A recently published security report from European data protection commissioners blasted Google for holding onto user data for 18 months. Google defended the policy, saying it is necessary to improve the results dished up by its search engine. How long is long enough? And is your IP address personal property?

The report, assembled by the Article 29 Working Party, says that six months should be plenty of time to save user data. It determined that Web addresses and cookie monitoring are personal information that search services should do more to protect. The group calls for increased user notification about data retention and warns that Web search services that fail to properly disclose how long user data is stored may be unlawful.

Google's global privacy counsel shot back, "We believe that data retention requirements have to take into account the need to provide quality products and services for users, like accurate search results, as well as system security and integrity concerns." In other words: We think you're wrong.

Reuters reports that Google Web services generate mountains of more or less anonymous user data that it stores securely in massive computer data centers it operates. The company's engineers regularly study this data to figure out how to improve its services. Last year, Google began limiting the time it stores this data to 18 months, but Article 29 thinks that's too long.

Its main beef has to do with IP addresses, which it thinks are personal property because they can identify specific computers connected to the Internet. Google's Fleischer said, "Based on our own analysis, we believe that whether or not an IP address is personal data depends on how the data is being used."

Arguing about the validity of IP addresses as personal property belongs in a court of law, and to my knowledge has not yet been determined. There's no doubt that people have a right to privacy. How far that privacy stretches on the Internet is becoming less black and white. Aren't our home phone numbers and addresses published in the phone book by default? You have to take specific action to prevent them from appearing in that public, searchable database. In fact, my local analog phone provider charges something like $2.99 per month if you don't want to be listed (i.e., if you want to protect your privacy). But you do have the option to opt out.

Should the same courtesy be extended to Internet users who don't want their personal data used for "improving Internet searches"? Is it even possible? Is Google's notion of using the data for the greater good a valid argument?

What are your thoughts?