Google offers glimpse at data collection
(AP)
Updated: 2005-10-18 21:43

Google Inc. is now disclosing more details on how it collects and uses data obtained from users, but it is remaining silent on several key questions that concern privacy advocates.

The company's new privacy policy, though little changed in substance from one issued 15 months ago, is easier to read and reflects Google's expansion beyond its core search engine business.

It also describes in greater detail what Google is doing to protect against abuses.

But it remains remains silent on how long information is kept. That's an area of growing concern as Google offers more and more services that potentially collect and store a wealth of personal data, making the company's servers a prime target for abuse by overzealous law enforcers and criminals alike.

The most material change is in format. The July 1, 2004, policy is replaced by a set of three statements: a full-length policy twice as long as the one it replaces, a "highlights" version and explanations in question-and-answer format.

"We regularly review our policy and update as necessary," Google associate general counsel Nicole Wong said Monday in an e-mail. "In this case, we were pleased to learn that the EU (European) Commission had embraced the concept of `layered notices' for privacy policies, emphasizing simplicity and clarity. We agree with that and modified our policies in a way that we hope is both clear and easy to understand for our users."

The new policy, issued Friday, states that Google may use personal information to display customized content and advertising, develop new services and ensure that its network continues to function. The practices aren't new but weren't explicit before.

And while the old policy says Google restricts access of such information to employees on a need-to-know basis, the new policy stresses that those individuals may be fired or criminally prosecuted for violations.

Google also reorganized its disclosures, bringing to the top details on information collected for e-mail, personalized search and other newer services that require registration.

The fact that information may be shared among services is also moved to the section describing the types of information collected.

Reflecting the fact that Google has been acquiring and partnering with more companies, the policy now includes language on affiliated companies and sites, though it did not specify what types of affiliates fall under those clauses.

"The affiliated sites may have different privacy practices and we encourage you to read their privacy policies," Google warns.

Chris Hoofnagle, senior counsel with the Electronic Privacy Information Center, said the changes do nothing to diminish his worries that Google is amassing "quite a trove of transactional and personal data" through its various services, which include e-mail, driving directions, photo-sharing, instant messaging and Web journals.

Because storage is cheap, data from these services can be retained practically forever.

Wong said Google could not set a general time limit on data retention because needs vary by service.

Danny Sullivan, editor of the industry newsletter Search Engine Watch, said that although Google can do more on disclosing how long it retains data, its rivals are also guilty of saying too little.