5 ms·
I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.go
by Torn 15y ago
I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.gov.uk/complaints/data_protection.aspx
- alexchamberlain 15y agoCan you post what you send and then we can all forward it?
- Torn 15y agoAdjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header. Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited. This can be verified by visiting http://lew.io/headers.php http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page. SECTION 10: Online utility that will show you the headers sent in your page request: http://lew.io/headers.php http://lew.io/headers.php Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857 http://news.ycombinator.org/item?id=3508857 Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 ------------------------- COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk: To whom it may concern, Please find attached my complaint against O2 under the Data Protection Act. When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. Regards,
- nandemo 15y agoThe tweet: > "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" Wow.
- rmc 15y agoTheir Twitter account ( https://twitter.com/#!/O2 https://twitter.com/#!/O2 ) has a burst of new activity. Looks like this has been passed up from Tier 1 support.
- jiggy2011 15y agoWhat are you guys sending as "supporting evidence"?
- Torn 15y agoI put links to the lew.io tool, this thread and O2's official twitter response. They seem to have taken down the header now though.
- urbanjunkie 15y agoO2 have responded, admitting the issue existed, and stating they've now fixed it. http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...
- iamichi 15y agoJust been looking into this and from the little info I can find, it looks like your phone number would be classed as personal information and so covered by the data protection act.
- forcer 15y agoYeah. Just submitted a form as well and got response from ICO that case work has been received. According to the law, companies that break Data Protection, can be fined up to £500,000 per case.
- pwaring 15y agoTechnically the organisation in breach would receive a penalty, not a fine. I realise that's a bit pedantic but there is a difference (fines can usually only be made and enforced by the courts). The ICO can also prosecute the company and officers in the criminal courts under some situations, including: "unlawfully obtaining, disclosing, or procuring the disclosure of personal data;" (I don't know whether this would count as unlawful disclosure or not).
- bjnortier_hn 15y agoI'm talking to someone now in their live chat so that I have a record of contact that I need to file the complaint.
- davedevelopment 15y agoFired them an email, don't really expect or care for a response, just want to make some noise about it.
- Torn 15y agoYou should absolutely expect a response. The ICO was set up exactly for cases like these and is funded by the taxes you are paying. Make sure you have filled in the correct complaint forms and provided your personal details. Sending an email with a link to the lew.io site or this HN thread is useless to them.
- pwaring 15y agoThe ICO does have a limited budget and powers though, so responding promptly to all complaints might not be possible.
- peterclary 15y agoThat page suggests you can only complain if you've been personally affected. Although I've been on O2 in the past, I don't have any evidence that the problem occurred during that time. I'm on Orange now, which appears to be unaffected. It's a pain, because I'd been thinking about switching back to O2 to get Visual Voicemail, which no other UK provider appears to be able to support.
- lewispb 15y agoI use hullomail which provides free visual voicemail for iPhone and android. It works well, so definitely worth a try.
- jiggy2011 15y agoI'm trying to do this but I downloaded the .doc complaint form off their website but it appears to be read only?
- alexchamberlain 15y agoYou have to save it before you can edit.
- warehouse 15y agoI am in the process of doing this now, also my contract expires this month with them and I will be moving to another provider - do we know it if only affects 02?
- drothlis 15y agoIt also affects GiffGaff, a "virtual network operator" that uses O2's network.
- warehouse 15y agoI am in the process of doing this now, also my contract expires this month with them and I will be moving to another provider - do we know it if only affects 02?