Data Protection Act

tommytynan123

I won't go into the reasons but I have asked a forum to delete all records kept about me. This is their answer:

We no longer delete users in total.
There were so many instances of people attempting to come back using different usernames.
You are de-activated you can no longer post and we have no interest whatsoever in any of your details.
However should you ever attempt to re-register, we will know as the details that are kept will show up.

To me that breaches the DPA rule of:
kept for no longer than is absolutely necessary

any thoughts please?

powerful_Rogue

tommytynan123 wrote: »

I won't go into the reasons but I have asked a forum to delete all records kept about me. This is their answer:

We no longer delete users in total.
There were so many instances of people attempting to come back using different usernames.
You are de-activated you can no longer post and we have no interest whatsoever in any of your details.
However should you ever attempt to re-register, we will know as the details that are kept will show up.

To me that breaches the DPA rule of:
kept for no longer than is absolutely necessary

any thoughts please?

I run several forums and never delete accounts. It can make following previous discussions extremely difficult if posts are missing.

What personal details does the forum hold? Simply log in, change your email address to a made up one - can use a site like 10minutemail.

Have you have disclosed any information in posts that can easily identify you? I doubt it as that would be a very stupid thing to do!

However if you have, ask the forum team to remove those details.

Regarding the DPA and forums - Have a look at this document. Depends on the type of forum you was registered on.

https://ico.org.uk/media/for-organisations/documents/1600/social-networking-and-online-forums-dpa-guidance.pdf

wealdroam

tommytynan123 wrote: »

I won't go into the reasons but I have asked a forum to delete all records kept about me. This is their answer:

We no longer delete users in total.
There were so many instances of people attempting to come back using different usernames.
You are de-activated you can no longer post and we have no interest whatsoever in any of your details.
However should you ever attempt to re-register, we will know as the details that are kept will show up.

To me that breaches the DPA rule of:
kept for no longer than is absolutely necessary

any thoughts please?

Doesn't the forum owner's last reason: "However should you ever attempt to re-register, we will know as the details that are kept will show up." strike you as a very good reason for keeping that data?

I certainly believe that is a valid reason under The Data Protection Act for keeping data.

Or to put it another way... it is absolutely necessary to keep that data to protect themselves from 'undesirables'.

tommytynan123

wealdroam wrote: »

Doesn't the forum owner's last reason: "However should you ever attempt to re-register, we will know as the details that are kept will show up." strike you as a very good reason for keeping that data?

I certainly believe that is a valid reason under The Data Protection Act for keeping data.

Or to put it another way... it is absolutely necessary to keep that data to protect themselves from 'undesirables'.

Lol - I've been outed!
The site have said that they have not signed up to the ICO guidelines ? as they don't have to being non-profit?
Is that correct? Doesn't sound correct to me.

Collabora

tommytynan123 wrote: »

Lol
The site have said that they have not signed up to the ICO guidelines ? as they don't have to being non-profit?
Is that correct? Doesn't sound correct to me.

They are wrong. Any UK based business/organisation that holds personal details of customers on manual or computer files must legally register with the ICO (£35 a year)

The Data Protection Act 1998 requires every data controller (eg organisation, sole trader) who is processing personal information to register with the ICO,

GrumpyPL

Collabora wrote: »

They are wrong. Any UK based business/organisation that holds personal details of customers on manual or computer files must legally register with the ICO (£35 a year)

For these purposes though, is a forum username & an email address considered personal details?

powerful_Rogue

Collabora wrote: »

They are wrong. Any UK based business/organisation that holds personal details of customers on manual or computer files must legally register with the ICO (£35 a year)

Wrong.

The section 36 exemption is based on the purposes for which
the personal data is being processed, not on the nature or
content of the data itself. It applies whenever someone uses an online forum purely in a personal capacity for their own
domestic or recreational purposes.
It doesn’t apply when an organisation or an individual uses
an online forum for corporate, business or non domestic purposes.

Read the link I posted in the second post.

powerful_Rogue

tommytynan123 wrote: »

Lol - I've been outed!
The site have said that they have not signed up to the ICO guidelines ? as they don't have to being non-profit?
Is that correct? Doesn't sound correct to me.

Again, read the link in the second post. Forums and the ICO.

Collabora

GrumpyPL wrote: »

For these purposes though, is a forum username & an email address considered personal details?

depends on what info they ask and hold, some forums will ask for DOB, address, real name.

powerful_Rogue

Collabora wrote: »

depends on what info they ask and hold, some forums will ask for DOB, address, real name.

So your initial post of

They are wrong. Any UK based business/organisation that holds personal details of customers on manual or computer files must legally register with the ICO (£35 a year)

is incorrect, I depends on what information they hold?

But then, its just as easy to go into your profile page and alter/remove those details.

GrumpyPL

Thanks powerful_Rogue, I was wondering this as I run my own forum based out of the UK and I was not aware of these rules.

All the information I collect & store is the username, email address & selected password of the user, as well as their timezone.

They do have to put their DoB in to register, but this is only checked against once to ensure they're over 13, and isn't stored anywhere so I don't think that's relevant.