Since the whole thing about server-side adware company Phorm first blew up, we've been hearing about the report by 80/20, a consultancy run by Simon Davies and Gus Hosein (better known for their role in Privacy International), which examined the implications of the Phorm setup. (Kent Ertegrul, Phorm's chief executive, confused the two, very separate, organisations, as you'll recall from our interview.)
Now we've been sent the report, dated February 10 2008, which you can download (PDF, 396KB). We've not had time to digest it at all, so we'll update this entry as and when we get the chance. In the meantime, Phorm points out that this was an interim report - the full one is due later this month (not much time for that, then) and that while it has a number of queries, those are now being sorted out with 80/20.
A couple of quick notes from the report:
This PIA [Privacy Impact Assessment] takes into account the May 2007 audit performed by Ernst & Young. While broadly agreeing with Ernst & Young's findings, the 80/20 assessment provides a broader geographical context, a wider focus across a more universal privacy environment and a more risk-based approach in its methodology.
I can see which report we have to look at next...
From the executive summary:
We broadly agree with the positive findings of the 2007 Ernst & Young privacy examination, but remain concerned that the scope of that report was based almost exclusively on conditions applying to the US privacy environment. Public sensitivities, regulatory conditions and other factors vary substantially according to geographical location.
We are encouraged by the spirit of openness shown by Phorm's executive team. A clear willingness to engage with and respond to this examination has, in our view, provided a strong foundation for development of a strong and sustainable privacy commitment by the organisation.
Based on the information and documentation we have reviewed, we believe that Phorm Technology does not make use of personal data as defined in the UK Data Protection Act (though not necessarily the data protection or privacy Acts of all countries). However the technology may prompt wider (albeit often perception based) privacy and intrusion concerns.
Can't fault them on their foresight with the latter. Over to you: what's in there?
