UK Law - the Data Protection Act and online forums?
 

Hi all,

Just a very quick one really.

How does the DPA apply to online forums? Given accounts are largely set up using nicknames etc and the only real personal info stored could be the email address and date of birth (and both of these are most likely not really personally identifiable anyway) is there any requirement to register under the act?

If someone made a DPA request, is there actually anything we have to send them? All of their information and posts are voluntarily supplied and are stored under their username and not their real name.

I've started working on our various policies in this regard and for Data Protection I currently have:

---

As we do not require any personally identifiable data OTHER than users email addresses and dates of birth, and all posts and information provided is on a voluntary basis, we are not strictly subject to the DPA. We have decided however to abide by the spirit of the act and therefore it is your right to make a request to The Digital Fix with regards to receiving a copy of all personally identifiable information we hold on you. There is a charge of £10 to cover the time taken to retrieve this information. The DPA only covers very limited data and we hold an even smaller subset of that information. We are NOT required to supply copies of any posts made by you although we are happy to supply copies of all posts that mention you by your real, identifiable, name.

We are not an ISP and email retention laws are not applicable. It is forum policy NOT to discuss any user by name in emails and all references are made only to user accounts.

To make a DPA request, send us an email using the site's contact form facilities. We will then reply with details on administration charges and the address to send the information along with a written postal request. Once the fee has been received, we will supply the following information within forty (40) days from the receipt of the request:

Username
Email Address
IP Addresses
Homepage
Instant Messenger Addresses
Details of any infractions listed against your account
Any posts that mention you by name

As required by the act, we only store personally identifiable information for as long as it is required. Therefore accounts that are temporarily banned retain all information against them, however any accounts permanently banned are automatically purged of information within 28 days of banning, retaining only the account username. If requests are made after this time, only the information we have left will be supplied. You can also request that posts that reference you by name are also deleted, but this does NOT include posts that mention your non-personally identifiable username. The only exception being where username matches your real name.

---

Is this all correct and above board?

Any help or comments would be appreciated as I'm sure it's a subject that a lot of UK board owners will come across.

Thanks,

Colin