[vicz]

Originally Posted by JohnnyWashngo

Haven't posted much recently, life is too hectic and this forum moves way too quickly. However, I would like to add something to the discussion of the contact page on www.webwise.bt.com.

I am not a lawyer, but I am a software engineer .

Over the years, I have worked for many companies that have pages like this on their sites. I have even worked on jobs where I have had to provide these services from one company to another and rebrand them to make them appear as though they are part of another system. For example, company A wants to use company Bs contact us page but brand it as being from company A.

This is what I believe it happening here. BT is using their relationship with Phorm to have them host and rebrand a conatct us type page to gather questions from customers.

Back in the day, forms like this would simply email the data to the approriate address for the company to read and answer. However, this type of form proved open to abuse, allowing people to use it as an open email relay. So these days the data is usually captured and stored somewhere before being sent to the company.

Given that the data is capture on a site hosted on a US server I would assume that the captured data would be stored somewhere on that server. This would be bad.

I assume that the data is being sent via email unencrypted as well. If this is the case then it is also bad.

Maybe I just see the worst in everything, but my experience tells me that all that data you enter on that form is recorded in a database over in the US and then passed back to BT over email. If that is the case then it scares the doo doo out of me.

I agree that this probably what is happening (we non-lawyers should stick together!) In fact BT privacy policy implies as much

We sometimes use other companies to provide services to you or to provide services to us. To enable them to do this, we may need to share your personal information with them. When we do so, these companies are required to act in accordance with the instructions we give them and they must meet the requirements of the Data Protection Act to keep the information secure.......Countries in the European Economic Area (EEA) are required to have a similar standard of protection of personal data but this is not always the case in countries outside of the EEA. We do sometimes transfer data outside the EEA but before doing so take steps to ensure that your data will be given adequate protection as required by the Data Protection Act.

It seems they have themselves covered legally if not morally in the fine print.