[Dabhand16]

Google cuts data retention times

Google is to cut the length of time it holds users' personal search data.
The move comes in response to a data protection group that wrote to the firm questioning its privacy policies.

The European advisory body, called Article 29, said Google's current data retention practices could be breaking European privacy laws.

The search giant has said it will now keep personally identifiable search data for 18 months rather than the previous period of 18 to 24 months.


We are committed to data protection principles that meet the expectations of our users in Europe and across the globe
Peter Fleischer, Google

Google currently collects and stores information from each search query, holding information about the search query itself, the unique PC address (known as an IP number), and details about how a user makes their searches, such as the web browser that is being used.

The company says it needs this information to improve its different services and to help fight threats such as fraud, spam and malicious attacks, and to aid "valid legal orders" from law enforcement agencies.

It keeps this information for a set period before "anonymising" it - disconnecting the data from an individual.

New policy

However, some are worried that this collected data from Google and other search engines may be infringing on civil liberties.

In May, working group Article 29, made up from data protection commissioners from around the EU, wrote to Google expressing particular concern over the length of time personally identifiable data was being retained on the company's servers.

It said the search engine's policy did not appear "to meet the requirements of the European legal data protection framework".

In a response to Article 29's letter, Google's global privacy counsel Peter Fleischer responded: "We are committed to data protection principles that meet the expectations of our users in Europe and across the globe."

He said that Google believed their current policy complied with data protection law, but admitted a shorter period of data retention than existed at present was possible.

Mr Fleischer wrote: "After considering the working party's concerns, we are announcing a new policy: to anonymise our search server logs after 18 months, rather than the previously-established period of 18 to 24 months."

He said that the company could still "address our legitimate interests in security, innovation and anti-fraud efforts" within the shorter period.

However, he added that "we also firmly reject any suggestions that we could meet our legitimate interests... with any retention period shorter than 18 months".

Article 29 has said it will "carefully study" Google's letter, and will discuss it at its next session taking place on 20 and 21 June.

Source: BBC