EC clarifies the applicable rules for search engines.
Art. 29 Data Protection Working Party clarifies the applicable rules for search engines :
“After having carried out a consultation of the main search engines the WP finally adopted the long-awaited opinion relative to the protection of personal data applicable to search engines on April 4th, 2008.
It endeavours to clarify the conditions of applicability of the European legal framework and it sets out the following recommendations :
- First of all, the WP stresses that the European rules of data protection apply to search engines, even if the headquarter is established in a country outside the European Union.
The WP considers that personal data registered by search engines must be erased as soon as possible, and after a 6-month period at the latest. In any event, Directive 2006/24/EC relating to the storage of traffic data does not apply to search engines; they do not have thus any legal obligation to store information concerning users traffic data, unlike Internet access providers for example.”
Google and MSN anonymise user data after 18 months, while Yahoo does the same after 13 months.
The report issued a set of obligations to search engines firms, including:
- Search engines should get informed consent from users if they correlate personal data across different services, such as desktop search
- Search engine providers must delete or anonymise (in an irreversible and efficient way) personal data once they are no longer necessary for the purpose for which they were collected
- In case search engine providers retain personal data longer than six months, they must demonstrate comprehensively that it is strictly necessary for the service
- It is not necessary to collect additional personal data from individual users in order to be able to perform the service of delivering search results and advertisements
- If search engine providers use cookies, their lifetime should be no longer than demonstrably necessary
- Search engine providers must give users clear and intelligible information about their identity and location and about the data they intend to collect store or transmit, as well as the purpose for which they are collected.
