EU strikes a blow against data hoarding
Posted: Friday, April 11 at 05:00 am CT by Bob Sullivan
Have you ever wondered why companies that collect your personal information seem to keep it forever? The European Union is wondering too.
European privacy officials published an opinion last week (in PDF format) that could have far-reaching impacts on data hoarding, stating that search engines must delete consumer information within six months.
In humans, hoarding can be a sign of mental illness. Victims feel compelled to keep everything they have, and their homes end up crowded to the rafters with piles of papers, knickknacks and other personal affects kept indefinitely "just in case." I’ll bet you know a hoarder.
Use that image to imagine what computer servers look like inside a 21st century company that collects personal information about you. Supermarkets, toll collection authorities, even retailers seem to be addicted to data, and can't seem to bring themselves to ever throw anything out. Exhibit A: TJ Maxx. When hackers broke in to the clothing retailer’s system last year, they found driver’s license data that had been saved for five years!
The opinion published by the European Data Protection Working Party, a part of the European Commission, may change all that in Europe. It's at least a shot across the bow at data hoarding companies. While the opinion is specifically directed at search engines, it could open a wider debate over what the industry calls “data retention” policies
Data should be kept "no longer than necessary," the report says. Then, it defines the time frame. "In view of the initial explanations given by search engine providers on the possible purposes for collecting personal data, the Working Party does not see a basis for a retention period beyond 6 months."
What they know about you
Major search engines like Google, Yahoo and MSN can construct highly detailed profiles of users with seemingly innocuous information. A simple list of search queries, for example, is often enough to glean a Web surfer's location, tastes, habits, and sometimes their name. Even when users never log in and don't provide their name, their searches can be catalogued using their IP address. Because of that, The Privacy Working Group also said in its opinion that IP addresses should be considered personal information, and should be covered by data privacy laws.
Search engines have already cut the time they hang on to personal information to about 12 to 18 months, according to privacy consultant and former Microsoft Chief Privacy Officer Richard Purcell. Nevertheless, the Working Party opinion is a "big deal," he said. It’s unclear when or if it will have the force of law – the Working Party has published an interpretation of the EU Data Privacy Act, but any attempt to enforce the opinion would certainly meet a spirited legal defense.
Special report: Privacy Lost
Still, to avoid potential conflict, the search engines may start deleting or “anonymizing” huge amounts of data. That could be costly and could also hurt efforts to provide targeted ads to Web surfers.
Marketing consultant Alan Chapell, who advises Web firms on data collection, said he’s concerned that the search engine ruling is arbitrary and impractical.
“In a lot of respects this is an academic argument,” he said. “I’m struggling with the question: Where’s the harm?” Whether Google keeps search data 6 months, 9 months, or 12 months seems inconsequential to most people's privacy, he said.
Search engines are often at the center of Web privacy debates. The "Google Earth" project, which gives map browsers a chance to see recent photographs of areas around the world, has been under a microscope recently after a Pennsylvania couple sued over privacy concerns. A recent parody of Google's invasive behaviors became a YouTube phenomenon.
'We have it, we keep it'
At least the search engines are talking about privacy. Many other firms we interact with every day haven't even put the issue on the table. Supermarkets collect data about us when we thoughtlessly swipe our loyalty cards at checkout counters; electronic toll booths track our driving habits. Credit reporting agencies and other data collectors, like ChoicePoint, hoard information about us and hang on to it indefinitely.
"They all have a set policy, which is ‘we have it, we keep it,’" Purcell, who runs Corporate Privacy Group, said. "That's wrong. ... If (they) don't have a demonstrable reason for keeping it, keeping it around just in case isn't good enough."
Alessandro Acquisti, a privacy expert at Carnegie Mellon University, said he’s glad European authorities are trying to turn privacy protections into law. But he’s concerned that U.S. firms won’t feel the need to address the retention issue any time soon.
“I do think that data should only be kept for a known and limited amount of time,” he said. “(But)
my cynical view is that in the self-regulated American approach, corporations correctly realized that the issue of retention, while critical, may not be so ‘visible’ or clear to individuals, and therefore (they) could get away by doing away with limiting the length of data retention.”
That’s why it’s high time we openly discussed "data expiration" in the United States. Companies have a terrible pack rat habit; they should delete our information when it’s no longer necessary for them to keep it for the reason we gave it. It's reasonable that TJ Maxx collects driver’s license data when customers return items in an attempt to combat fraud; but after six months, the fraud checking is over and the data should be erased.
No E-ZPass for me
I refuse to sign up for E-ZPass and other electronic toll tools, which costs me quite a bit of time waiting to give my money to human toll collectors. In some states, I am charged a 25 percent premium for my refusal. Friends tease me each time I sit at a long toll booth line and watch cars sail through the express lanes. I tell them I would happily sign up for E-ZPass and its ilk if I were assured that my car would be tracked only long enough for the toll road to take my money.
It's an obvious and reasonable rule we need to impose on entities that collect our information -- take only what you need, use it only for what you said, and keep it only as long as necessary. That's the rule the EU Data Privacy Working Group is trying to force upon search engines. It shows a decidedly different approach in Europe than the U.S. -- companies there that collect information and keep it longer than six months will have to "demonstrate comprehensively that it is strictly necessary."
It's time the rest of the Web, and in fact, all data collectors, were held to the same, reasonable standard.
Fake Craigslist ads a big headache
EMAIL THIS
TRACKBACKS
Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/t/trackback/454638/27988104
advertisement
BUY BOB SULLIVAN'S NEW BOOK
Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.
Syndicate this site
RSS is an easy way to get the news you want as it is updated even if you are not on MSNBC.com. More information about MSNBC.com's RSS feeds.
More consumer news
Consumer Man, aka Herb Weisbaum, exposes scams and answers questions
It would be great to see such reasonable restrictions put on US operations, but I doubt we ever will. The first (and only) authorization for private concerns to collect and maintain data was credit reporting, which was (and is iirc) limited to credit relationships. In recent years, as credit reports have been used for everything else, this distinction has blurred. I am willing to bet that we will never see these restrictions since it allows large volumes of data to be collected, which can then be selectivly requested by government agencys when they see the need. From this twisted logic, it makes sense to retain the data since one never can tell what records might show the next terror cell (an attempt to show justification that I dont personally believe but).
Don, Onaway, MI (Sent Apr 11, 2008 9:05:28 AM)
Hear hear, go EU, go EU!
In the Netherlands, any entity collecting personal information is subject to the privacy watch dog (CBP), that is pretty particular and has very good rules on what a company can keep and what not.
Now you can whine about evil government regulation, but the fact is that ID theft *does not exist* in the Netherlands (except for "re-use" of stolen ID documents such as passports and driver's licenses).
(Sent Apr 11, 2008 9:35:20 AM)
It's about time someone realized that this data hoarding is dangerous to say the least.
We pay for a service to be provided to us, not the other way around, I hope that the EU goes further and makes it a serious criminal offense to hoard data and attaches severe civil liability laws as well.
Pat (Sent Apr 11, 2008 9:57:12 AM)
The European Data Protection Working Party is not addressing the most important point - consent. The amount of time that data is retained a minor point compared to the fact the average person has no clue about which enities are collecting their personal data. After individuals can only opt-in to data collection, can the consumer vote by asking colloectors about their controls and safeguards and refuse to do business when the polices - including retention periods are unreasonable. Only when adequate data safeguards become a competitive advatage will the public see improvement.
Florence, KY (Sent Apr 11, 2008 10:31:05 AM)
Finally! I have been arguing with the powers that be at my company on this point for years.
(Sent Apr 11, 2008 10:38:01 AM)
Yes. In general, I agree. But there is one concern about deleting information after an expiration period that deserves at least a bit of thought. Take the T.J.Maxx breach as an example. This breach went on for quite a while. If they had deleted their data after, say 90 days, it would have been impossible to discover which accounts may have been affected because record of those accounts would be gone from their records. While I agree they held onto much too much data for much too long, this did make it possible to contain the risk after the fact. What would have been done if that data was in the hands of the bad guys, but the good guys couldn't obtain it. Re-issue every credit and debit card in the country? I don't know that aswer here, but it seems a question worth considering.
Bruce, NH (Sent Apr 11, 2008 11:14:05 AM)
Geez, why can't these proposed "data purging" rules apply to credit bureaus too!!!
They keep that late payment you made 8 years ago to a credit card for 7 - 10 years!!!
I had an employer go back in my financial history to 1984!!!!!!
Stuff I did WAAAAY back in the 80's was still haunting me. It would be nice to have that purged every six months...
coolzer0, Ohio (Sent Apr 11, 2008 11:18:12 AM)
I don't get it - what good is old information to thiefs? Credit card info from five years ago???
s (Sent Apr 11, 2008 11:28:47 AM)
I am concerned about the fabric of our nations heritage at this time. I hope we a fulfilled in our prayers, and reconciled, as we move forward to face our own truth.
Charles D. Bailey III (Sent Apr 11, 2008 11:29:51 AM)
EZ-Pass data is already being (ab)used by employers to penalize their employees; by states to send out speeding tickets; and by the FBI to track the movements of private citizens they have no right to otherwise surveil.
Since we now have a Communist Congress, if one of the three Communists now campaigning for President gets into the White House, there will be literally not one single thing standing between Americans and a Totalitarian Communist police state except possibly the Supreme Court, and my guess is they'll cave pretty fast if they want to keep their cushy jobs.
Data Retention Bad. Laws preventing Data Retention Good. End of discussion.
Ann, KC MO (Sent Apr 11, 2008 11:40:17 AM)
It is insane the amount of data collected about/on individuals. OPT Outs are are used as an excuse to justify corporate retention of information. Why do corps have the right to keep this info unless we opt out? It should be an opt IN.
(Sent Apr 11, 2008 11:47:44 AM)
re: Florence, KY - In general you give permission to a company your doing business with to collect the data. If you don't like it, then don't do business with them. Any "average person" knows that.
John in Denver, not John Denver ;-) (Sent Apr 11, 2008 11:54:34 AM)
What I don't get is that the local grocery stores use the loyalty cards and state that they won't use the data to send junk ads, or sell the info to someone else. If that is the case why would they need it? I accepted the cards but never filled out the information and submit it so it is basically blank but I still get the discounts.
Dave, Murray Utah (Sent Apr 11, 2008 12:30:35 PM)
Simply do not put your credit card info on the computer if you do not want it hoarded or abused. Do not put any personal info on the computer unless you are ready to risk getting robbed! I never have and never will!
Margaret Whiteside, Asheville, NC (Sent Apr 11, 2008 12:31:04 PM)
I agree with the person above me to some extent. people should refrain entirely from putting credit card information on the internet or any other valuable source of information. the internet is accessed by billions of people around the world. even when the site says that your information will never be shared it can still be accessed by many other people. for example, many sites have what is called a backdoor. im sure you've heard the term before. a backdoor is another entrance into the site but this entrance allows whoever is entering to access all the files stored in the sites bank. unless of course they have it stored in a seperate hard drive. but even then u can find enough information to access that drive too. i know a lot about computers and breaking into them for fun, and i suggest that the companies stop saving this information for so long, or at least try harder to make it inaccessible.
Cameron Taylor, Pittsburgh, Pennsylvania (Sent Apr 11, 2008 12:49:57 PM)
search engines should be PROHIBITED from using IP addresses AT ALL to collect info on users' searches.. they have no need or reason for doing this.. except if they want to make money w/our info that is.. for this reason they should simply NOT BE ALLOWED to collect any info at all on users' searches..
kali (Sent Apr 11, 2008 1:11:24 PM)
In most cases the reason for keeping all that data is not for some sinister purpose. The trivial truth - it costs money to put a good data management procedures and software in place and usually this is the place the companies look for quick savings. They will not spend any money for the software people to go beyond basic functionality and the answer about what to do with the accumulation of the data is usually: "We will worry about it, when it becomes a problem."
Well, with modern database systems being good with fast access and processing of large data sets and 500GB hard drives to boot it may not become a problem for many, many years.
Raph, South Carolina (Sent Apr 11, 2008 1:25:56 PM)
I don't understand business' compulsive need to obtain and retain personal information. I tried to open a safety deposit box at a bank where I have done business for over 20 years. They demand a credit report...for what? They said it was a Homeland Security requirement but it seems a little excessive (and assinine) to me. Having a credit history doesn't prove/disprove anything. It's our information, why can't we be in charge of who gets information (and what information) and how long they can keep it? It seems to me that we have no control over our own personal information so why call it 'personal information'?
Karen Davis, Waukegan, IL (Sent Apr 11, 2008 1:41:19 PM)
how many of you posted 'real' information just to give your opinion and therefor were put on another list? oh and by the way, they said they will keep it private. Any one have any info on google people? I mean if they need OUR info to do business with us, why don't we need their info to do business with them?
Jon Dough ]\ (Sent Apr 11, 2008 2:28:59 PM)
Ha-a! Ha! This blog's administrator says He's going to keep our information private. Honourable Blog administrator, did you really read these comments above? I don't think so. Anyway, You guys are freeking me out of cybernetics with these types of comments. Being in a third world country has its interesting challenges. I'm awed by your topic, its contents and responses from other readers. Woe be unto us in the third world, we stand no chance at all in this game. But its good to learn from your guys already in the first world?
Paul, Rustenburg, Northwest RSA (Sent Apr 11, 2008 2:31:00 PM)
Any website that requires you to give personal information - lie. Supermarket loyalty cards - lie. EZ pass - don't use it or at least not all the time. Computer cookies - don't accept them or make sure you delete them often. It isn't the most convenient way to go but it beats letting everyone know everything about you.
Stephen, Harrisburg, PA (Sent Apr 11, 2008 2:50:39 PM)
Its funny how the government "of the people, by the people, for the people" isn't listening to the people it represents wishes. More like of the corporation, by the corporation, for the corporation
(Sent Apr 11, 2008 3:14:43 PM)
Yes the TJ max issue seems to lead us to think retention could help when there are security breaches, however, fixing after 5 years of data is breached is a lot bigger fix than a 90 day amount of data. People know where they shop, so it would mean being open to the public if your records have been compromised if you had already deleted them - So I must lean towards the lesser of 2 evils.
tgm, springfield MO (Sent Apr 11, 2008 3:33:25 PM)
Who cares about an EZ pass system? That fancy telephone in your picket broadcasts your location 24/7... that is if you leave the battery attached.
The internet is a public network. Get over it.
Everyone of US are locked inside a million-bazillion databases already if you count all the backup tapes; A billion miles of magnetic tape degrading as we speak.
It's not going to get any better, at least any time soon. Just try to keep an eye on things.
I think we should all go home and watch some television and forget all about this important informative article. :)
_Mike
Kansas
Mike McClintock Jr., Somewhere in, Kansas (Sent Apr 11, 2008 3:40:29 PM)
US Businesses are required to retain data on business transactions for a number of years - there are both federal and state laws that affect how long data is to to be held. In texas, it's 3 years, in federal cases its effectively 7 years. You delete that data and you will loose tort cases by default.
Clare Welker, Brenham Texas (Sent Apr 15, 2008 1:39:54 PM)
The EU is doing something that the US should have done 20 years ago. Retaining information and ISP sites speaks loudly of citizen oversight. Our country promised "freedom" not surveillance overtones from a regime existence. US corporations and their databases have stretched beyond the natural limits of public domain acceptance.
(Sent Apr 16, 2008 1:48:55 PM)
Who are you kidding? This isn't going to change here in Amerika the Corpocracy, home of the fee & land of the slave. Not until the sheeple take up arms & revolt (aka; no time soon.)
Lana (Sent Apr 17, 2008 6:37:48 PM)
SEND A COMMENT
PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.