Google data privacy concerns linger

Letter from EU working group is made public as search firm admits its policy is 'vague'

Google: keeps search information for 18-24 months

The letter sent by European Information Commissioners to Google saying that its new privacy policies appear to breach the requirements of the EU’s data protection regime has been published.

The news comes as Google's global counsel, Peter Fleischer, admitted on BBC News yesterday that Google's privacy policy on sharing information with third parties is 'vague'.

'There is a constant process of trying to be clear with language and improve notices. We ought to be able to do better than that now that you have drawn my attention to that particular clause,' said Fleischer, referring to a clause on third-party information sharing.

Previously, Google operated a policy of retaining search queries and identifying information, such as Internet Protecol (IP) addresses, for as long as it thought useful.

In March, Fleischer announced a new policy saying that the company will keep its server log data but will make that data more anonymous, so that it can no longer be identified with individual users, after 18 to 24 months.

In response a letter of concern was sent to the search giant on 16 May by the Article 29 Working Party, an independent European advisory body on data protection and privacy.

The letter says: 'Although Google's headquarters are based in the United States, Google is under legal obligation to comply with European laws, in particular privacy laws, as Google's services are provided to European citizens and it maintains data processing activities in Europe, especially the processing of personal data that takes place at its European centre.

'The Article 29 Working Party… is of the opinion that the new storage period of 18 to 24 months on the basis indicated by Google thus far, does not seem to meet the requirements of the European legal data protection framework.'

The letter goes on to say that the Article 29 Working Party is concerned that Google has so far not sufficiently specified the purposes for which server logs need to be kept, as required by Article 6(1)(e) of Data Protection Directive 95/46/EC.

The letter also raises concerns about the cookie that Google stores on the computers of visitors who do not use their browser settings to block these small text files that allow Google to recognise a return visit from a particular computer.

Google will also announce a new initiative today - the firm will launch Google Gears, an open-source technology for creating offline web applications.