The 118800 service we and other media outlets reported on a fortnight ago still seems to be out of action. The whole issue raises privacy and regulatory issues which, as digital citizens, we should all take up with the Information Commissioners Office and OFCOM. The power is in your hands.
How it works: The 118800 service wasn’t designed to give out mobile numbers. It works by contacting the requested party and letting them know the ‘requesting party’ is looking for them and asking if they wish to speak with/contact them. This is enabled by text or a connecting call after the verification call completes.
The company has provided a facility so people can op-out and become ex-directory . . . . except demand has clearly overtaken them and numbers now have to be emailed to them in order to prevent being contactable. Nearly three weeks after going public the site is still down due to excessive demand.
The issues: This directory enquiry (call completion) service sits outside the regulatory framework for directories and directory enquiry services in the UK, which in turn fall under the remit of OFCOM.
OFCOM has established a national directory database managed by BT, called OSIS. OSIS is the official database and also contains ex-directory numbers.
All 118 providers offering telephone numbers are entitled to access OSIS or receive the information from OSIS subject to the regulatory framework required by OFCOM.
Mobile operators pass subscriber information to OSIS under obligation but only where a customer has specifically requested that they want an entry in a directory or directory enquiry service.
The 118800 service does not fall under any definitions of a directory enquiry service subject to the regulatory framework described above. The company is not entitled to access OSIS data or receive data from OSIS or the mobile operators. The 118800 service is a purely private system.
How many databases should you need opt-out of to become ex-directory? Surely once is enough!
The 15 million names, addresses and numbers obtained from third parties are subject to two legal constraints:
Data Protection Act 1998 – the DPA. Under the DPA those collecting your data need to make you aware in a clear manner of the intention to place your details in a directory service and the purposes of that directory and of any disclosures of your data. You are entitled to make an informed decision whether you wish to be in the directory or not. In short, your consent is required; an opt-in. Neither 118800 or the company that collected your data has any legal obligation to process your data in this way.
Regulation 18 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 – the PECRs. Reg 18 states: The personal data of an individual subscriber shall not be included in a directory unless that subscriber has, free of charge, been -
(a) informed by the collector of the personal data of the purposes of the directory in which his personal data are to be included, and
(b) given the opportunity to determine whether such of his personal data as are considered relevant by the producer of the directory should be included in the directory.
In short, the party collecting your data should have told you about the 118800 service and given you the clear opportunity to agree – either by an opt-in box or by an opt-out box.
All 118 services are regulated by PhonePayPlus which is an agency of OFCOM, the telecoms and media regulator. PhonePayPlus regulates services by a Code of Practice – the Code. The 118800 service is incompatible with the Code which
(a) defines telephone directories as ones that supply phone numbers
(b) requires companies providing call completion services to disclose telephone numbers to persons who demand a number and
(c) requires that services must not or must not be likely to result in any unreasonable invasion of privacy.
- Opt-in consent has not been sought from any person in the 118800 directory
- Individuals listed in the directory without their knowledge or agreement will consider contact via the call completion service to amount to an unreasonable invasion of their privacy
- Those who consider they are already ex-directory under the official national OSIS database are not so as far as 118800 is concerned
If you are concerned: Ask 118800 to verify what data they have on you free of charge by emailing 118800 (the email address is in their privacy policy at 118800.co.uk)
Points of Redress
Raise your concerns or complain directly to the Information Commissioners Office (ico.gov.uk)
Approach OFCOM with your concerns (ofcom.org.uk)
Contact PhonePayPayPlus too if you feel the need (phonepayplus.org.uk)
118800, or rather their legal representatves have been in touch with us. We are happy to offer a right of reply via this update (03/08/09 – 18.30pm). The content that follows is supplied by 118800’s owners, Connectivity, via their lawyers, Field Fisher Waterhouse LLP.
1. Privacy by design
You briefly refer to the 118800 service and how it works, but what you fail to point out is that 118800 is a leading example of “privacy by design”; in other words, a business model that has been developed to address the privacy and data protection issues affecting it. In case you are unaware of it, “privacy by design” is an initiative that is being championed by progressive regulators like the Canadian privacy commissioner and the UK Information Commissioner. 118800’s functionality has been specifically designed with privacy rights in mind and that is the reason why the numbers are not given out.
2. Regulatory framework
You state that 118800 ‘sits outside the regulatory framework for directories and directory enquiry services in the UK’. This is factually incorrect. The 118800 service is regulated by the Information Commissioner, OFCOM and PhonePay Plus (previously ICTIS) and Connectivity has engaged with all of them since well before it started operating. Three years ago, Connectivity carried out a privacy impact assessment and sought advice from the Information Commissioner’s Office (“ICO”) to ensure that 118800 was both legally compliant and privacy-friendly.
3. 118 800 does qualify as a directory enquiry service
PhonepayPlus and the ICO have both confirmed that 118800 qualifies as a directory enquiry service.
4. Inaccuracies in your assertions about data collection and use
· Contrary to the implication of your article, UK law does not state that mobile operators must pass subscriber information “only where a customer has specifically requested that they want an entry in a directory or directory enquiry service”. The law states that mobile operators are subject to data protection legislation that says that customers must be given the opportunity to determine which of their data may be included in the directory. The ICO interprets this as the right to opt-out of being in a directory – so prior opt-in consent is, in fact, not the default legal position.
· Connectivity is indeed entitled to access OSIS data and receive data from OSIS or the mobile operators, subject to the data protection requirements mentioned above.
· There is nothing in the Data Protection Act that says that opt in consent is required to collect and use people’s data. This is a massive misconception. There are a number of legal grounds that justify the collection and use of personal information beyond consent.
· In the context of directory enquiry services, the Privacy and Electronic Communications Regulations are very specific in this area and require both informing individuals and giving them the opportunity to say whether they are happy to be in the directory, which is exactly what happens when someone’s number is requested through 118800.
In summary, at all times during the provision of the 118800 service, privacy is paramount, and Connectivity is continuing to work and liaise with the regulators to ensure that 118800 follows the legal requirements and delivers a privacy-friendly and quality service to its customers.
