Even anonymized search records can be used. Or have we forgotten the recent AOL data breach, where anonymized search results were up for the public to grab. It was possible to determine for a number of those results to which person they belonged.

I don't think even 18 minutes is acceptable. They should just be a search engine and stop putting their users at risk under the guise of protecting them. Their old "do no evil" motto does not apply any more because now they've got share holders and money is the bottom line.

The gathering of information about their users is for the purpose of taking advantage of them. At their level , that's what sales and marketing is about. They are in a position of power and they are going to use that position for their own greed. Of course they like to make it sound like it is for other reasons by giving fear mongering examples such as "internet security and enforcement of child protection laws". That is not their job. I don't want to be held hostage by criminals, and I certainly don't want Google to help them do it. I for one won't be happy until they cut the retention of personal data down to system latency.

"To hear Fleischer tell it, Google is walking the razor-thin line between security, innovation and compliance on the one side and privacy on the other."

Yeh, they're in full on bullplop mode. Basically they continue to keep searches per IP address. They refuse to derive the search metrics they need immediately and discard the raw data. That data is personally identifiable, as the AOL case showed.

They are flat out in violation of EU privacy laws, but then they know it because their answers are misleading, hostile and evasive.

SOX has nothing to do with their searches, zero, zip, nada, that's an excuse. Alice in wonderland stuff.

Saying they need to keep the cookie to identify language preference, is also an excuse.

cookie: language = english

Doesn't require personally identifiable data.

It's not worth talking to them at this point, their answers and the sheer hostility to fixing the problem show a staggering contempt for the people they're talking too.

I'd remind you that this is yet another case of a need to give the EU Privacy body legal teeth. Because without those teeth, companies only pay lip service to these EU directives.

This is getting pretty crazy. Check out this guys huge list of Google Street View privacy invasions:

http://streetviewgallery.corank.com