Google Gives an Inch in EU Privacy Tiff

Under pressure from the European Union's Data Protection Working Party, search giant Google (Nasdaq: GOOG) said it will "anonymize" its search server logs after 18 months. However, Google also stressed it will never alter the data sooner than 18 months after its creation and will comply with laws that could require it to retain the information for up to two years.

"We believe that we can still address our legitimate interests in security, innovation and antifraud efforts with this shorter period," wrote Google's privacy counsel Peter Fleischer in an e-mailed letter to the Article 29 Data Protection Working Party in Brussels, Belgium. The group, a privacy watchdog, has criticized Google's privacy policies, contending the company appeared to be violating EU privacy rules.

Earlier this year, Google -- again answering concerns about its data retention policies -- announced it would anonymize server logs 18 months to 24 months after their creation. The logs contain information about Web search history gathered from people using Google. The data can be useful to advertisers and to Google as it tries to improve the quality of search results, but privacy advocates fear the information can be exploited.

A Big Know-It-All

Earlier this week, Privacy International, a London-based privacy advocacy group, ranked Google as the worst in protecting customer privacy out of a field of nearly two dozen major Internet-based companies. Google acknowledges sharing general user statistics but insists it never provides outsiders with personally-identifiable data.

Search logs aren't the only data being questioned by the EU. In May, the Working Party expressed concern for Google's use of "cookies" to track customers' search habits and other propensities. The EU was particularly concerned about the length of time Google retained cookie data.

"We are considering the Working Party's concerns regarding cookie expiration periods, and we are exploring ways to redesign cookies and to reduce their expiration without artificially forcing users to re-enter basic preferences such as language preference," wrote Fleischer in his response. "We plan to make an announcement about privacy improvements for our cookies in the coming months."

Still Testing the Anonymizer

In March, Google explained that anonymizing the logs entails changing some of the bits in the IP (Internet protocol) address in the logs as well as the cookie information. "We're still developing the precise technical methods and approach to this, but we believe these changes will be a significant addition to protecting user privacy," said the company.

It explained that changing the bits of an IP addresses and cookies makes it "less likely" that IP addresses can be associated with specific computers or users.

World According to Google

Google's continual innovation into ways to personalize Web-based computing has privacy implications that the company is obliged to address, said Ben Edelman, a computer privacy expert and assistant professor at Harvard Business School.

"As we all come to rely on Google for more and more services, it's natural to expect Google's privacy promises to be that much more impressive," he told TechNewsWorld. "When Google was just a search engine, we could write off Google's privacy consequences as limited to search. But when Google indexes users' hard drives, stores e-mails, and even hosts documents and spreadsheets, it matters that much more what Google knows."

Even if the company is not as bad as Privacy International contends, there seems to be growing public opinion that it's become an all-knowing Big Brother. "I share the general sense that there's more Google could do to earn and deserve users' confidence on privacy issues," said Edelman.

Pros and Cons

Data retention is a double-edged sword, noted Google. Governments and businesses are obliged to retain information. "It's extraordinarily difficult to operate a global Internet service according to different privacy standards in different countries. Thus, the discussion regarding the right retention period is in fact a global discussion," Fleisher pointed out in his letter.

Google is walking a tightrope, said JupiterResearch analyst Barry Parr.

"Speaking as a person who deals in data, I can understand the temptation to hang on to everything you collect because you might need it some day, especially for a company like Google, which knows how to do amazing things with large data sets," he told TechNewsWorld. "However, I also believe that loss of control of our personal information is a serious public policy issue in the U.S. I hope that at some point Google comes to realize that hanging on to this information is like keeping a loaded gun in an unlocked nightstand. It gives them a feeling of security, but they may come to regret it in the long run."

Privacy International criticized Google for having "an attitude to privacy ... that at its most blatant is hostile, and at its most benign is ambivalent." However, it noted Google's competitors have little room to boast since most track user behavior.