Expiration date for search engines' user data


BRUSSELS -- Internet search engine providers such as Google and Yahoo must delete data taken from users after six months, even when they operate abroad, the European Union's privacy watchdog said.

The committee, known as the Article 29 Data Protection Working Party, called for stricter rules on user consent and data retention.

In a draft report issued following an extensive inquiry into data retention, the advisory body said: "Search engine providers must delete or irreversibly anonymize personal data once they no longer serve the specified and legitimate purpose they were collected for." It added that "the consent of the user must be sought for all planned cross-relation of user data, user profile enrichment exercises."

Google and Yahoo retain such data for as many as 18 months. But the panel, whose advice is usually followed by the European Commission, said that "if personal data is stored beyond that time, search engine providers will have to demonstrate comprehensively that it is strictly necessary for the service."

The panel also advised that collected data should be deleted at the end of a search session, and that the lifetime of "cookies" that track search history should not be longer than absolutely necessary.