Commission takes on UK privacy laws in Phorm action

The European Commission has launched an infringement proceeding against the UK after complaints by internet users against online advertising company Phorm.

The Commission alleges the UK failed to comply with EU e-privacy and personal data protection rules by allowing Phorm to track internet users’ web-surfing patterns to determine their interests and then deliver targeted advertising, without customers’ consent.

BT allowed Phorm to trial its services in 2006 and 2007, without informing customers.

EU telecoms commissioner Viviane Reding called on the UK authorities to “change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal”.

It is an offence to unlawfully intercept communications, but only where interception is “intentional”, and not if the interceptor has “reasonable grounds for believing” that consent to interception has been given.

Sarah Needham, solicitor at Macfarlanes LLP, says: “It is unclear whether the Phorm service contravenes EU or UK privacy laws.

“This is because they all revolve around a ‘consent’ regime without further detailing what is meant by this and whether this would include a clearly worded opt out regime,” she says.

One possibility, Needham says, is that the Phorm service may be “legitimised” if the user has consented to use of their data in this way, although EU and UK data protection laws are unclear on what this requires.

“The law is entirely clear that internet users must be told at the time their data is collected by ISPs what it will be used for.

“It seems that Phorm is planning on including this information as part of its launch. The best way for consumers to avoid unwanted Phorm activity is therefore to read privacy policies carefully,” she adds.

The Incorporated Society of British Advertisers wants the Commission to withdraw its legal challenge, saying selfregulation is the best way to address the issue.

The UK now has two months to reply. The Commission can then issue a reasoned opinion and, if still dissatisfied, refer the case to the European Court of Justice.