EU Warns Google on User Data Records Kept Too Long, Privacy Officials Say

May 28, 10:30 AM

Current Headlines: By Kevin J. O'Brien and Thomas Crampton

In the latest example of a U.S. technology giant potentially being called on the carpet in Europe, Google has been warned that it may be violating European Union privacy laws by storing data on its users for up to two years. An advisory panel of data protection chiefs from the 27 EU countries sent a letter last week to the Internet search engine company asking Google to justify its policy of retaining data on Internet addresses and individual search habits, said Friso Roscam Abbing, a spokesman for European Union's justice commissioner, Franco Frattini.

Privacy experts said the letter was the first salvo in what could become a determined effort by the European Commission to force Google to change how it does business in the EU, whose 400 million consumers outnumber the U.S. population.

Any EU effort to impose limits on Google, which as a U.S.-based company operates under U.S. law, would be the latest in a series of aggressive actions taken by European policy makers to rein in global technology companies.

Frattini called the working group's query to Google "pertinent, appropriate and legitimate."

According to one member, who declined to be named because he was not authorized to speak for the group, the panel was concerned that Google's retention period was too long and is designed to serve commercial interests.

The data are often used to direct advertising to users.

"The discussion is only just beginning," said Christoph Gusy, a privacy law expert at Bielefeld University in Germany. "The pressure to regulate this type of business activity, which is still in its infancy, is building and what you are seeing is the beginning of a serious effort in Europe."

Google described the committee's request as reasonable. It noted that the company itself raised the issue with EU officials in March by announcing that it was shortening the retention of customer data, which had previously been unlimited, to up to two years.

Other large search engines like Yahoo have not disclosed how long they keep data on users.

"Our data retention practices vary according to the diverse nature of our services," Alex Laity, a spokesman for Yahoo, said in an e-mail message.

In a letter to be sent to the EU panel, Google will argue that the retention periods are necessary to ward off hackers and prevent Internet advertising fraud, and to improve Google's search algorithm, said Peter Fleischer, Google's global privacy counsel.

"There can be reasonable arguments for and against keeping server logs for this length of time," Fleischer said. "But we believe that between 18 and 24 months is a reasonable length of time to balance privacy issues with business concerns."

The panel plans to meet on June 19 in Brussels to consider Google's response.

The most prominent EU case against a U.S. technology giant focused on Microsoft, which the European Commission found in 2004 to have violated antitrust laws for using its de facto Windows operating system monopoly to promote its own server software and desktop media players.

Microsoft is appealing the commission's decision. The commission and EU competition officials have fined the company nearly $1 billion for failing to comply with the terms of its original order.

Some European nations are also challenging the operating practices of global technology companies, with success.

In Britain, eBay this year agreed to modify its servers after the information commissioner in Britain, Richard Thomas, complained that customers were not able to easily close accounts and wipe out trading logs.

Simon Davies, the director of Privacy International, an advocacy group based in London, said that Google was a leading target of complaints received by his organization last year.

Of the 10,000 complaints made to Privacy International in 2006, 2,000 involved Internet-related activities. And of those, 96 percent, Davies said, were about Google and its practice of retaining customer data.

"The EU's action is the first shot in a long, potentially bloody battle with Google," Davies said. How far EU officials can go to require Google to change its data retention policies remains unclear. The European Union's Data Retention Directive, which takes effect on Sept. 1, requires all telecommunications companies and Internet service providers to retain traffic data on users for periods of up to two years.

But EU law, according to Gusy, the German data retention expert, is silent on whether to apply the same limits, conceived to combat terrorism, to content providers or search engines like Google.

Abbing, the spokesman for the EU justice commissioner, said the commission could compel EU nations to enforce EU law.

How that could be used to challenge Google, whose business takes place largely in the virtual Internet universe, was unclear. The EU data retention panel member said his group was hoping with its letter to persuade Google to voluntarily lower its retention periods.

But Francois Bourdoncle, the chief executive of a French search engine, Exalead, said European countries had the right to impose their own standards on the collection of Internet data.

"I think it is fair for the state to place boundaries around what a company may do with your private data," Bourdoncle said. "We follow the very strict French privacy law that prevents us from storing any personal information that can be traced back to the individual."

International Herald Tribune * Thomas Crampton reported from Paris.

(c) 2007 International Herald Tribune. Provided by ProQuest Information and Learning. All rights Reserved.