Feeds

EU data guardians: search engines must obey our rules

Which we will issue very soon now

Remote control for virtualized desktops

European gov data-privacy supremos have collectively said that search engines operating in their jurisdiction are governed by EU personal-data regs even if headquartered elsewhere.

The Article 29 Working Group, a committee of EU member state data protection chiefs, is expected to issue a full working paper on search engines "in the course of the next months".

However, after a meeting this week in Brussels, the group issued a short preliminary statement (pdf).

According to the assembled bureaucrats:

As the use of search engines becomes a daily routine for an ever growing number of citizens, the protection of the users’ privacy and the guaranteeing of their rights, such as the right to access to their data and the right to information as provided for by the applicable data protection regulations, remain the core issues of the ongoing debate.

Search engines fall under the EU Data Protection Directive 95/46/EC if there are controllers collecting users’ IP addresses or search history information, and therefore have to comply with relevant provisions. These provisions also apply to such controllers who have their headquarters outside the EU, but only an establishment in one of the EU Member States, or who use automated equipment based in one of the Member States for the purposes of processing personal data.

So essentially the only way for a search engine to avoid compliance with the EU regs is to have neither offices nor hardware in Europe. Most of the major search providers have at least some such footprint in EU territory.

IP addresses - particularly when times are logged - can be tied to locations and often to individuals, and as such can be viewed as personal information. Exact details of the compliance regime are expected to appear in the full report.

Google told AP that "we look forward to seeing [the Article 29 Group's] report". Microsoft apparently said that a way for companies to comply would be to remove IPs from stored data. ®

Beginner's guide to SSL certificates

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.