Terence Eden. He has a beard and is smiling.

Terence Eden’s Blog

Theme Switcher:

Can you use GDPR to Circumvent BlueSky's Adult Content Blocks?

· 4 comments · 1,200 words · Viewed ~13,043 times


A notification counter showing the number 3. The message next to it says I need to complete age assurance.

In the battle between the Online Safety Act and GDPR, who will win? FIGHT! I'll start by saying that I'm moderately positive on Online Safety. If services don't want to provide moderation then they shouldn't let their younger users be exposed to harm. The social network BlueSky has taken a pragmatic approach to this. If you don't want to verify your age, you can still use its services - but it…

The NHS shouldn't outsource its QR codes

· 8 comments · 600 words · Viewed ~1,222 times


Screenshot of terms and conditions with an hello email address.

QR codes are brilliant. They're a simple way to allow users to easily and quickly go to the right URl - no matter how complex. No more worrying about typing in long addresses or figuring out if that's a letter O or the number O. Scan and go! The best thing about QR codes is that they're free. It doesn't cost any money to generate one. They're an open standard with no middle-men. Users can go…

O2 UK's Weird MSISDN Lookup API

· 7 comments · 250 words · Viewed ~219 times


Sorry, we don’t recognise this number. Please try again.

It's always fun keeping your network inspector tab open. While looking around the O2 UK website, I found this page all about eSIMs. For some reason, it wants to know the user's phone number. I put in a random number, and it refused to let me in. Putting in a genuine O2 number let me through. So what is it doing to validate numbers? It is making an API call to this URl: …

Envelopes and GDPR

· 6 comments · 700 words · Viewed ~319 times


A letter addressed to me. Just inside the plastic window you can see the word "colonoscopies".

Privacy is a funny concept, isn't it? Very few people want the whole world to know what medical complaints they have. But most hospitals are open-access buildings, where the waiting rooms have large monitors to tell patients that their doctor is running late. A few years ago I was sat in the proctology waiting room. Anyone who knew me would have seen I was waiting for an bum doctor. They may…

How do you stop people accessing data they shouldn't?

· 7 comments · 950 words · Viewed ~385 times


A padlock engraved into a circuit board.

I used to work in a call centre for a Very Big Company. Every week, without exception, we'd get a bunch of new starters to train. And every week, without exception, a newbie would be fired after looking up a famous person's data. This was in the days before GDPR. There was a lot less general awareness of data protection issues. It didn't matter how often will drilled it into trainees' heads -…

Poorly folded letters lead to exposure of medical data

· 11 comments · 400 words · Viewed ~276 times


A letter addressed to me. Just inside the plastic window you can see the word "colonoscopies".

I returned home from holiday to a pile of letters. Mostly junk, a few Christmas cards, and something from the NHS. This is what the envelope looked like: As it happens, I'm not particularly concerned about who knows I had a fairly normal medical procedure. I've blogged a bit about it and Tweeted about the experience in an attempt to de-stigmatise it. Terence Eden is on Mastodon@edentReplying …

EBCDIC is incompatible with GDPR

· 33 comments · 800 words · Viewed ~43,912 times


Dutch text and a diagram.

Welcome to acronym city! The Court of Appeal of Brussels has made an interesting ruling. A customer complained that their bank was spelling the customer's name incorrectly. The bank didn't have support for diacritical marks. Things like á, è, ô, ü, ç etc. Those accents are common in many languages. So it was a little surprising that the bank didn't support them. The bank refused to spell their c…

"Advanced Network Error Search" - how to turn off Virgin's least helpful service

· 9 comments · 950 words · Viewed ~2,022 times


Screenshots showing adverts next to my mispelled domain.

tl;dr you have to keep complaining to Virgin for several months and then take them to the Communication & Internet Services Adjudication Scheme then complain to their Data Protection team by contacting them on LinkedIn. Background Virgin have a spammy DNS hijacking service. If you accidentally misspell a domain - for example example.coom - Virgin will pretend that the domain exists and serve…

£25 GDPR Compensation - why it's always worth complaining

· 2 comments · 500 words · Viewed ~407 times


A tiny lego Storm Trooper eats a chocolate coin.

Back in 2011, I sold all of my shares in my former employer and used the money to buy solar panels. I closed my account at the same time. Or so I thought Fast-forward 9 years, and I was surprised to receive an unwanted email from the corporate shareholding service. It was some nonsense about their corporate rebranding. I dropped them a note saying that I hadn't been a customer for many years…

Don't trust Cloudflare with your personal data

· 11 comments · 700 words · Viewed ~12,632 times


It has been over a year since I cancelled my Cloudflare account. They keep emailing me and haven't taken me off their marketing lists despite repeated requests. Their CTO told me he would investigate, but nothing changed. Their Data Protection Office hasn't respond to my requests. Cloudflare do not appear to respect the GDPR. I've escalated this to the highest levels of Cloudflare, but they…

GDPR and common sense

· 3 comments · 400 words


Some giant question marks standing in a field. Photo by https://www.flickr.com/photos/dbrekke/181939582/

Every so often, I get a glimpse into the thought processes of someone who has a very different view of the world to me. I don't deal with people's personal information often. So I was surprised to receive an email with a multi-megabyte spreadsheet called "Pay and Bonuses 2020". The email contained this doozy of a sentence: “Due to GDPR the attached file is password protected, I will send the p…

Can you trust CloudFlare with your personal data?

· 1 comment · 450 words · Viewed ~359 times


Email with CloudFlare's new privacy policy.

I'm increasingly concerned with the power that CDNs wield - and CloudFlare in particular. So I decided to delete my CloudFlare account. While they claim to have removed my account, they still seem to count me as an active customer. I wonder how many people bought shares in their IPO based on inaccurate customer numbers? Timeline 2019-08-04 I raised a support ticket to close my account.…