I am not a lawyer. I’m just a lowly computer geek who’s done various computer geeky things (coding, systems, tech consulting, etc) for the Berkman Center for Internet & Society at Harvard Law School for the past six years. Lately, I’ve been spending most of my time at the Berkman Center on research projects that straddle social and technical issues, including a surveillance project that has me looking into dpi monitoring.

This particular case does not require formal computer science or legal qualifications, though. The language in the privacy policy is plain, as is the language in the technical document by Richard Clayton. The privacy policy says that Phorm won’t share its IDs with anyone else, but the technical description they gave to Richard Clayton says that they do.

Notice that I don’t speak to the question of whether Phorm is liable in any way for its violation of its privacy policy. The point of the post is just that Phorm is plainly and obviously violating its own privacy policy and that Ernst & Young should be ashamed that they didn’t find and disclose that violation.

It is a very interesting piece you have written here in your blog. I wonder on your “about” page you do not mention your academic background. I would be interested to know your credentials. There is a lot of talk at the moment on the internet about Phorm, NebuAd and other outfits who wish to profile individuals, but alas very little of the debate is disciplined. Whether you have read or are reading law, and whether you have any formal computer science qualifications would greatly interest me.