The European Commission has told Britain to change its laws, after concluding it incorrectly applied European rules in allowing the go-ahead of controversial behavioural ad targeter Phorm, which will monitor an ISP customer’s every web click to better target ads on partner websites.

The EC’s complaint (see statement) seems to disagree with the Home Office’s interpretation of what constitutes “intentional” interception of communications traffic - something allowed under UK law. The commission lodged an “infringement proceeding” on Tuesday, giving the UK two months to respond - if not satisfied, it could publish an “opinion” on the matter (more serious, but so far quite toothless) and finally could file suit in the European Court of Justice.

EC telecoms and media commissioner Viviane Reding said the UK had not properly implemented Europe’s 2002 ePrivacy Directive: “We have been
following the Phorm case for some time and have concluded that there are problems in the way the UK has implemented parts of EU rules on the confidentiality of
communications.

“I call on the UK authorities to change their national laws and ensure that national authorities are duly empowered and have proper sanctions at their disposal to enforce EU legislation on the confidentiality of communications. This should allow the UK to respond more vigorously to new challenges to ePrivacy and personal data protection such as those that have arisen in the Phorm case. It should also help reassure UK consumers about their privacy and data protection while
surfing the internet.”

Government’s scrutiny of Phorm has so far been overseen by the Information Commissioner’s Office, which monitors compliance under the Data Protection Act 1998 (DPA) and the Privacy and Electronic Communications Regulations 2003 (PECR). The commissioner last April said Phorm would be legal if, as promised, customers could choose to use the service or otherwise and would not be explicitly identified.

But the commissioner left up to the Home Office the issue of whether monitoring users’ web transfers constitutes an interception under the Regulation of Investigatory Powers Act 2000 (RIPA). The Register reports the Home Office earlier told Phorm it would be legal if ISP customers’ permission is sought, but The Reg reports some lawyers say permission would also be needed from every website visited by a user.

Reding also posted a video message, listing her many privacy concerns.

Update: Phorm issued an update, several hours after the EC’s announcement, in which it says the announcement “is obviously a matter for the commission and the UK government”. It says it’s technology has been declared legal by the government, and there’s “no suggestion to the contrary in the commission’s statement today”.

• Phorm Fights Back With Public Meeting; Still No Deployment Date
• Analysts: Behavioural Targeting Has Finally Taken Off In Europe
• Europe Warns Web Firms To Improve User Privacy Frameworks
• Advertisers, IAB Try To Counter Behavioural Targeting Sceptics