ICO warns TalkTalk over URL tracking service

Watchdog criticises ISP for failing to inform customers of trial

TalkTalk plans to press on with the monitoring of its customers

The Information Commissioner's Office (ICO) has issued a warning to TalkTalk after the ISP ran a covert trial that traced web sites visited by its customers in order to detect malware.

Information commissioner Christopher Graham has written to TalkTalk to voice his displeasure that the company had failed to inform its customers of the trial.

"I am concerned that the trial was undertaken without first informing those affected that it was taking place," he said in a letter to TalkTalk (PDF) released under the Freedom of Information Act by whatdotheyknow.com.

"I should be grateful if you could inform me as to the reasons why the trial was conducted without first informing customers, in particular how such a trial was in compliance with the relevant legislation."

Graham also chided TalkTalk for not bringing the matter to his attention when the two last met, suggesting that the firm should have realised the possible public outcry considering the furore over Phorm last year.

"In light of the public reaction to BT's trial of the proposed Webwise service, I am disappointed to note that this particular trial was not mentioned to my officials during the latest of our liaison meetings," he said.

TalkTalk has replied to the ICO, explaining how the technology works and claiming that no personal information is gathered.

ICO warns TalkTalk over URL tracking service

Watchdog criticises ISP for failing to inform customers of trial

"The service operates by looking at any web site URL that our network is used to access. The important point is that it is a web site URL accessed by our network, not individual customers, that is recorded," the ISP said.

"We do not look at, nor record, who is accessing the web site, as we simply look at where web traffic is routed to on our network."

TalkTalk communications director Mark Schmid told V3.co.uk that the firm understands the ICO's reasons for wishing to be informed of the trial.

"The ICO wanted us to inform them the trial was taking place so they were better prepared to answer questions on the issue, and on our part we accept that we should have informed them in advance," he said.

Nevertheless, Schmid said that TalkTalk is preparing to use the technology across its entire network, and provided some figures on its success.

"We are now preparing to press on with the rollout of this technology on our network, and think it will prove an invaluable service. In the trial period alone we saw customers try to access over 75,000 web sites that contain malware, " he said.

However, the ICO told V3.co.uk that it has yet to draw a line under the issue.

"The ICO is currently looking into the process by which TalkTalk collects data about web sites visited on its network," the regulator said.

"We have requested further details about how data is used, and will continue to monitor this service to ensure that it complies with the Data Protection Act. "