March 14, 2007 3:07 PM PDT
Google adding search privacy protections
- Related Stories
Three workers depart AOL after privacy uproarAugust 21, 2006
AOL gaffe draws Capitol Hill rebukeAugust 9, 2006
AOL's disturbing glimpse into users' livesAugust 7, 2006
Judge: Google must give feds limited access to recordsMarch 17, 2006
Google to feds: Back offFebruary 17, 2006
(continued from previous page)
The lawsuit was later dismissed because AOL's user agreement requires lawsuits filed against it to be filed in its home state of Virginia, said Bankston.
Google said it can't anonymize the entire IP address, delete it altogether or anonymize any of it sooner than 18 months because it needs the data to analyze usage patterns and diagnose system problems. For example, Google uses the information for fraud detection and prevention and to combat denial of service attacks that can temporarily cripple or shut down servers. "Knowing what country a user is coming from helps us figure out whether or not we are delivering the right search," said Nicole Wong, deputy general counsel for Google.
Why wait 18 to 24 months?
The proposed timeframe for retaining the data in identifiable form was chosen because data retention laws in Europe require communications service providers to hold on to the information for that long, according to Wong.
If governments in various countries enact legislation to require communications service providers to archive Internet traffic for specific lengths of time including up to four years, as some are considering, Google would then have to abide by the laws, the company said. Law enforcement will still be able to subpoena server log data after it is anonymized, but every request will be considered on its merits and Google's response will depend on how narrow the request is and how relevant the data is to the investigation, Google said.
However, EPIC's Rotenberg said two years is that "top end" of the timeframe European governments are seeking for requiring communications service providers retain user data.
Google said it is making the changes in response to feedback from privacy activists and others, including the Norwegian Data Protection Authority with which Google executives met in January. A team of Google executives, engineers and lawyers were involved in establishing the new policy, Wong said.
Of all the major search engines, Google is the only one to publicly disclose that it has fought government efforts for consumer data. A year ago, Google challenged a subpoena received by the U.S. Department of Justice that ordered Google to hand over a random sample of a week's worth of search terms and one million Web pages from its index to aid in the Bush administration's defense of an Internet pornography law. One month later a federal judge sided mostly with Google and ordered the company to provide half of the amount of Web pages sought but none of the search queries.
The new policy would not have affected that situation because the government was not asking for searches tied to individual IP addresses, Wong said.
3 commentsJoin the conversation! Add your comment