New Article 29 Working Party EU Rules on Search Engines: Protecting Privacy and Freedom

The Article 29 Data Protection Working Party has apparently released [pdf] its “Opinion on data protection issues related to search engines.” It’s a very important decision and governs how search engines collect, process, use, and retain individual consumer information. It expands the discussion on why IP addresses and cookies are to be considered personal information as they relate to search. Search engine companies engaged in business in the EU will have to comply with this directive, which will include Google, Yahoo, MSN, etc.

Among the key findings [excerpts]:

“… search engines collect and process vast amounts of user data, including data gathered by technical means, such as cookies. Data collected can range from the IP address of individual users to extensive histories of past searching behaviour or data provided by users themselves when signing up to use personalised services… It is the opinion of the Working Party that search engines in their role as collectors of user data have so far insufficiently explained the nature and purpose of their operations to the users of their services.”

“…IP information as personal data… These considerations will apply equally to search engine operators.”
“When a cookie contains a unique user ID, this ID is clearly personal data. The use of persistent cookies or similar devices with a unique user ID allows tracking users of a certain computer even when dynamic IP addresses are used11. The behavioural data that is generated through the use of these devices allows focusing even more on the personal characteristics of the individual concerned.”

“Generally, search engine providers fail to provide a comprehensive overview of the different specified, explicit and legitimate purposes for which they process personal data. Firstly, some purposes, such as ‘improvement of the service’ or ‘the offering of personalised advertising’ are too broadly defined to offer an appropriate framework to judge the legitimacy of the purpose. Secondly, because many search engine providers mention many different purposes for the processing, it is not clear to what extent data are reprocessed for another purpose that is incompatible with the purpose for which they were originally collected.”

“Search engine providers that wish to provide personalised advertising in order to increase their revenues, may find a ground for the legitimate processing of some personal data in Article 7 (a) of the Directive (consent) or Article 7 (b) of the Directive (performance of a contract) but it is difficult to find a legitimate ground for this practice for users who have not specifically signed in based on specific information about the purpose of the processing. The Working Party has a clear preference for anonymised data.”

“If personal data are stored, the retention period should be no longer than necessary for the specific purposes of the processing. Therefore, after the end of a search session, personal data could be deleted, and continued storage therefore needs an adequate justification. However, some search engine companies seem to retain data indefinitely, which is prohibited. For each purpose, a limited retention time should be defined. Moreover, the set of personal data to be retained should not be excessive in relation to each purpose.

In practice, the major search engines retain data about their users in personally identifiable form for over a year (precise terms vary). The Working Party welcomes the recent reductions in retention periods of personal data by major search engine providers. However, the fact that leading companies in the field have been able to reduce their retention periods suggests that the previous terms were longer than necessary.

In view of the initial explanations given by search engine providers on the possible purposes for collecting personal data, the Working Party does not see a basis for a retention period beyond 6 months.”

“Persistent cookies containing a unique user ID are personal data and therefore subject to applicable data protection legislation. The responsibility for their processing cannot be reduced to the responsibility of the user for taking or not taking certain precautions in his browser settings. The search engine provider decides if a cookie is stored, what cookie is stored and for what purposes it is used. Finally, expiration dates of cookies set by some search engine providers seem to be excessive. For instance, several companies set cookies that expire after many years. When a cookie is used, an appropriate cookie lifetime should be defined both to allow an improved surfing experience and a limited cookie duration. Especially in view of the default settings of browsers, it is very important that users are fully informed about the use and effect of cookies. This information should be more prominent than simply being part of a search engine’s privacy policy, which may not be immediately apparent.

If there is no legitimate ground for processing, or for use beyond the well-specified legitimate purposes, search engine providers must delete personal data. Instead of deletion, search engines may also anonymise data, but such anonymisation must be completely irreversible for the Data Protection Directive to no longer apply.

Even where an IP address and cookie are replaced by a unique identifier, the correlation of stored search queries may allow individuals to be identified. For this reason, where anonymisation rather than deletion of data is chosen, the methods used should be considered carefully and performed thoroughly. This might involve the removal of parts of the search history to avoid the possibility of indirect identification of the user who performed those searches.

Anonymisation of data should exclude any possibility of individuals to be identified, even by combining anonymised information held by the search engine company with information held by another stakeholder (for instance, an internet service provider). Currently, some search engine providers truncate IPv4 addresses by removing the final octet, thus in effect retaining information about the user’s ISP or subnet, but not directly identifying the individual. The activity could then originate from any of 254 IP addresses. This may not always be enough to guarantee anonymisation.”

“The Working Party finds that the correlation of personal data across services and platforms for authenticated users can only be legitimately done based on consent, after the users have been adequately informed… Finally, some search engine providers explicitly admit in their privacy policy that they enrich data provided by users with data from third parties, other companies that may for
example attach geographical information to ranges of IP addresses or websites carrying advertisements sold by the search engine provider24. This kind of correlation might be unlawful, if the data subjects are not informed at the time of collecting their personal data and if they are not granted an easy way of access to their personal profiles and the right to correct or delete certain elements that are incorrect or superfluous. If the processing in question is not necessary for providing the (search) service, the freely given, informed consent of the user would be required for lawful processing.”

Most internet users are unaware of the large amounts of data that are processed about their search behaviour, and of the purposes they are being used for. If they are not aware of this processing they are unable to make informed decisions about it.”

amateur wife stripperwomen squirting when cummingwomen pissing poopinganime hentai manga jpg gif girlsinterracial grannya website with girls pooping and peeingbbw facesitfree teen lesibian sex with no credit card on camsexy big bootty slutsinterracial mmf bi porninterracial cuckold sex storiesamature teen pantysmariam hairy moviesgrandpa fuckingclose up creampieshemales nudesanal insertion fistinglesbian bondage mangastiny teens.comteen lesbians humpingunderage bbs nudecollage girls anal fuckingbang bros tits and asshairy pussipreeteen analnonnude underage teensunderage porn pics bbshairy pusy – atkgirl peeing diapermisty lesbian hentaihuge swollen clitcheating picture stripper wifehairy underarms vaginayoung asian loli teennina hartley interracial pornfat granny nakedbbw lesbians free videonaked fat women bumswomen peeing in diaperslarge tits galleriesold fat grandmalesbian pissing galerysquirt cum in moms mouthlesbiens pissingasian teens xxxxtiny teens.comcuty having interracial sexrectal anal fuking big ass teensimpsons toon pornamature squirting womenmature women masterbationnami onepiece hentai flash gamefat old granny picsinterracial cuckold house wives movieshairy big clitfat wet cuntchubby mature escortstiny youg teensjapan xxx pissingwomen squirting milk picsunderage teen fuck picsebony free pussy picsass in tight jeans picslargest tits everasian speculum tgpbart simpson fucking lisa hardvideos gratis de tawneestonemmf interracial bisexual pornwwe divas wet nakedthe incredibles cartoon porntifa hentai clipskinny granny sexanal asian virgin teenhairy mariam mpegblacksonblondes interracialhairy pusy – atknepal model woman women nude porn sex girlnude underage asian girlsnepal model woman women nude porn sex girlvery hairy bushy hirsute pussyjosie atk hairynude hairy girlscomic toons winx club hentaiunderage teen russianinterracial deepthroat mpegsunderage teen girls nakedfree ebony xxx videodragonball pan hentaiinterracial cuckholddibujos hentaiclit masterbationbig naked assesnude men speedoslesbian scat girlnude futurama cartoonsmother fucks daughterfree sex stories, interracial breedingnaked fat grannies 60mature amature mpgshairy teen clithairy teen vagina photosnude whipped ass videosunderage nude teen girlshairy pusymariam hairy picsmature women tiny tits shaved cuntwomem fisting menfilipina ladies nudewomen squirting when cummingcollage girls anal fuckinghairy underarms vaginabeastiality asianfree lactating breastsinterracial biwhairy pusy pictureslady sonia – interracial sexfemale squirter galleriesmature creampie cuntshairy puissybig tity ebony girlskagome lesbiancollege fuck fest spring breakmature nudes in lingriequicktime video trailer interracial pornmatuer women pissingamateur swap wifeceleb nips tits photoscollege fuck fest video clipsebony girls squirting viginateen lesbians humpingbdsm chauefferinggirls peeing hidden tolite cam photojapanese sex mei sawaiasian school girl picsabby winters pissingkagome lesbiansex cartoons jetsonsfree nude asian girlsbbs asian upskirtdildo fuckerssquirting orgasm clipsinterracial cuckold sex storiesteen anal deflorationpissing shiting asiansfarm girl analinterracial milf dptawneestone fotos gratischeating white wives black cocknud chubby womeninterracial breedingunderage girls hairy pussyvideos gratis de tawneestoneinterracial bride fuckinterracial sex wives cuckoldfree hot asian sexinterracial wifejapan xxx pissingamateur wife share .ukasian nudeteenhairy pussy underageasian heshehairy spread cunt lipsfinal fantasy yuna hentaiwhipping stories of teen girlspreeteen analjasmine aladdin nude toonfree 80s interracial porndesi erotic storiesmen peeing outsideladies pissing in pantsskinny nude squirting womenhairy nudist galleriespictures of naked womens pusseyslactating pic squirting femalenami onepiece hentai flash gametranslated hentai comicssakura hentai galleryjapanese bbw picscuckold interracial sexdesi indian eroticanude underage teen girls blogsnaked fat women bumsfree pics of mature cunts spreadingpictures of pregnant womens naked privetsbeastiality creampienaked pussies gallarysbang bros tits and assyoungest nude girlsfree sylvia saint interracial gallerycartoon mom fucks sonmanila girls handjobflat chested teen photoslactating breasts eroticabig hairy vulvaunderage cock suckingfat granny fuckingtranslated hentai comicshairy tiavanudity in bollywoodfarm fuckingnudist girls peeingunderage teen girls naked

Author: jeff

Jeff Chester is executive director of the Center for Digital Democracy. A former journalist and filmmaker, Jeff's book on U.S. electronic media politics, entitled "Digital Destiny: New Media and the Future of Democracy" was published by The New Press in January 2007. He is now working on a new book about interactive advertising and the public interest.

Leave a Reply