Privacy and Search Engines like Google: Opinion of Art. 29 Working Party

The Working Party set up pursuant to Article 29 of Directive 95/46/EC on data protection has issued an interesting opinion on the privacy issues raised by search engines like Google or Yahoo.

You can find the opinion ("WP 148") here.

Part of the executive summary reads as follows:

"In this Opinion the Working Party identifies a clear set of responsibilities under the Data Protection Directive (95/46/EC) for search engine providers as controllers of user data. As providers of content data (i.e. the index of search results), European data protection law also applies to search engines in specific situations, for example if they offer a caching service or specialise in building profiles of individuals. The primary objective throughout the Opinion is to strike a balance between the legitimate business needs of the search engine providers and the protection of the personal data of internet users.

This Opinion addresses the definition of search engines, the kinds of data processed in the provision of search services, the legal framework, purposes/grounds for legitimate processing, the obligation to inform data subjects, and the rights of data subjects.

A key conclusion of this Opinion is that the Data Protection Directive generally applies to the processing of personal data by search engines, even when their headquarters are outside the EEA, and that the onus is on search engines in this position to clarify their role in the EEA and the scope of their responsibilities under the Directive. The Data Retention Directive (2006/24/EC) is clearly highlighted as not applicable to search engine providers."

The conclusion that Directive 95/46/EC applies to the processing of personal data by search engines outside the EU needs looking at more closely and is likely to be controversial.

Comments

[Atika]

Search engines should take care of security primarily as negligence of this can prove harmful for their users.