Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[XBNM]

Originally Posted by Dephormation

Phorm have not published the algorithm or method they use. Indeed there was no reference to the anonymisation process AT ALL in the leaked 2006 report.
They have made oblique statements which claim names, and identifiers will be filtered out, but this is obviously unlikely to be successful unless you know the names of everyone on the planet, your filter is multilingual, and you know the format of all identifiers in use on the planet.
Look at this page, put yourself in Phorm's shoes, and ask yourself how you will remove all identifiers from this page? roadrunner69, dephormation, NTLvictim... are those names? Are they personal identifiers?
Phorm claim they will not process form data, but that assumes the form data is a post request, and seems not to include search engine forms. In other words, they will process form data if it is commercially attractive for them to do so.
Clearly, after a moments thought you'll agree, its complete nonsense to claim they can fully anonymise data.
Yet ICO did not ask BT how this algorithm worked, nor inspect its operation.

Something i just noticed a lot of things advertisers might be interested in could also be personally identifiable information.

Examples
Mercedes (A car but also possibly someones first name)
Carr (possibly being taken for car)
Villa ( is a another good example)


Look through a phone book or surnames and try to decide which ones could also have another meaning to advertiser.

How in these cases will they know the context enough to decide it is personally identifing or not ?

[Raistlin]

In order for it to be 'personally identifying' the information would need to make it possible to directly identify an individual.

As many people in the UK could have the name 'Mercedes' the name on its own would not be classed as personaly identifiable.

[mark777]

Originally Posted by Raistlin

In order for it to be 'personally identifying' the information would need to make it possible to directly identify an individual.

As many people in the UK could have the name 'Mercedes' the name on its own would not be classed as personaly identifiable.

I think the point is that your clickstream will be used to associate you with various interest channels. At the moment, phorm argues they are wide.

What happens when they increase the resolution of these channels? Just an incremental step in widening the wedge.

The most obvious is one for your postcode - POSTCODE_AB2_3DE. They don't have to record your postcode, just assign you to the right channel.

The most difficult thing for them is to get this started. Once it's in, give them 5 years and they will be doing whatever they want.

[Digbert]

Originally Posted by Paul Delaney

Can somebody please confirm that the following is correct (want to try a different tack with my MP)

Enter Phorm.
........
A computer program written by Phorm "strips personally identifiable material" from the data. This is what they present to every regulatory body to justify that their system complies with privacy laws.
So privacy is only guaranteed by Phorm's software program and as part of their contract with BT Phorm have complete control over the updating and servicing of their software.

Surely the very act of stripping personally identifiable material is processing that data as defined in the Data Protection Act 1998.

[Bonglet]

It sure is digbert it comes right after the first illegal interception screen all illegal in every step of the process they break fundemental rules but fail to even acknowledge it.

Still suprises me how far this thing is still going on tbh.

[popper]

Originally Posted by Ravenheart

I did have an idea of getting the video's Kent and his team posted to youtube then putting subtitles into English at the bottom as his advertising spyware magnate speak isn't anything like real English.

for example.. http://youtube.com/watch?v=QQULhWLWucM

"as far as the consumer proposition is concerned Webwise is a way of spying on internet users and getting private data about them. Think of it as spyware installed at your isp.."

I've grabbed the video using downloadhelper, but I can't seem to pop it into Movie maker I'll keep trying

i answered this in the OT BR thread.

http://www.cableforum.co.uk/board/12...l#post34587095

[vicz]

Let me make this point again: Nobody knows what phorm does, except phorm, and they are not telling. Or at least they are only telling us what they want us to know. BT are culpable, in that they are intercepting, then snooping on our data stream, but they are than handing that data to a company to process with no credible means of verifying what processing is being carried out. We keep hearing from the ICO and the HO, that 'phorm does this, phorm does that' but THEY DON'T BLOODY WELL KNOW what it does. They only know what Ertugrul tells them, and he doesn't exactly have a reputation for being honest and trustworthy does he? Strange that politicians, amongst whom being a congenital liar is almost a career necessity, seem to find it impossible to recognise this trait in others.

[Digbert]

Originally Posted by Bonglet

It sure is digbert it comes right after the first illegal interception screen all illegal in every step of the process they break fundemental rules but fail to even acknowledge it.

Still suprises me how far this thing is still going on tbh.

Just a further thought, I've just been to the genesrunited site, my sister has entered a whole family tree, so if I go to those pages I can see all the family members with their dates of birth, place of birth, date of marriage etc. All information that can identify an individual.
Similarly with friendsreunited name, schools attended and dates, all personally identifying an individual.
Many of the MySpace or similar pages contain enough information to identify an individual.
So everytime a BT/Webwise customer accesses those pages, Phorm processes personal information. Why doesn't the ICO understand this?

[BadPhormula]

Originally Posted by Dephormation

I'm expecting a response from the HO soon, which will hopefully put a few significant missing pieces of the jigsaw together.

There are some very serious inconsistencies in the HO account of events, which makes me wonder how they are going to account for their actions in the next batch of FoI data.

Once I've got the HO data, I can do some analysis, take stock, and plan the next move with respect to getting additional information.

At that stage I may in a position to write up everything I know about this scandal as a long article for CF (if they'll take it?). But it depends how open HO choose to be.

Shocking... They have got their priorites @ss backwards. The government, its departments and the civil service should be there to protect and serve the public not some greedy gannet immoral sneaky company, Phorm!

Btw take a look at KFO

[NTLVictim]

So sites like genes/friends reunited need to be informed...off you go!

[Dephormation]

Originally Posted by Raistlin

In order for it to be 'personally identifying' the information would need to make it possible to directly identify an individual.
As many people in the UK could have the name 'Mercedes' the name on its own would not be classed as personaly identifiable.

Its all about context and volume of data.

A name alone - John Smith - might not identify an individual. With enough context it would certainly identify an individual.

You cannot allow a communication service provider (electronic or otherwise) to inspect all of your private communications and make a judgement for themselves about what is and isn't personal and private information before you've even had the chance to read it yourself.

You just can't do it.

[popper]

Originally Posted by Raistlin

In order for it to be 'personally identifying' the information would need to make it possible to directly identify an individual.

As many people in the UK could have the name 'Mercedes' the name on its own would not be classed as personaly identifiable.

its always good to keep the definition of the act in clear sight and in mind....

http://www.opsi.gov.uk/acts/acts1998..._en_2#pt1-l1g1
...
“personal data” means data which relate to a living individual who can be identified—
(a)
from those data, or

(b)
from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

...

and this is helpful to some
http://www.jisclegal.ac.uk/dataprote...#_Toc174939790

[jelv]

Originally Posted by Dephormation

A name alone - John Smith - might not identify an individual.

But it could be sufficient if the person has an unusual name. For example, is there more than one Kent Ertugrul?

[warescouse]

Originally Posted by Digbert

Just a further thought, I've just been to the genesrunited site, my sister has entered a whole family tree, so if I go to those pages I can see all the family members with their dates of birth, place of birth, date of marriage etc. All information that can identify an individual.
Similarly with friendsreunited name, schools attended and dates, all personally identifying an individual.
Many of the MySpace or similar pages contain enough information to identify an individual.
So everytime a BT/Webwise customer accesses those pages, Phorm processes personal information. Why doesn't the ICO understand this?

I am hoping in the ICO's case it is pure and simple incompetence. The other reasons I can think of could lead to some very serious accusations.

[popper]

Originally Posted by Digbert

Surely the very act of stripping personally identifiable material is processing that data as defined in the Data Protection Act 1998.

it is.....

the very fact Phorm or the ISPs NEVER mention or answer the question when ever the word "collecting" or "retrieval" of your datastream, comes up, and always just directly jumps to storeing to try and fudge the unwary interviewer or viewer gives that away.

its a shame the word "derivative" didnt get used in the act directly , as that would have made it cristal clear to anyone remotely thinking about the subject understand it in relation to the copyright laws....

http://www.opsi.gov.uk/acts/acts1998..._en_2#pt1-l1g1
“processing”, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including—
(a)
organisation, adaptation or alteration of the information or data,

(b)
retrieval, consultation or use of the information or data,

(c)
disclosure of the information or data by transmission, dissemination or otherwise making available, or

(d)
alignment, combination, blocking, erasure or destruction of the information or data;

“relevant filing system” means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.
...