Phorm slammed as 'illegal'

ISPs under fire for Phorm

Online advert system Phorm is in contravention of the Regulation of Investigatory Powers Act 2000 (RIPA) and illegal in the UK, according to the Foundation for Information Policy Research (FIPR).

In an open letter to the Information Commissioner Richard Thomas, FIPR argued that to ensure compliance with RIPA Phorm must not only secure the consent of web users but also of website operators.

The monitoring system, which analyses users' surfing habits, is proving increasingly popular with ISPs looking to more accurately target their subscribers with advertising. Talk Talk, Virgin and BT are all currently working with Phorm on a pilot basis.

Phorm builds a user profile by sifting websites visited by individuals, matching key words with the content of the web page. Tailored advertising is then served up to users when they visit sites employing Phorm's technology.

"The need for both parties to consent to interception in order for it to be lawful is an extremely basic principle within the legislation, and it cannot be lightly ignored or treated as a technicality," said Nicholas Bohm, general counsel at FIPR.

Richard Clayton, treasurer at FIPR, added: "The Phorm system is highly intrusive; it's like the Post Office opening all my letters to see what I'm interested in, merely so that I can be sent a better class of junk mail.

"Not surprisingly, when you look closely, this activity turns out to be illegal.

"We hope that the Information Commissioner will take careful note of our analysis when he expresses his opinion upon the scheme."

FIPR's move is the latest in a spate of recent initiatives highlighting the concerns of privacy advocates.

The Open Rights Group (ORG) recently raised concerns over potential privacy violations caused by the ad system Phorm.

"Until we know exactly how Phorm works, and across whose networks our data will flow, speculation about the privacy implications will continue", said ORG in a statement.

Phorm has denied that the technology breaches any UK privacy laws.

"Our technology complies with the Data Protection Act, RIPA and other applicable UK laws. Consumers are in control - they can switch the service off or on," the company claimed in a statement last week.