ARTICLE 29
DATA
PROTECTION WORKINGPARTY
Unofficial final version
04.04.2008
This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body ondata protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 15 ofDirective 2002/58/EC.The secretariat is provided by Directorate C (Civil Justice, Rights and Citizenship) of the European Commission,Directorate General Justice, Freedom and Security, B-1049 Brussels, Belgium, Office No LX-46 06/80.Website:http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm
/08/ENWPOpinion on data protection issues related to search engines
Unofficial final version
04.04.2008
-
2
-
Table of contentsEXECUTIVE SUMMARY.................................................................................................31. INTRODUCTION.......................................................................................................42. DEFINITION OF A "SEARCH ENGINE" AND BUSINESS MODEL....................53. WHAT KIND OF DATA?..........................................................................................64. LEGAL FRAMEWORK.............................................................................................74. 1. Controllers of user data...........................................................................................74.1.1. The fundamental right - respect for private life.................................................74.1.2. Applicability of Directive 95/46/EC (Data Protection Directive).....................84.1.3 Applicability of Directive 2002/58/EC (ePrivacy Directive) and Directive2006/24/EC (Data Retention Directive)....................................................................124.2 Content providers....................................................................................................134.2.1. Freedom of expression and right to private life..............................................134.2.2 Data Protection Directive.................................................................................135. THE LAWFULNESS OF PROCESSING................................................................155.1. Purposes/grounds mentioned by search engine providers.................................155.2. Analysis of purposes and grounds by the Working Party.................................165.3. Some issues to be solved by industry................................................................196. OBLIGATION TO INFORM DATA SUBJECT.....................................................227. RIGHTS OF DATA SUBJECT................................................................................238. CONCLUSIONS.......................................................................................................24ANNEX 1 – EXAMPLE OF DATA PROCESSED BY SEARCH ENGINES &TERMINOLOGY..............................................................................................................27ANNEX 2..........................................................................................................................28
Unofficial final version
04.04.2008
-
3
-
EXECUTIVE SUMMARY
Search engines have become a part of the daily life of individuals using the Internet andinformation retrieval technologies. The Article 29 Working Party recognises theusefulness of search engines and acknowledges their importance.In this Opinion the Working Party identifies a clear set of responsibilities under the DataProtection Directive (95/46/EC) for search engine providers as controllers of user data.As providers of content data (i.e. the index of search results), European data protectionlaw also applies to search engines in specific situations, for example if they offer acaching service or specialise in building profiles of individuals. The primary objectivethroughout the Opinion is to strike a balance between the legitimate business needs of thesearch engine providers and the protection of the personal data of internet users.This Opinion addresses the definition of search engines, the kinds of data processed inthe provision of search services, the legal framework, purposes/grounds for legitimateprocessing, the obligation to inform data subjects, and the rights of data subjects.A key conclusion of this Opinion is that the Data Protection Directive generally appliesto the processing of personal data by search engines, even when their headquarters areoutside the EEA, and that the onus is on search engines in this position to clarify theirrole in the EEA and the scope of their responsibilities under the Directive. The DataRetention Directive (2006/24/EC) is clearly highlighted as not applicable to searchengine providers.This Opinion concludes that personal data must only be processed for legitimatepurposes. Search engine providers must delete or irreversibly anonymise personal dataonce they no longer serve the specified and legitimate purpose they were collected forand be capable of justifying retention and the longevity of cookies deployed at all times.The consent of the user must be sought for all planned cross-relation of user data, userprofile enrichment exercises. Website editor opt-outs must be respected by searchengines and requests from users to update/refresh caches must be complied withimmediately. The Working Party recalls the obligation of search engines to clearlyinform the users upfront of all intended uses of their data and to respect their right toreadily access, inspect or correct their personal data in accordance with Article 12 of theData Protection Directive (95/46/EC).
THE WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITHREGARD TO THE PROCESSING OF PERSONAL DATA
set up by Directive 95/46/EC of the European Parliament and of the Council of 24October 1995
1
,
1
Official Journal no. L281 of 23/11/1995, p. 31, available at:http://europa.eu.int/comm/internal_market/en/media/dataprot/index.htm
Search History:
Result 00 of 00
00 results for result for
p.
More From This User
Notes
Load more
