Intellectual Property Law

Does Phorm's 'Webwise' Online AD System Break U.K. Law?

By IBLS Editor

Internet security expert Dr Richard Clayton, a noted analyst working at England's University of Cambridge claims that the Phorm company's new and highly sophisticated advertising system actually breaches the Regulation of Investigatory Powers Act of 2000. Clayton says that what he recently learned while interviewing Phorm about its system convinced him that their model breaks laws that are designed to limit unwarranted capturing of the Internet data of private users.

In response, Phorm claims Clayton is misreading the law and that the legislators who created the Act never meant the law to apply to such a setting. Now, the Information Commissioner's Office (ICO) has released a statement that  it will monitor Phorm more closely as it gets ready to deploy its sophisticated and potentially lucrative advertising program. 

The Phorm "Webwise" system gets information by making a copy of a user's traffic history when the user visits a website, and they break down the information in this history, making available the results to websites paying for its service. Afterwards, paying websites can then very closely apply their advertisers to the presumed interests of the Net surfers by running adverts that correlate to the history of the visitor.

Phorm achieves this by taking a web visit and redirecting it three different times within their system so they can inspect user cookies to set a unique identifier ID for the user. They also add a cookie to the user's system that they make to look as if it came from someone else's website. These actions, according to Dr. Clayton, may well be illegal under the Fraud Act 2006 and/or the Computer Misuse Act 1990. Clayton believes the real issue here is an unwarranted invasion of privacy. He defines privacy as the expectation that "other people, even people I'll never meet and who will never meet me, don't get to know what I do."

Clayton believes the Phorm system fails the very first Section of the RIPA act. This view is shared by a number of other IT experts, as well. The ACT states:

"1 Unlawful interception:

(1) It shall be an offence for a person intentionally and without lawful authority to intercept, at any place in the United Kingdom, any communication in the course of its transmission by means of?

(a) a public postal service; or

(b) a public telecommunication system."

 In response to Clayton's statements, a Phorm spokesperson said: "Our technology complies with all the appropriate UK laws - and we've consulted a range of experts on this. The Regulation of Investigatory Powers Act (RIPA) was drafted in the earliest days of the internet. It is not designed to criminalise legitimate business activities - online targeted advertising is an accepted part of the internet landscape today."

Other experts have weighed in on the practice. For example, the Foundation for Information Policy Research (FIPR) released the text of an open letter to Richard Thomas, the U.K. Information Commissioner (IC) on the legality of Phorm Inc's targeted advertising that comes from what it claims to be "snooping on Internet users' web browsing."

The open letter says, "The controversial Phorm system is to be deployed by three of Britain's largest ISPs, BT, Talk Talk and Virgin Media. However, in FIPR's view the system will be processing data illegally. It will involve the processing of sensitive personal data: political opinions, sexual proclivities, religious views, and health -- but it will not be operated by all of the ISPs on an "opt-in" basis, as is required by European Data Protection Law. Despite the attempts at anonymisation within the system, some people will remain identifiable because of the nature of their searches and the sites they choose to visit. The system will inevitably be looking at the content of some people's email, into chat rooms and at social networking activity. Although well-known sites are said to be excluded, there are tens or hundreds of thousands of other low volume or semi-private systems."

Certainly, the controversy about Phorm's practices will not be ended anytime soon, and the Government may have to address the issue of Internet privacy and user's rights sometime in the near future.

Full post as published by IBLS Internet Law Blog on April 13, 2008 (boomark / email).