said Yahoo does not have a single policy on the issue.

"Our data retention practices vary according to the diverse nature of our services," he said in an e-mail message.

Fleischer that his company was the first of its kind to voluntarily cut retention periods, not just in Europe but around the world.

"We started this privacy dialogue precisely because we think it is something that needs to be further discussed," he said.