Unpacking privacy issues: the all knowing search engine

In this article, senior associate Heidi Leslie and law clerk Nick Laing take a look at the very topical issue of privacy and service providers on the internet in light of the European Union's recently released report which offers an opinion on the collection of personal data by search engines.

Picture yourself sitting in front of your PC. You're about to Google your long lost great-great-grandfather. Have you ever stopped to consider what Google does with your query – outside of just finding another genealogical megasite for you?

The truth is, every time you use a search engine like Google, it retains your search history, along with your internet protocol (IP) address. What's more, search engines crawl through the internet compiling information about people – like your long lost great-great-grandfather, making information easier to find, but at the same time creating a "profile" of that person.

Search engines are essential tools for all manner of personal and professional activities, but unbeknownst to many of us they fulfil several roles. They are collectors of information as well as content providers. When you look into it, the amount of information stored by search engines is a bit creepy.

It is undisputed that their first role to the user is as a service provider – being there to find data from websites after the user enters a search command. In the process, they collect vast amounts of data from that user, including IP addresses, search histories using what are known as "cookies", and personalised data that the user submits when subscribing to personalised services such as iGoogle.

Recently, internet provider AOL made the search records of 658,000 of its internet users available over a three month period to researchers. Unfortunately, even though the records had been anonymised, media organisations were able to trace some of the users by name. Needless to say, this was unpopular with the users. A recent survey from the Info-Tech Research Group in London, Ontario, notes that 60% of respondents to a survey are uncomfortable with websites customising content to personal profiles.

Search engines' role as content providers is to bring content to the user. Search engines crawl, analyse and index the web and other sources to make them searchable and more easily accessible. In the process search engines come across personal information about internet users posted on websites, and store that information in a cache. Later republication of this data may pose problems, particularly when a search engine can draw data about a person from many different sources, some of which may be inaccurate or skewed toward certain biases based on popular posts online.

The main concern about the aggregation feature is that it can significantly affect individuals if the personal data in the search results is incorrect, incomplete or excessive. This can lead to the "profiling" of the user by third parties, including incorrect profiling – potentially breaching a person's privacy rights bv disclosing that information to the next user who searches their name.

In addition, search engines use search logs. This allows them to monitor and improve the functioning of the services and the user experience. But they also use them to provide targeted advertising. The most recognisable form of this is the Google AdSense programme, which presents advertisements to the right of the search box that relate to the search command entered. More in depth advertising programmes, known as "behavioural targeting", collect significantly more information over an extended period of time, including data on age, sex, geographic location and occupation, to target their advertising at particular demographics. Such advertising allows the use of the search engine to be free. But freedom can come at a cost to personal privacy however, with personal data being collected, stored and used by advertisers without the user's awareness or consent.

The European Union's opinion

In 1995, the European Union (the EU) adopted a directive over the retention of personal "user data" by companies across the EU and the European Economic Area. A report entitled "Opinion on data protection issues related to search engines" released last month (April 2008) offers an opinion on the collection of personal data by search engines.

Looking at the collection and retention of personal data by search engines, the report notes a fundamental imbalance between the reasonable expectations of internet users to privacy on the one hand, and the multiple functions of search engines that are not well understood.

The central issue is the degree of awareness by internet users about these functions. The report says that most internet users are unaware of the large amounts of personal data collected by search engines (including their IP address), and the purposes for which it is being used. Consequently, without such awareness, they are unable to make informed decisions about whether to provide it or not.

The future of online privacy

In the light of the report, search engines in the EU will be likely to refine their procedures for informing users and gaining their consent to use their information, as well as limiting the time that they retain personal data for. They will also be likely to improve their policies for notifying users about the information that they retain and for what purpose it is collected for.

The report will no doubt be read with interest by the New Zealand's Privacy Commission as part of its four stage review of the law of privacy in New Zealand. In its first study paper, published in January this year, the commission began an analysis of the current state of the law, and established the framework for the later stages of its review. How much influence the EU report might have when the commission examines the Privacy Act itself in stage four of the review is eagerly anticipated.

This article was first published in the Dominion Post, 2 May 2008.

Enquiries and information

For more information on any of the cases, articles and features in Commercial Quarterly, please email Diane Graham or call her on 64 9 916 8849.