Google's data dilemma

Human rights campaign organisation Privacy International recently placed Google at the bottom of its privacy rankings. In a survey of major internet organisations, including Microsoft, Wikipedia and MySpace, PI found “numerous deficiencies and hostilities in Google’s approach to privacy”.

The report points to the diversity of Google’s product range and its market dominance, which enables the company to extract a good deal of information about the online habits of its users. For example, search strings were stored for up to 24 months, while personal information about hobbies, employment and more is accessible to Google via profiles created in community site Orkut, says PI.

Use of the Google Toolbar for searches is also reckoned to enable the company to track users. Criticism is not just confined to Google - the PI report describes privacy standards of key industry players as “appalling” and calls on them to improve their privacy performance.

User data is very valuable to websites, in that it helps them target advertising more effectively, as well as improve the quality of the service offered. For example, Google can better personalise user search results if it knows the user’s surfing habits. And with tens of millions of pages in the Google database, speed and relevance of response are of paramount importance, as searchers could become overwhelmed by the sheer mass of data available.

Nevertheless, privacy campaigners are still worried about the amount of personal data Google can extract and a working party of the European Information Commissioners recently wrote to the company asking why it holds on to data for up to two years.

In response, Google’s global privacy counsel Peter Fleischer said server logs would be anonymised after 18 months, rather than the previous 18 to 24 months.

“We believe that we can still address our legitimate interests in security, innovation and anti-fraud efforts with this shorter period,” said Fleischer in a letter to the working party. “However, we must point out that future data retention laws may obligate us to raise the retention period to 24 months.”

- Retaining data

At a basic level, Google’s servers record page requests made when visiting its sites. Information such as your browser type, IP address, the date and time of the request is logged. If you click on a link, such as a search result or advert, that information may also be logged. And if you sign up for a Google Account, your profile, including name, email address, password and whatever else comprises that profile, will also be stored.

The company line is that retaining data enables Google to improve search algorithms, defend its systems from malicious access, fight fraud and spam, and comply with legal obligations, such as responding to legal orders from law enforcement agencies. Google has, however, objected to certain subpoenas, such as the US Department of Justice’s attempt to demand the disclosure of two months’ worth of searches in August 2006.

- Arguments against

However, rights campaigners point to the fact that commercial companies devote a lot of effort to mining personal data in order to create new business opportunities. There’s also the fear that government agencies could demand user data from companies in order to snoop on people. A UN report last December warned that the increasing use of personalised web pages, such as those requiring login information, could lead to a rise in identity theft.

Privacy International is campaigning for meaningful privacy protection, but accepts that a meeting is necessary to discuss existing practices to find out how customer data is being used. As such, PI is inviting companies to attend a conference in San Francisco this summer to work towards an accord on privacy.

The EU also has its concerns, one of which is Google’s use of cookies. The Google cookie, a file used to store information on the local computer, goes beyond what is “strictly necessary” for the provision of the service, said an EU working party member in a letter to the company.

- The next steps

The EU’s Article 29 Working Party has asked Google to take heed of the Resolution on Privacy Protection and Search Engines, adopted last year. It says that search engine providers shall not record any information about a search that can be linked to users or about the search engines themselves, adding that at the end of a session, no information should be stored about the user unless consent has been given.

But Google says that it cannot meet its obligations in terms of innovation, security and fraud prevention with a data retention period of less than 18 months. As for cookies, the company is trying to find ways to redesign them to reduce their expiration time without forcing users to have to re-enter basic preferences.

www.google.co.uk
www.privacyinternational.org