News 

A group of data protection commissioners from across the European Union found that web addresses and cookie monitoring are personal information that search services should do more to protect.

The long-anticipated set of recommendations for how European data protection laws should be applied to web search services was published on Friday.

The report by the so-called Article 29 Working Party calls for increased user notification and warns web search services that fail to do so may be unlawful.

"It is the opinion of the Working Party that search engines in their role as collectors of user data have so far insufficiently explained the nature and purpose of their operations to the users of their services," the report states.

"The Working Party does not see a basis for a retention period beyond 6 months," the study concludes.

Peter Fleischer, Google's global privacy counsel, says his company disagreed with key findings in the report and argued that privacy policies must be balanced

ADVERTISEMENT

against efforts to make web services easier to use.

"We believe that data retention requirements have to take into account the need to provide quality products and services for users, like accurate search results, as well as system security and integrity concerns," Fleischer writes on the company's blog.

The EU report specifically challenges the defence by saying arguments about improving services may conceal other uses that go beyond the original reasons the data was collected.

The Google official also took issue with the Article 29 Working Party's finding that IP addresses should be treated as personal information, with the full weight of data protection laws.

"Based on our own analysis, we believe that whether or not an IP address is personal data depends on how the data is being used," Fleischer claims. Google has previously argued the issue is not black and white, in part because ISPs often allot the same IP address to many users.

The length of time search companies retain user data has become something of a bidding war among the search engines in recent years. Last year, Google shortened the period it held user-identifiable data from two years to 18 months. Yahoo keeps user data for 13 months, while Ask goes a step further by offering a set of tools for users to scrub their data stored from Ask computers.