European gov data-privacy supremos have collectively said that search engines operating in their jurisdiction are governed by EU personal-data regs even if headquartered elsewhere.

The Article 29 Working Group, a committee of EU member state data protection chiefs, is expected to issue a full working paper on search engines "in the course of the next months".

However, after a meeting this week in Brussels, the group issued a short preliminary statement (pdf (http://ec.europa.eu/justice_home/fsj/privacy/news/docs/pr_18_19_02_08_en.pdf)).

According to the assembled bureaucrats:

As the use of search engines becomes a daily routine for an ever growing number of citizens, the protection of the users’ privacy and the guaranteeing of their rights, such as the right to access to their data and the right to information as provided for by the applicable data protection regulations, remain the core issues of the ongoing debate.

Search engines fall under the EU Data Protection Directive 95/46/EC if there are controllers collecting users’ IP addresses or search history information, and therefore have to comply with relevant provisions. These provisions also apply to such controllers who have their headquarters outside the EU, but only an establishment in one of the EU Member States, or who use automated equipment based in one of the Member States for the purposes of processing personal data.

So essentially the only way for a search engine to avoid compliance with the EU regs is to have neither offices nor hardware in Europe. Most of the major search providers have at least some such footprint in EU territory.

IP addresses - particularly when times are logged - can be tied to locations and often to individuals, and as such can be viewed as personal information. Exact details of the compliance regime are expected to appear in the full report.

Google told AP (http://ap.google.com/article/ALeqM5g08qkYTaNhLlscXKMnS3V8dkc-WwD8UV0R200) that "we look forward to seeing [the Article 29 Group's] report". Microsoft apparently said that a way for companies to comply would be to remove IPs from stored data. ®

Related stories

EU demands Google slashes cookie retention times (8 April 2008)
http://www.theregister.co.uk/2008/04/08/article29_search_privacy/
Children should get keys to their data when they come of age (18 March 2008)
http://www.theregister.co.uk/2008/03/18/child_data_protection_recommendation/
Can Microsoft teach tots digital-age virtue? (27 February 2008)
http://www.theregister.co.uk/2008/02/27/microsoft_ip_curriculum_look/
EC jacks up Microsoft fine by €899m (27 February 2008)
http://www.theregister.co.uk/2008/02/27/ec_fines_microsoft_largest_ever/
EU throws €5.5bn at embedded chips and nanotech (26 February 2008)
http://www.theregister.co.uk/2008/02/26/eu_joint_technology_initiatives/
Solicitors fined under Data Protection Act (22 February 2008)
http://www.theregister.co.uk/2008/02/22/lawyers_fined_4_data_breach/
Fraud guardian LifeLock accused of fraud (21 February 2008)
http://www.theregister.co.uk/2008/02/21/experian_sues_lifelock/
Home Office opens sex offender files in pilot scheme (18 February 2008)
http://www.theregister.co.uk/2008/02/18/home_office_violent_crime/
Secret printer ID codes may breach EU privacy laws (15 February 2008)
http://www.theregister.co.uk/2008/02/15/secret_printer_tracking_dots/
Euro privacy chief predicts Google policy flip (1 February 2008)
http://www.theregister.co.uk/2008/02/01/eu_google_privacy/
CCTV must not record conversations, warns new guidance (29 January 2008)
http://www.theregister.co.uk/2008/01/29/cctv_convo_recording/
Don't expect privacy law overhaul in the wake of HMRC (28 January 2008)
http://www.theregister.co.uk/2008/01/28/privacy_law/
EU debates privacy of IP numbers (22 January 2008)
http://www.theregister.co.uk/2008/01/22/eu_ip_numbers_personal/
Clarkson's 'steal my ID' stunt backfires (7 January 2008)
http://www.theregister.co.uk/2008/01/07/clarkson_bank_prank_backfires/
Info chief prescribes shock therapy for health dept (20 December 2007)
http://www.theregister.co.uk/2007/12/20/ico_doh/