One for Alexander... using this flow I can't see how Phorm are not processing personal data I guess you agree?
from here
Particularly noted this example... perhaps replace 'CCTV' with spyware and 'physical characteristics' with 'browsing characteristics';
There will be circumstances where the data you hold enables you to identify an individual whose name you do not know and you may never intend to discover.
Example: Where an individual is not previously known to the operators of a sophisticated multi-camera town centre CCTV system, but the operators are able to distinguish that individual on the basis of physical characteristics, that individual is identified. Therefore, where the operators are tracking a particular individual that they have singled out in some way (perhaps using such physical characteristics) they will be processing ‘personal data’.