More on Google and Privacy

Back in March, I was pleased when Google said that they intended to anonymise server logs. Records would be kept but user identification would be separated from the search data after a particular length of time, (except for the data of "opted in users" of Search History).

It struck me at the time that Google were attempting to live up to the "Do no evil" mantra. The particular length of time would be between 18 and 24 months after search execution.

Here in the EU the so called Article 29 Working Party asked Google to explain how the period of 18 to 24 months was proportionate under European data laws. Writing on the official Googleblog last Monday Peter Fleischer (Google Global Privacy Counsel) revealed their response and some further information.

Google believe that they have a legitimate interest in retaining search server logs for a number of reasons.

• to improve our search algorithms for the benefit of users
• to defend our systems from malicious access and exploitation attempts
• to maintain the integrity of our systems by fighting click fraud and web spam
• to protect our users from threats like spam and phishing
• to respond to valid legal orders from law enforcement as they investigate and prosecute serious crimes like child exploitation; and
• to comply with data retention legal obligations.

Additionally they announced a new policy, search server logs will now be anonymised after 18 months, but future data retention laws may obligate raising the retention period to 24 months. They also indicate that they intend to redesign cookies to reduce their expiration. Some observers might suspect that the change in policy is not much of a change at all. In plain English, 18 to 24 months is now 18 months (unless laws change somewhere); and one day we might change the life span of our cookies (if we can work out how to do it).

It's probably unfortunate that this statement came two days after Privacy International released their colour coded report. Google do care about issues of user privacy and are very aware of their responsibilities. Now they need to consider how they can best advertise their goal of improving user privacy protection. The words of a lawyer on the official Google blog may not be the best medium for this particular message.

Google is still trying to "do no evil", but is finding it harder to prove it. Conspiracy theorists will search out alternative search engines, informed digital natives will seek out proxy servers; the rest of us will just carry on living our digital life under the kindly panoptic gaze of Google and hope for the best.