The CPS has released a statement which reveals its thinking in response to a request to begin a prosecution of BT Group Plc and Phorm Inc in relation to alleged unlawful interception of Internet browsing data. Prosecutions for unlawful interception require the CPS’s consent.
After reviewing of the available evidence, the CPS has decided there is insufficient evidence to begin a prosecution under the Regulation of Investigatory Powers Act 2000, s 1. It believes that it would not be in the public interest to proceed any further.
The PageSense software (later known as Web Wise), created by Phorm and used by BT, stored a cookie on a user’s computer and covertly gathered selected information on their Internet browsing habits. The software used this data to automatically target web-based advertisements at the user. An unannounced trial of this technology, involving about 18,000 BT customers, took place during 2006.
Andrew Hadik, reviewing lawyer for CPS London’s Complex Casework Unit, said:
‘We have thoroughly reviewed all of the material supplied by the individual who wished for us to consent to a prosecution, as well as the evidence provided by City of London Police, BT and Phorm. On the basis of the evidence gathered and with advice from legal and technical experts, we have determined the extent and seriousness of the alleged criminality.
At present, the available evidence is insufficient to provide a realistic prospect of conviction. In the vast majority of cases, we would only decide whether to prosecute after the investigation had been completed and after all the likely evidence had been reviewed. In rare cases, however, it may become clear prior to the collection and consideration of all the likely evidence that a prosecution would not be in the public interest.
We would only take such a decision if we were satisfied that the broad extent of the criminality had been determined and that we could make a fully informed assessment of the public interest. This is such a case.
We obtained expert evidence to enable us to understand how the technology worked, how many people were affected and how they were affected. Those are the key elements of the alleged offending. Even if further evidence were available and collected, we are satisfied that it could not change our assessment.
We have concluded a prosecution would not be in the public interest. As such, consent to a prosecution cannot be given.’
The CPS say that the review identified several public interest factors against prosecution:
- BT and Phorm received considerable legal advice concerning the use of this software and were advised its use was unlikely to be contrary to s 1. The Home Office also provided informal advice that stated the same. Following the second trial, BT received further and conflicting legal advice that led to it halting the covert trials. As there was no evidence to suggest either company acted in bad faith, it could be reasonably argued that any offending was the result of an honest mistake or genuine misunderstanding of the law.
- Both companies cooperated with the police investigation.
- The behaviour in question is unlikely to be repeated. After the first two trials, BT conducted a further single, public trial of the technology (in late 2008). Phorm now requests the user’s consent.
- The trial was of limited duration and limited application. The data gathered was anonymised and processed without human intervention and later destroyed.
- There has already been an investigation by a regulator, the Information Commissioner’s Office, which concluded there was ‘no evidence to suggest significant detriment to the individuals involved’ and took no action.
- There is no evidence to suggest that anyone affected by the trial suffered any loss or harm as a result.
- Taking into account all of the above, a court would be likely to impose only a nominal penalty.
Mr Hadik continued:
‘The CPS was also asked to consider if an offence had been committed under the Computer Misuse Act 1990 or the Copyright Designs and Patents Act 1988. The core alleged criminality in this case was the possibly unlawful interception of data, not computer modification or copyright. Additionally, the same factors that would weigh against a prosecution in relation to the alleged interception would also apply to a prosecution for another offence.’
