The European Commission's data protection findings
Monday, April 7, 2008
Today, a Google search is far more likely to provide you with the information you're looking for than it did a few years ago. This has not happened by accident. It is the result of our engineers painstakingly analysing the patterns in our server logs to improve the relevance of our searches. At the same time, we have developed privacy policies designed to give users choices over the information they share with us.
Against this backdrop, the European Commission's Article 29 Data Protection Working Party -- named after the rules they are monitoring –- has been conducting a lengthy inquiry into the question of online privacy. While the working party has welcomed our decision to anonymise data logs after 18 months as a positive privacy protective step, it suggested in findings released today that this period might still be too long.
We believe that data retention requirements have to take into account the need to provide quality products and services for users, like accurate search results, as well as system security and integrity concerns. We have recently discussed some of the many ways that using this data helps improve users' experience, from making our products safe, to preventing fraud, to building language models to improve search results. This perspective -- the ways in which data is used to improve consumers' experience on the web -- is unfortunately sometimes lacking in discussions about online privacy.
The Working Party's findings also stated that IP addresses should be treated as personal information, with the full weight of data protection laws. Based on our own analysis, we believe that whether or not an IP address is personal data depends on how the data is being used.
The findings are another important step in an ongoing dialogue about protecting user privacy online – a discussion in which Google will continue to be engaged. It's also a debate in which we hope our users will participate.
As for saving our search data, how does it help by knowing who it came from? And I do think there should be more protections for your IP address, and i think that goes for whoever is using them, not just your ISP.
ReplyDeleteUnfortunately, it is necessary to save all of the search data for longer than the EC suggests. It is used to protect against all kinds of unwanted traffic, such as click fraud and index dictionary attacks.
ReplyDeleteI know the data is useful to development, marketing and ad placement but why not just do what Ask.com has done and allow users to scrub their data? It would certainly address the EU concerns.
ReplyDelete>>> Today, a Google search >>> is far more likely to >>> provide you with the >>> information you're
ReplyDelete>>> looking for than it
>>> did a few years ago.
please let the user decide if that's true or not, i as a user for myself don't see ANYthing alike, search results are as bad or even worse as they always were since altavista came into existence ...
>>> As for saving our
>>> search data, how
>>> does it help by
>>> knowing who it came
>>> from
bearclaw has made the point here, which directly leads me into believing that there's AGAIN something else lurking behind these allegations about "better user experience" or whatever you call it in different situations. my suspicion is: all you want is our data, as much as you can get, if possible ALL data and you're going to store it FOREVER the purpose of it being to just HAVE it in case there's any idea what to do with it later. i don't trust google. if there's anything i can do to help stop this juggernaut, i will.
Personally I believe that the EU is looking for powder wherever there is money behind.
ReplyDeleteOn one hand , it is true that Google and other Institutions keep lots of our information, ranging from IP, habits, e-mails, medical records, etc etc., but it is also true that this info is necessary to accomplish the user’s goal of finding what they are looking for, as easy as it may be. Other objectives for having this info are possible, but we do not know specifically.
The EU has successfully tried to collect Billons from big American Companies. I believe that most part of the times their enormous economic requests go far beyond the EU ‘s consumers. It is also true that similar request to European companies are not very much known. Without going far back in time, the EU paid to a person, for stolen information regarding people’s backing information. This attitude does not match their prayers.
On the other hand, each of us is constantly skimmed on what we do and were we go. Using the cell phone allows companies to know where we are and whom we call. Each Credit Card transaction is the same. Each time we pass customs, we are requested to place a finger, take a pictures etc. etc. An these requirements not only involve the EU, but the US too.
In short, what is the EU complaining, since every big institution y collecting our information !!!!!. and we the individuals can do anything in order to avoid it.
I don't understand like how Google stores information that identifies the individual and network address. If location is crucuial for searches, why can't Google store information as "city, country" instead of by IP address? My suspicion is that Google's stance on this issue is mainly based on protecting its advertising revenue - advertising clicks. By knowing the IP address Google can identify exactly who's "clicking" and help protect against fraud.
ReplyDeleteI think Google needs to only keep IP information on users who click, and not on peope who don't, like me :o)
@r32argent,
ReplyDeleteFor G to store city and country info, they first have to get it, which is not so easily determinable. IP addresses, generally speaking, map to registry information. A bit more work can give the location of a datacenter where the IP address (or block) may be served. But it is much more difficult to determine the actual location of the computing device that actually viewed a page or clicked on a link. Furthermore, that information would be very difficult to reliably and trustworthily communicate to G. For more information, see this geolocation paper.
why doesn't the EU give users the opportunity to have their data used for a longer period if that improves the quality of their searches?
ReplyDeleteWe can contest the effectivity of the anonimization... Deleting the last numbers of the IP is not necessary sufficient when you still have 18 month of data including the full IP.
ReplyDeleteAnother point is interresting. You said that the data were needed to garantuee the security of your network. it is true, but in France for example, you can not merge the treatments concerning security and direct marketing. This are 2 different ojectives which need 2 different treatments.
You wrote : "The Working Party's findings also stated that IP addresses should be treated as personal information, with the full weight of data protection laws"
ReplyDeleteWhereas n° 26 of the directive 95/46/CE says : "to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person"
The FAI for example is the "any other person to identify the said person".
Wheras are not liable for the states. So, in France, the 26th whereas has been introduce and the IP is a personal data. In england, we just look after the means used by the controller and not a third person, IP is not a personal.
This misunderstanding about the objet of law is not a good thing for google and for the clients.
In a decision C-101/2001, 6 nov. 2003, Lindqvist, JOCE 10 janv. 2004 C 7/3 the court says a telephone number is a personal data.... Very near form an IP ^_^
In the decision C275-06, 29 janv. 2008, Promusicae, JOCE 8 mars 2008, C 64/9 the court says the name and the IP are personal data... But the real question is for the IP alone, and on the court did not answer.
If IP is finally qualify as a personal data, new specific regulations should be voted to reduce the heavy consequences of that interpretation.
Johannes wrote :"why doesn't the EU give users the opportunity to have their data used for a longer period if that improves the quality of their searches?"
ReplyDeleteFor example, in China the state use those data for politic repression. Google or the other internet giants can not refuse if the law of the country says they should transmit the data. In europe, a lot persons died during the 2nd WW because of the use of the personal data collected by ste states.
It is nonsense when google states IP addresses of searches are to be stored in order to prevent click-fraud. Worst thing is that they labelled it fraud but it is not: If the google site involves people not being allowed to click on arbitrary links any number of times, it ought to say so that this is forbidden.
ReplyDeletegoogle itself created the possibility to "misuse" its own advertisement system and then uses this to claim exemption from the law! Nobody granted google this right either, they just took it! It sounds to me like building a road which is connected to the public with no signs on it that one is not to travel on it.
Of course, google is perfectly able to fix the problem, but at a cost, namely, to annoy users that they surrender their right to privacy any time they steer to the google site. It is this price that google doesn't want to incur...
If you would ask me google has to abide by the privacy laws which existed in Europe long before it existed. If google wants to be exempt from the law, we need real reasons to do so. That's true for any company. It is time that google becomes a responsible company and comes to terms with the deficiencies of its own technology.