Personal data on forums

tiff

I run a forum site. Some of the members have been banned and 2 of those have requested all their personal details be deleted (ie email address, msn, user name, all posts).

Yesterday I received a pm from a new member on my forum saying the following:

I also know that several of the banned members have asked for there user details to be removed from your forum.
This includes such data as Usernames, Email address MSN address and any post that the individual has made

You have had over 2 months to action this request and therefore you clearly do not respect the privacy of the individuals you have banned from your forum

This clearly violates the data protection act.
You are required to comply with the Act; you have a number of legal responsibilities:

The fifth principle of the Data Protection Act states that 'personal data kept for any purpose shouldn't be kept for longer than necessary’
You are also required by law to remove any such data held, when requested by the individual that the data belongs to.

So, am I legally obliged to delete their membership?

Browntoa

well from the FAQ's (there is no hard an fast rule for time allowed by the looks of it)

Q: When should I erase personal information from our computer system? You should ensure that all information is erased if it is no longer required for business purposes

http://www.ico.gov.uk/Global/faqs/data_protection_for_organisations.aspx#fF42EF959-EA43-434B-8AFE-3CA945D48926

I would reply that you hold records of deleted accounts for xx months and add it to the forum rules for the future (if a member gets banned who's to say that some idiot won't try to take it further ?? I would retain relevant posts and membership details for a while, maybe also says if they wish to complain about being banned then email within 90 days stating the reasons )

tiff

Thanks for that link. So the actual posts made can remain for "business purposes" ? Deleting membership wont delete posts.

Browntoa

yes, I would say that is correct, the personal data is the users personal details

I think that it is prudent to state that personal details of banned members are retained for x months and that all posts will remain after that deletion when new members sign up....

Bossyboots

I am sure it has been mentioned on here before that the copyright of the posts on forum belong to the site owners and therefore are no longer in the domain of the poster.

On that basis, I would say that you can leave the posts. Certainly on all the forums I have been on (including this one) the posts of banned members are left on the boards (usually causing a string of threads discussing someone's ban, but there you go) unless they are in breach of the forum rules on posting.