the parameter 'data' here does contain the filename yes but that is obviously only any use when the cgi program and the file are on the same machine

Well.... not quite. From the CGI docs (emphasis mine):

               $filename = $query->param('uploaded_file');
[download]

Different browsers will return slightly different things for the name. Some browsers return the filename only. Others return the full path to the file, using the path conventions of the user's machine. Regardless, the name returned is always the name of the file on the user's machine, and is unrelated to the name of the temporary file that CGI.pm creates during upload spooling (see below).

The filename returned is also a file handle. You can read the contents of the file using standard Perl file reading calls:

               # Read a text file and print it out
               while (<$filename>) {
                  print;
               }

               # Copy a binary file to somewhere safe
               open (OUTFILE,">>/usr/local/web/users/feedback");
               while ($bytesread=read($filename,$buffer,1024)) {
                  print OUTFILE $buffer;
               }
[download]

His use is still wrong, and the upload() method is clearer, though.