Having just read Richard Clayton's
re-revised Phorm explanatory document 18 May 2008, I was concerned about certain paragraphs.
Forgive me if I have misunderstood them but the document was a lengthy read.
Paragraph 72. In the meeting itself, Phorm said that the reason for not centralising the Channel Server function was that they were concerned about EU regulations concerning moving personal data outside of Europe.
Paragraph 73. I then pointed out that it was Phorm's contention that the {channel/UID/timestamp} information was completely anonymised and hence there would be no movement of data that could fall foul of the regulations - to which they responded that they wished to ensure that they were not being perceived to break the rules, even though they did not believe they would do so.
So, Phorm don't collect any personal data, but just to ensure they don't fall foul of the regulations, should any personal data be collected, it will not leave Europe.
Paragraph 77. It is Phorm's belief that it is not possible for the Channel Server (the part of the system operated by them) to make a link back to any particular individual.
It would be nice to have a bit more assurances than a belief that it isn't possible. I would suggest that it probably IS possible but they want to cover their backsides if it ever comes to light.
It would seem that the more that Phorm is pressed, the more unfavourable information emerges.