The Article 29 Working Party has issued its opinion on search engine privacy, the BBC and CNET report. The recommendation takes a number of shots at Google’s business practices, and indeed those of the search industry as a whole. One position the working party took was expected – that IP address is personal information. Another is a development with widespread impact – that search histories and profiles, even without additional identifiers, are personal information.
The opinion clarifies some points about jurisdiction and non-EU based providers, and outlines a number of responsibilities of search providers, including:
- Delete or anonymize personal data (including IP addresses and search histories) after 6 months, or if retained for longer, retained for no longer than strictly necessary for declared purposes. Make data retention information should be clearly accessible from the home page.
- Other than such information that must be collected to provide the service, do not require additional personal data from users to perform a search.
- Minimize cookie periods to no longer than demonstrably necessary. Use Flash cookies only with transparent information about their use and control.
- Do not add data from third parties to existing profiles without consent.
- Give users rights to access, correction and deletion of data held about them, including profiles and search histories.
- Do not correlate data across services without informed consent.
The opinion also discusses a number of issues relevant to the indexing and caching of websites, and search providers’ responsibilities with respect to personal data that might be contained therein. The working party notes that providers of caching services can at some point become data controllers (and thus reqired to provide access, correction and deletion rights) if they retain the cache for longer than to resolve the issue of temporary inaccessibility of the website. An interesting question about this interpretation is, to what extent would it apply to caching for historical purposes, like the Wayback Machine?