[Frank Rizzo]

* * * ICO will NOT take action over the 2007 trials * * *

The ICO have written to me in relation to the complaint I had made about the 2007 trials (re: BT intercepted my communications - told me I had a virus)

BT have explained that two technical tests of a prototype advertising platform were conducted in 2006 and 2007. They have informed us that these tests were designed to evaluate the functional and technical performance of the platform. BT have confirmed that they sought their own legal advice before both trials.

Where a purely technical trial is conducted that, in BT's view, is likely to have little or no impact on customers, they have advised that they would not generally seek consent from customers. As they did not anticipate the trials would cause customers problems they did not brief their customer service helpdesks about them (hence the problems you experienced in getting advice from them at the time).

BT have told us that they did not associate your enquiry with the 2007 trial and as they were not able to identify individual customers that had participated (because of the anonymity of the process) they were unable to get back to you. They have advised that they attempted to contact you after you had expressed concerns online at 'The Register' however they were apparently not successful.

Finally, BT have confirmed that no personally identifiable information was processed, stored or disclosed during either trial. We have no reason to doubt this assertion. Where no personal data is processed the Data Protection Act will not apply.

As we discussed when we spoke the issues that we have considered in this case relate primarily to the requirements of Regulations 6 and 7 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Regulation 6 requires that where an organisation is using an electronic communications network to store information, or gain access to information stored, in the terminal equipment of a subscriber or user, the subscriber or user should (in most cases) be provided with 'clear and comprehensive' information about the purposes of the storage of, or access to, that information, and the opportunity to refuse the storage of or access to that information. In other words, if an organisation collects information using cookies they have to tell people about that, and advised them how to prevent operating.

Regulation 7 sets down conditions for the conditions for the circumstances in which traffic data relating to subscribers or users can be processed. In some cases this Regulation requires that a public communications provider has a subscriber or users consent to process traffic data for the provision of ‘value added services’. Traffic data is broadly speaking data used to convey, route or charge for a communication.

It is arguable whether the requirements of Regulation 7 are engaged in this instance, however it is our view that Regulation 6 would likely to apply. BT’s view is that as the 2007 trial was small scale and technical in nature and no adverts were served, it would have been difficult to frame any advice for customers about the operation of cookies, and obtain any relevant consents for the processing of traffic data, with a wording that they would have any resonance at all for theory customers.
Our view is that, whether or not there was a technical breach of the Regulation, there is no evidence that the trials generally involved significant detriment to individuals involved (although we acknowledge – as have BT – the problem you flagged) or privacy risks to individuals. On this basis, and taking into account the difficulties involved in providing meaningful and clear information to customers (the vast majority of whom were likely to be completed unrelated to the anonymous technical trial) in this case, this is not an issue we intend to pursue further with BT.

However, as we discussed when we spoke I understand you were considering the options available to you in terms of pursuing this matter further yourself. As I mentioned briefly on the telephone, Regulation 30 specifies that a person who suffers damage by reason of a contravention of any of the requirements of the Regulations by any other person can make a claim for compensation for that damage.

If you believe you have suffered quantifiable damage as a result of a breach of the Regulations and are considering pursuing this matter you should seek your own legal advice.

As I mentioned in my previous email whilst I appreciate your concerns about the trial(s), particularly in light of the information you received when you contacted HBT, we continue to be focused on ensuring that any future wide scale use of the Phorm product is conducted in as clear and transparent a manner as possible in compliance with the legislation.

Yours sincerely..