Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[OF1975]

Alexander that is truly truly shocking. I am gobsmacked. I had to read it twice to make sure I hadnt misread it first time.

So the ICO is passing the buck back to the Home Office are they? Thats interesting. Curiously, just for information I have had no rejection yet of my third petition submitted to the downing street petition site. Thanks must go to others who have noted that the labour ex-minister Patricia Hewitt sits on the BT board. Would be interesting to hear what she has to say on the matter.

Now that we know that the ICO is not investigating Phorm or the secret BT trials its obvious that we need to ramp this up a few more levels if anything is to be done. Maybe it IS time to try find people involved in the BT trials and write letters to the computer crime unit of the Met Police afterall.

Still astounded here.

[Shin Gouki]

Originally Posted by kt88man

Posted on virginmedia.feedback earlier this morning

turbo wrote:
Just announced on BBC24 news ( 10.23am) that the information Commissioner has declared BT's testing of Phorm with customer data is a clear case of intercepting data , and further action is being taken...

Is anyone able to confirm this.

I can confirm it.

I can also confirm that BT claim they have done nothing wrong and they actually did two tests, not one.

[popper]

http://www.channel4.com/news/article...g+deal/1703547
Concerns over data pimping deal

Last Modified: 04 Mar 2008
By: Channel 4 News

---------- Post added at 13:46 ---------- Previous post was at 13:40 ----------

anyone found a video clip for that BBC "IC:a clear case of intercepting data" yet?

[AlexanderHanff]

The thing that shocks me the most is that they have passed the buck unconditionally to the Home Office as opposed to doing their own investigation in parallel with the Home Office with regards the privacy and data protection issues surrounding this matter; issues, I must add, which most certainly do fall under the ICO umbrella:

"The ICO is the UK's independent public body set up to promote access to official information and protect personal information by promoting good practise, ruling on eligible complaints, providing information to individuals and organisations, and taking appropriate action when the law is broken."
(emphasis added)(Source: http://www.ico.gov.uk/about_us.aspx )

"What we do
We enforce the Data Protection Act, the Freedom of Information Act, the Privacy and Electronic Communications Regulations and the Environmental Information Regulations
...
We influence thinking on privacy and access issues
...
We prosecute those who commit offences under the legislation"
(emphasis added) (source: http://www.ico.gov.uk/upload/documen...y/about_us.pdf )

I don't think I need to elaborate on any that now do I?

Privacy and Electronic Communications Regulations <- looks like I have some heavy reading to do tonight...

Alexander Hanff

[CaptJamieHunter]

I'm stunned at the ICO's response here. And I mean stunned. What reasons could they have for passing the buck to the Home Office?

[Ravenheart]

I can't believe this, the ICO are turning a blind eye to the whole thing? Someone has already mentioned that the government wanted to spy on our online activities, maybe using Phorm is the thin end of the wedge and using spin to say ohh it will make us all safer etc, they're hoping people will just accept it.

We HAVE to stop this

[3x2]

They were not very happy to talk to me at ICO either and stated I was not permitted to quote them and would not even give me a name until I first gave them my name, address and phone number.

Since when have public servants had the right to stop you quoting them? Dream on ICO you have no right to privacy, you exist to serve us. You are a public body funded by taxpayers.

[AlexanderHanff]

Privacy and Electronic Communications (European Directive) Regulations 2003

Confidentiality of communications
6. - (1) Subject to paragraph (4), a person shall not use an electronic communications network to store information, or to gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment -

(a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and

(b) is given the opportunity to refuse the storage of or access to that information.


(on (a) clearly this requirement has not been met since BT did these trials in secret.)
(on (b) clearly this requirement has not been met since (yup you guessed it) BT didn't ask the subscriber/user for consent because they conducted the trials in secret.)
...

(4) Paragraph (1) shall not apply to the technical storage of, or access to, information -

(a) for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network; or

(b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.

...

(7)(3) Traffic data relating to a subscriber or user may be processed and stored by a provider of a public electronic communications service if -

(a) such processing and storage are for the purpose of marketing electronic communications services, or for the provision of value added services to that subscriber or user; and

(b) the subscriber or user to whom the traffic data relate has given his consent to such processing or storage; and

(c) such processing and storage are undertaken only for the duration necessary for the purposes specified in subparagraph (a).

(on (b) clearly this requirement has not been met as BT carried out these trials in secret and did not seek consent)
...

Further provisions relating to the processing of traffic data under regulation 7
8. - (1) Processing of traffic data in accordance with regulation 7(2) or (3) shall not be undertaken by a public communications provider unless the subscriber or user to whom the data relate has been provided with information regarding the types of traffic data which are to be processed and the duration of such processing and, in the case of processing in accordance with regulation 7(3), he has been provided with that information before his consent has been obtained.

(for fear of sounding like a broken record, these trials were carried out in secret; requirement of 8. above NOT MET!)
...

Modification of contracts
27. To the extent that any term in a contract between a subscriber to and the provider of a public electronic communications service or such a provider and the provider of an electronic communications network would be inconsistent with a requirement of these Regulations, that term shall be void.

(Could this possibly mean that simply changing terms and conditions would not work???)

...

Request that the Commissioner exercise his enforcement functions
32. Where it is alleged that there has been a contravention of any of the requirements of these Regulations either OFCOM or a person aggrieved by the alleged contravention may request the Commissioner to exercise his enforcement functions in respect of that contravention, but those functions shall be exercisable by the Commissioner whether or not he has been so requested.

(on 32 - so the IC is supposed to exercise his enforcement functions irrespective of whether an official complaint is made or not!)

Technical advice to the Commissioner
33. OFCOM shall comply with any reasonable request made by the Commissioner, in connection with his enforcement functions, for advice on technical and similar matters relating to electronic communications.
(Commissioner is referring to the Information Commissioner)

...

Amendment to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000
34. In regulation 3 of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000[16], for paragraph (3), there shall be substituted -

" (3) Conduct falling within paragraph (1)(a)(i) above is authorised only to the extent that Article 5 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector so permits.".


In relation to the last point above re: Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000:

(a) monitoring or keeping a record of communications -

(i) in order to -

(aa) establish the existence of facts, or

(bb) ascertain compliance with regulatory or self-regulatory practices or procedures which are -

applicable to the system controller in the carrying on of his business or

applicable to another person in the carrying on of his business where that person is supervised by the system controller in respect of those practices or procedures, or

(cc) ascertain or demonstrate the standards which are achieved or ought to be achieved by persons using the system in the course of their duties, or

(ii) in the interests of national security, or

(iii) for the purpose of preventing or detecting crime, or

(iv) for the purpose of investigating or detecting the unauthorised use of that or any other telecommunication system, or

(v) where that is undertaken -

(aa) in order to secure, or

(bb) as an inherent part of,

the effective operation of the system (including any monitoring or keeping of a record which would be authorised by section 3(3) of the Act if the conditions in paragraphs (a) and (b) thereof were satisfied); or

(b) monitoring communications for the purpose of determining whether they are communications relevant to the system controller's business which fall within regulation 2(b)(i) above; or

(c) monitoring communications made to a confidential voice-telephony counselling or support service which is free of charge (other than the cost, if any, of making a telephone call) and operated in such a way that users may remain anonymous if they so choose.

(2) Conduct is authorised by paragraph (1) of this regulation only if -

(a) the interception in question is effected solely for the purpose of monitoring or (where appropriate) keeping a record of communications relevant to the system controller's business;

(b) the telecommunication system in question is provided for use wholly or partly in connection with that business;

(c) the system controller has made all reasonable efforts to inform every person who may use the telecommunication system in question that communications transmitted by means thereof may be intercepted; and

(d) in a case falling within -

(i) paragraph (1)(a)(ii) above, the person by or on whose behalf the interception is effected is a person specified in section 6(2)(a) to (i) of the Act;

(ii) paragraph (1)(b) above, the communication is one which is intended to be received (whether or not it has been actually received) by a person using the telecommunication system in question.

(3) Conduct falling within paragraph (1)(a)(i) above is authorised only to the extent that Article 5 of Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector[2] so permits.

---

Now what was that about ICO not being responsible for issues surrounding interception of communications again?

Alexander Hanff

---------- Post added at 14:33 ---------- Previous post was at 14:23 ----------

And here is Article 5 of Directive 97/66/EC:

Article 5

Confidentiality of the communications

1. Member States shall ensure the confidentiality of communications and the related traffic data by means of a public communications network and publicly available electronic communications services, through national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or surveillance of communications and the related traffic data by persons other than users, without the consent of the users concerned, except when legally authorised to do so in accordance with Article 15(1). This paragraph shall not prevent technical storage which is necessary for the conveyance of a communication without prejudice to the principle of confidentiality.

2. Paragraph 1 shall not affect any legally authorised recording of communications and the related traffic data when carried out in the course of lawful business practice for the purpose of providing evidence of a commercial transaction or of any other business communication.

3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

---

Maybe the ICO can explain to me again how unlawful interception is not covered by their office when the very regulations they claim to enforce on their web site create amendments to other legislation and regulations on interception specifically ?

Alexander Hanff

---------- Post added at 14:36 ---------- Previous post was at 14:33 ----------

*** Article 15(1) clearly doesn't state "For targetting customers with adverts":

Article 15

Application of certain provisions of Directive 95/46/EC

1. Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.

---------- Post added at 14:37 ---------- Previous post was at 14:36 ----------

oops sorry for the long post...

I have just edited the original post to put my own comments in italics so they don't get lost in all the legalise.

[rogerdraig]

read those yesterday i would read it that even if it some how went ahead if i refuse permision some cookie wouldnt be good enough as unless we agree they cant store or process the data and cant even sneak it it in as a section in "Terms & Conditions" as it says that would make any such condition null and void

[AlexanderHanff]

Originally Posted by rogermevans

read those yesterday i would read it that even if it some how went ahead if i refuse permision some cookie wouldnt be good enough as unless we agree they cant store or process the data and cant even sneak it it in as a section in "Terms & Conditions" as it says that would make any such condition null and void

Yup that is certainly how I interpret the regulations. Without getting explicit consent to the change in terms (as opposed to implied which is what it would be if the terms were changed to opt people in by default) any Terms added would be void.

It is laughable though that the ICO claim to enforce legislation directly relating to this matter (see the first couple of points from the Privacy and Electronic Communications Regulations) in their official definition of themselves yet then go on to claim that the BT trials do not fall under their jurisdiction. It is blatantly clear that Privacy and Electronic Communications Regulations cover this issue directly as outlined in my previous post.

Of course the procedure for complaining about a public authority not doing there job is to first write to your MP and if a satisfactory solution is not obtained, to place a complaint with the Parliamentary Ombudsman. Looks like my MP is going to be busy with letters from me this month.

Alexander Hanff

[kt88man]

C4's news coverage of BT/Phorm is now online.

http://www.channel4.com/news/article...tomers/1933047

Contains this very nice quote:

"The act of anonymising the surfing history of someone is in itself processing personal data. And someone is doing that, whether it's ISP or Phorm, so there's a good argument that that is a breach of the Data Protection Act." - Mike Conradi, Technology Lawyer

[Barkotron]

Oooh - good old Channel 4 news: http://www.channel4.com/player/v2/pl...p?showId=11611

Would be nice if that made the evening one. A far better report than that BBC one earlier.

[EDIT: hehe, jinx!]

[OF1975]

Originally Posted by AlexanderHanff

{ snip }
....... Of course the procedure for complaining about a public authority not doing there job is to first write to your MP and if a satisfactory solution is not obtained, to place a complaint with the Parliamentary Ombudsman. Looks like my MP is going to be busy with letters from me this month.


Alexander Hanff

Actually that opens up another albeit expensive possibility. If you write to the ICO and they reply in writing that they dont view it as being within their remit then it actually opens up the avenue of applying for a judicial review at the High Court. The problem with that is that it would most likely be prohibitively expensive.

[AlexanderHanff]

Oooo some case law re: RIPA Crown vs C Stanford (Demon Internet). Stanford pleaded guilty judge says:

"It is essential people, in whatever walks of life, and, of course, those running important businesses, should know that the integrity of their confidential communication should be respected, and ... they will be protected from being hacked into by outsiders."

(Source: http://news.bbc.co.uk/1/hi/uk/4251264.stm )

That's the first piece of case law I have managed to find relating to RIPA and interception on a public telecommunications network which involved an individual as opposed to the police. I will try and dig up the paperwork for the case after I have had a sleep, but I suspect it is going to raise the same points we have been raising over Phorm for the past 6 weeks.

Alexander Hanff

---------- Post added at 16:13 ---------- Previous post was at 15:57 ----------

The Horizontal Effect of the Human Rights Act 1998

The protection of human rights in the private, as well as the public, sector is also supported by the Human Rights Act 1998 through its incorporation of the Convention into domestic law. The 1998 Act has a direct effect on public authorities and an indirect effect on private bodies. Public authorities are directly (vertically) bound since section 6(1) of the 1998 Act states that it is unlawful for a public authority to act incompatibly with Convention rights.(11) The 1998 Act also has a horizontal effect whereby Convention rights are indirectly enforceable against private bodies. This is achieved through sections 3 and 6 of the Act. Section 3(1) requires that the domestic courts interpret existing and future legislation (so far as it is possible to do so) in a way compatible with Convention rights (incompatible legislation remains valid). Section 3 is not worded to limit its effect only to legislation concerning public authorities, so it can apply to wholly private disputes.

Private bodies can also be indirectly bound by the 1998 Act since section 6(3)(a) defines a ‘public authority’ as including courts and tribunals. Therefore, in an action against a private body (for example, an employee suing for unfair dismissal) a human rights claim can be attached. The main cause of action is not the rights issue since these cannot be directly enforced against the private body (since section 6 only requires public authorities to act compatibly). Nevertheless, the court or tribunal is obliged to consider the human rights issue and must resolve it, through the application and interpretation of common law, equity or legislation, in a manner compatible with the Convention.(12)

The positive obligation imposed on states by the European Convention on Human Rights also lends weight to the argument that section 6 should have horizontal effect. Firstly, because the courts are part of the state they are subject to the Convention obligations, and these feed through into domestic law via section 6 and are imposed on the courts as public authorities (Davies 2000, p.839; Lester and Pannick 2000, p.381; Hunt 1998, pp.435-6). Secondly, section 2 of the 1998 Act requires that the courts must take Convention jurisprudence into account when interpreting Convention rights. Thus, the positive obligation will also come to form a part of domestic jurisprudence through this route (Bamforth 1999, pp.166-8).

The end result is that just as an individual or business can now claim privacy rights against public authorities in both international and domestic law, a private body (such as a business) may also find itself vulnerable to privacy claims from other private bodies (such as employees). However, just as the public authority may be able to show a legal justification for its interference with rights, equally a business may also be able to justify its interference. In particular, as a ‘legal person’ a business could monitor the communications of its employees in order to protect its own right to peaceful enjoyment of possessions (Article 1, First Protocol) against threats to its trade secrets or reputation (Bingley 2000, p.5). The restriction to an employee’s privacy could then be justified as falling within Article 8(2) ‘for the protection of the rights and freedoms of others.’

(Source: http://webjcli.ncl.ac.uk/2002/issue1/kb-rm1.html )

Alexander Hanff

[CaptJamieHunter]

OK, so who to write to with this information? Any one influential minister or adviser in particular? This is an abject cop out and needs to be seriously challenged.

[Edited to include]

Looks like the Shadow Home Secretary, David Davis, would be a good bet after his comments as reported by the BBC: http://news.bbc.co.uk/1/hi/uk_politics/7327082.stm:

Mr Davis - a self-confessed "geek" who studied computer science in the late 1960s - said there needed to be a "shake-up in attitudes, strategy and the whole mindset of government on cyber-crime".