EU's Next Global Target: Google Company May Violate Privacy Laws By Storing User Data

May 27, 08:59 AM

Current Headlines: By Kevin J. O'Brien and Thomas Crampton

Thomas Crampton reported from Paris.

*

In the latest example of a U.S. technology giant potentially being called on the carpet in Europe, Google has been warned that it may be violating European Union privacy laws by storing data on its users for up to two years. An advisory panel of data protection chiefs from the 27 EU countries sent a letter last week to the Internet search engine company asking Google to justify its policy of retaining data on Internet addresses and individual search habits, said Friso Roscam Abbing, a spokesman for European Union's justice commissioner, Franco Frattini.

Privacy experts said the letter was the first salvo in what could become a determined effort by the European Commission to force Google to change how it does business in the EU, whose 400 million consumers outnumber the United States.

Any EU effort to impose limits on Google, which as a U.S.-based company operates under U.S. law, would be the latest in a series of increasingly aggressive actions taken by European policy makers to rein in global technology companies.

Frattini called the working group's query to Google "pertinent, appropriate and legitimate."

According to one member, who declined to be named because he was not authorized to speak for the group, the panel was concerned that Google's retention period was too long and is designed to serve commercial interests.

The data are often used to direct advertising to users.

"The discussion is only just beginning," said Christoph Gusy, a privacy law expert at Bielefeld University in Germany. "The pressure to regulate this type of business activity, which is still in its infancy, is building and what you are seeing is the beginning of a serious effort in Europe."

Google described the committee's request as reasonable. It noted that the company itself raised the issue with EU officials in March by announcing that it was shortening the retention of customer data, which had previously been unlimited, to up to two years. Other large search engines like Yahoo and MSN Search have not disclosed how long they keep data on users.

"There can be reasonable arguments for and against keeping server logs for this length of time," said Peter Fleischer, Google's global privacy counsel. "But we believe that between 18 and 24 months is a reasonable length of time to balance privacy issues with business concerns."

In a letter to be sent to the EU panel, Google will argue that the retention periods are necessary to ward off hackers and prevent Internet advertising fraud, and to improve Google's search algorithm, Fleischer said.

The panel plans to meet on June 19 in Brussels to consider Google's response.

The most prominent EU case against a U.S. technology giant focused on Microsoft, which the European Commission found in 2004 to have violated EU antitrust laws for using its de facto Windows operating system monopoly to promote its own server software and desktop media players. U.S. antitrust authorities had a similar case, but it was settled in 1994.

Microsoft is appealing the commission's decision. In the meantime, the commission and EU competition officials have fined the world's largest software maker nearly $1 billion for failing to comply with the terms of its original order.

Some European nations are also challenging the operating practices of global technology companies, with success.

In Britain, eBay this year agreed to modify its servers after the information commissioner in Britain, Richard Thomas, complained that customers were not able to easily close accounts and wipe out trading logs.

Simon Davies, the director of Privacy International, an advocacy group based in London, said that Google was a leading target of complaints received by his organization last year.

Of the 10,000 complaints made to Privacy International in 2006, 2,000 involved Internet-related activities. And of those, 96 percent, Davies said, were about Google and its practice of retaining customer data.

"The EU's action is the first shot in a long, potentially bloody battle with Google," Davies said. "There is definitely a perception that something is amiss with Google."

How far EU officials can go to require Google to change its data retention policies remains unclear. The European Union's Data Retention Directive, which takes effect on Sept. 1, requires all telecommunications companies and Internet service providers to retain traffic data on users for periods of up to two years.

But EU law, according to Gusy, the German data retention expert, is silent on whether to apply the same limits, which were conceived to combat terrorism, to content providers or search engines like Google.

Abbing, the spokesman for the EU justice commissioner, said the commission could compel EU nations to enforce EU law.

How that could be used to challenge Google, whose business takes place largely in the virtual Internet universe, was unclear. The EU data retention panel member said his group was hoping with its letter to persuade Google to voluntarily lower its retention periods.

But Francois Bourdoncle, the chief executive of a French search engine, Exalead, said European countries have the right to impose their own standards on the collection of Internet data.

"I think it is fair for the state to place boundaries around what a company may do with your private data," Bourdoncle said. "We follow the very strict French privacy law that prevents us from storing any personal information that can be traced back to the individual."

Bourdoncle said that the growing range of services offered by Google and other search portals present an increasing threat to privacy.

"By offering services from e-mail to search, they can easily build a complete profile of your entire digital life," Bourdoncle said. "It is worrisome how much they can know simply by correlating all the information they collect on you."

Yahoo declined to comment on the working group.

Alex Laity, a spokesman, said Yahoo does not have a single policy on the issue.

Fleischer of Google noted that his company is the first of its kind to voluntarily cut retention periods, not just in Europe but around the world.

"We started this privacy dialogue precisely because we think it is something that needs to be further discussed," he said.

(c) 2007 International Herald Tribune. Provided by ProQuest Information and Learning. All rights Reserved.