大象传媒

1.) I would like to know if Phorm paid 80/20 Thinking Ltd for their privacy assessment, and what the exact scope of the assessment was, and are they prepared to release the full report to the wider IT security and privacy community for scrutiny. 2.) I'd please like you to put it to Kant that the mechanisms for opt-out (apparently using a cookie according to leaked documents) are at best unproven and at worst inadequate under the provisions of the Data Protection Act, which gives individuals a right to contact the Data Controller of the ISP in writing removing their permission for processing of personal information beyond that necessary in providing the service, which obviously would not set (and ensure that they remain set) cookies on all current and future computers used on that connection. Would they consider hiring an external agency to audit the provisions for opt-out? 3.) I like the Phorm approach to data storage reported and described in his patent disclosure and have no problem with behavioural targeting except in the following case: two people use a shared computer 鈥� how will Phorm ensure that a surprise, e.g. a partner researching wedding venues, is not ruined when the other partner next uses the computer and is bombarded with adverts for dresses and rings? I believe the effect will most likely be noticeable because I was recently engaged and since the point at which I changed my Facebook status, which also uses behavioural targeting, I have been subjected to an endless stream of adverts about weddings, despite the arrangements now being fully in place! I鈥檓 happy using Facebook because there is strict demarcation between what I choose to share and what I don鈥檛. What I don鈥檛 choose to share still has to go via my ISP! 4.) I would argue that anonymity of data is critically important but in the legal case perhaps a side issue, where the primary focus is on consent and access to information either now or in the future. I would like to better understand the strict demarcation of ownership of equipment to be installed in the ISP to really understand the full content of the stream received at the point of entry to equipment under the control of Phorm. Bloggers purporting to be from BT claim that this is the FULL browsing (http - port 80) stream with IP addresses obfuscated in some way. Is this true? And if so, what safeguards over employee recruitment do Phorm have since they will be in an extremely powerful and trusted position, being able to read 10m peoples' web traffic. If this is true, is it correct that Phorm use oversees software developers, and if so, how will software updates be validated to ensure there are no back-doors and processing is within the boundaries outlined in the EULA. 5.) The E&Y report makes a concession that the safeguards audited only apply whilst the system is in it's current form. I would argue that the infrastructure itself is inherently intrusive, so how can future safeguards be maintained? 6.) The same report also mentions detailed (but anonymous) logs that will be removed from the closed loop onto Phorm servers and kept for up-to 14 days. Why do they need these logs since the very thing that impressed 80/20 was the lack of need to store detailed personal information nor remove it from the closed loop. And crucially, will these logs be stored within the EEA? 7.) Do phorm intend to resell any data, such as "clickstream" trends, perhaps even split by demographic, and if so, are they aware of the possibility that this data would be "de-anonymized" as reported on techcrunch and numerous sites with the AOL and Netflix "anonymous" releases.

There are inconsistencies appearing. Phorm told The Register that data is still passed to the "Profiler" even if people opt-out, but apparently the "Profiler" is owned by the ISP, which is how they claim no personal data is sent to Phorm, as per the reply to the 大象传媒. However, I would like to know who provides the software for the "Profiler" and if it's not written by the ISP, how does the ISP check that it does what it's meant to?

I still want answers to my cookie question. Part II Section 11 "Right to prevent processing for purposes of direct marketing". Is this direct marketing - well as is clear to all concerned there HAS to be some link between the profile and the target computer else the ads would not get served.

Opt out by cookie is insufficient in my mind.