Die sog. Art. 29 Gruppe der europäischen Datenschützer hat einen Bericht zum Datenschutz veröffentlicht. Danach sind auch vom Ausland aus operierende Anbieter unter gewissen Voraussetzungen - die die großen Player des Marktes aber alle erfüllen - an die Datenschutzbestimmungen der EU gebunden. Danach sind keine Gründe ersichtlich, persönliche Informationen länger als 6 Monate zu speichern. Die von Suchmaschinen genannten Gründe (z.B. Verbesserung der Dienste, personalisierte Werbung, Abwehr von Attacken) seien nicht geeignet, eine weiter gehende Speicherdauer zu rechtfertigen.

Die zentralen Aussagen des Reports sind:

• The Data Protection Directive (95/46/EC) generally applies to the processing of personal data by search engines, even when their headquarters are outside of the EEA.

• Search engines may only process personal data for legitimate purposes and the amount of data has to be relevant and not excessive in respect of the various purposes to be achieved.

• In view of the initial explanations given by search engine providers on the possible purposes for collecting personal data (e.g. Service improvements, system security, fraud prevention, personalised advertising), the Working Party does not see a basis for a retention period beyond 6 months.... In case search engine providers retain personal data longer than 6 months, they will have to demonstrate comprehensively that it is strictly necessary for the service.... If there is no legitimate ground for processing, or for use beyond the well-specified legitimate purposes, search engine providers must delete personal data. Instead of deletion, search engines may also anonymise data, but such anonymisation must be completely irreversible for the Data Protection Directive to no longer apply.

• The Working Party finds that the correlation of personal data across services and platforms for authenticated users can only be legitimately done based on consent, after the users have been adequately informed.

• Users of search engine services have the right to access, inspect and correct if necessary, according to Article 12 of the Data Protection Directive (95/46/EC), all their personal data, including their profiles and search history.

• Cross-correlation of data originating from different services belonging to the search engine provider may only be performed if consent has been granted by the user for that specific service.

 

   

	Web www.linksandlaw.de