The Information Comissioner's Office (ICO) has expressed concern that Google may be breaching privacy laws by keeping information about its users' internet searches for too long.

The ICO is a member of a European working party that has sent Google a letter asking that the company justify its policy of keeping data relating to searches for two years.

The letter, sent by a group that advises the European Union on privacy, demanded that Google reveal "the full facts" about how it stored personal information in order to establish whether the company is complying with data protection legislation.

Google collects a range of information about its users, including the search terms they use and, occasionally, more personal information gathered by cookies which track a user's behaviour on the internet.

The company previously had kept such information indefinitely, but in March it announced it would limit the period to two years in an attempt to ease the concerns of privacy campaigners.

Neither European nor UK law specifies a length of time for which data may be retained by a company.

Under the European Data Protection Directive, information should not be kept "any longer than necessary for specific purposes."

The Data Protection Act provides that information can be obtained "only for one of more specified and lawful purposes, and shall not be further processed in any manner incompatible with those purposes."

A spokesperson for the ICO said: "‘The Article 29 Working Party is leading the process to consider Google’s retention of personal information. It has written a letter to Google to establish the full facts about how personal information is retained. Google is co-operating fully with this process.

Norway is one of several countries to have raised concerns about Google's data retention policy, claiming that the 18- to 24-month period proposed by Google is "far too long."

Peter Fleischer, European privacy counsel for Google, said that the company needed to keep information for security purposes. If it collected more personal information about a user, it was only ever with the user's consent, he said.

"Personalised search does raise privacy issues, and there are some people who may not want to share information because they believe it is too personal," Mr Fleischer wrote in an article in the Financial Times.