Category: Yahoo!

The Article 29 Data Protection Working Party has apparently released [pdf] its “Opinion on data protection issues related to search engines.” It’s a very important decision and governs how search engines collect, process, use, and retain individual consumer information. It expands the discussion on why IP addresses and cookies are to be considered personal information as they relate to search. Search engine companies engaged in business in the EU will have to comply with this directive, which will include Google, Yahoo, MSN, etc.

Among the key findings [excerpts]:

“… search engines collect and process vast amounts of user data, including data gathered by technical means, such as cookies. Data collected can range from the IP address of individual users to extensive histories of past searching behaviour or data provided by users themselves when signing up to use personalised services… It is the opinion of the Working Party that search engines in their role as collectors of user data have so far insufficiently explained the nature and purpose of their operations to the users of their services.”

“…IP information as personal data… These considerations will apply equally to search engine operators.”
“When a cookie contains a unique user ID, this ID is clearly personal data. The use of persistent cookies or similar devices with a unique user ID allows tracking users of a certain computer even when dynamic IP addresses are used11. The behavioural data that is generated through the use of these devices allows focusing even more on the personal characteristics of the individual concerned.”

“Generally, search engine providers fail to provide a comprehensive overview of the different specified, explicit and legitimate purposes for which they process personal data. Firstly, some purposes, such as ‘improvement of the service’ or ‘the offering of personalised advertising’ are too broadly defined to offer an appropriate framework to judge the legitimacy of the purpose. Secondly, because many search engine providers mention many different purposes for the processing, it is not clear to what extent data are reprocessed for another purpose that is incompatible with the purpose for which they were originally collected.”

“Search engine providers that wish to provide personalised advertising in order to increase their revenues, may find a ground for the legitimate processing of some personal data in Article 7 (a) of the Directive (consent) or Article 7 (b) of the Directive (performance of a contract) but it is difficult to find a legitimate ground for this practice for users who have not specifically signed in based on specific information about the purpose of the processing. The Working Party has a clear preference for anonymised data.”

“If personal data are stored, the retention period should be no longer than necessary for the specific purposes of the processing. Therefore, after the end of a search session, personal data could be deleted, and continued storage therefore needs an adequate justification. However, some search engine companies seem to retain data indefinitely, which is prohibited. For each purpose, a limited retention time should be defined. Moreover, the set of personal data to be retained should not be excessive in relation to each purpose.

In practice, the major search engines retain data about their users in personally identifiable form for over a year (precise terms vary). The Working Party welcomes the recent reductions in retention periods of personal data by major search engine providers. However, the fact that leading companies in the field have been able to reduce their retention periods suggests that the previous terms were longer than necessary.

In view of the initial explanations given by search engine providers on the possible purposes for collecting personal data, the Working Party does not see a basis for a retention period beyond 6 months.”

“Persistent cookies containing a unique user ID are personal data and therefore subject to applicable data protection legislation. The responsibility for their processing cannot be reduced to the responsibility of the user for taking or not taking certain precautions in his browser settings. The search engine provider decides if a cookie is stored, what cookie is stored and for what purposes it is used. Finally, expiration dates of cookies set by some search engine providers seem to be excessive. For instance, several companies set cookies that expire after many years. When a cookie is used, an appropriate cookie lifetime should be defined both to allow an improved surfing experience and a limited cookie duration. Especially in view of the default settings of browsers, it is very important that users are fully informed about the use and effect of cookies. This information should be more prominent than simply being part of a search engine’s privacy policy, which may not be immediately apparent.

Anonymisation
If there is no legitimate ground for processing, or for use beyond the well-specified legitimate purposes, search engine providers must delete personal data. Instead of deletion, search engines may also anonymise data, but such anonymisation must be completely irreversible for the Data Protection Directive to no longer apply.

Even where an IP address and cookie are replaced by a unique identifier, the correlation of stored search queries may allow individuals to be identified. For this reason, where anonymisation rather than deletion of data is chosen, the methods used should be considered carefully and performed thoroughly. This might involve the removal of parts of the search history to avoid the possibility of indirect identification of the user who performed those searches.

Anonymisation of data should exclude any possibility of individuals to be identified, even by combining anonymised information held by the search engine company with information held by another stakeholder (for instance, an internet service provider). Currently, some search engine providers truncate IPv4 addresses by removing the final octet, thus in effect retaining information about the user’s ISP or subnet, but not directly identifying the individual. The activity could then originate from any of 254 IP addresses. This may not always be enough to guarantee anonymisation.”

“The Working Party finds that the correlation of personal data across services and platforms for authenticated users can only be legitimately done based on consent, after the users have been adequately informed… Finally, some search engine providers explicitly admit in their privacy policy that they enrich data provided by users with data from third parties, other companies that may for
example attach geographical information to ranges of IP addresses or websites carrying advertisements sold by the search engine provider24. This kind of correlation might be unlawful, if the data subjects are not informed at the time of collecting their personal data and if they are not granted an easy way of access to their personal profiles and the right to correct or delete certain elements that are incorrect or superfluous. If the processing in question is not necessary for providing the (search) service, the freely given, informed consent of the user would be required for lawful processing.”

“OBLIGATION TO INFORM DATA SUBJECT
Most internet users are unaware of the large amounts of data that are processed about their search behaviour, and of the purposes they are being used for. If they are not aware of this processing they are unable to make informed decisions about it.”

Here’s what DM (Direct Marketing) News reports, via excerpt:
“Microsoft, Google and AOL are getting ready to meet with New York assembly­man Richard Brodsky, a Demo­crat from Westchester County, to discuss a privacy bill that he is developing, which could have strong implications for the online advertising industry…Brodsky’s office is meeting with these Internet giants to discuss and help finalize the pro­posal, which was based in part on the best practice guidelines set by the Network Advertising Initiative, a group of online mar­keting and analytics companies. Yahoo met with the Assembly­man last fall…

The bill first came to life last June in response to Google’s offer to acquire DoubleClick, which, after a series of reviews, has been approved.

“Assemblyman Brodsky was not satisfied with the focus of privacy that the [Federal Trade Commission] was looking at and wanted to make sure that a big company like Google cannot track a consumer’s behavior and then target them with advertis­ing based on these ads,” Sopris [an aide to Bordsky] explained.

Google, Yahoo and Micro­soft did not return phone calls for comment. AOL declined to comment on the proposed bill until it meets with Brodsky.

The IAB is pushing for consumer and legislator education about how online ad­vertising technologies work and the ben­efits that it can have for consumers.

“While it claims to be looking out for consumers, this bill is not consumer friendly,” Zaneis [a lobbyist for the Interactive Advertising Bureau] said. “Advertising is the engine that drives the Internet today. It pays for free services and content for consumers.”

*****

PS from Digital Destiny: Here’s a link to email Assemblyman Brodsky. Don’t let the online ad companies erode your privacy rights.

270c ringtone motorola timeportconusumer acc creditpresident mp3 17th assholecoaster aceonline enthusiasts aceonline credits american151 mp3 rumc credit 1099hit ringtone up em 2pac cingular1930 mp3 orcestra Map

We are glad that the privacy officlals “over there” are going to help bring about some serious new policies (let alone informed discourse) on the “impact of new technologies” and privacy. On its 2008-9 work plan, is “ensuring data protection in relation to new technologies,” including “search engines, On-line social networks (especially for children and teenagers), Behavioural profiling, data mining (on-line or off-line), [&] digital broadcasting.” We expect that Working Party’s investigation will contribute to a serious public analysis of the threats to privacy from behavioral targeting.

It’s no secret that many U.S. companies are engaged in behavioral targeting in the EU. It’s time they were held accountable.

free teen gay moviesmovies interracial free pornfree movie downloads lesbianstreaming movies free pornhentai shemale moviesevans keisha moviesmovie kissing lesbianmovie lesbian porn Map

Via Dow Jones: “[Tim] Armstrong [Google’s North American president for advertising and commerce]…said Google has established engineering and sales teams dedicated to figuring out how to make money from advertisements on social networking sites…he said it became clear that user behavior on social networks was different than on traditional sites and the company has now carved out teams dedicated to monetizing those sites. “We now have a very clear path and direction for it,” he said.

Source: Google: To Be `Very Significant’ in Display Ads By ’08-’09. Scott Morrison. Dow Jones. March 120, 2008