Data Protection Act

powerful_Rogue

GrumpyPL wrote: »

Thanks powerful_Rogue, I was wondering this as I run my own forum based out of the UK and I was not aware of these rules.

All the information I collect & store is the username, email address & selected password of the user, as well as their timezone.

They do have to put their DoB in to register, but this is only checked against once to ensure they're over 13, and isn't stored anywhere so I don't think that's relevant.

Cant post the link due to site rules, but search TheAdminZone - Great resource for all forum owners.

tommytynan123

OK so far - but what if the site in question then use your email to contact you to ask if you wish to rejoin after you have asked for total deletion and they replied that they don't do that but will never use the info.

wealdroam

tommytynan123 wrote: »

OK so far - but what if the site in question then use your email to contact you to ask if you wish to rejoin after you have asked for total deletion and they replied that they don't do that but will never use the info.

Then report them to The Information Commissioner's Office.

But according to your original post, that isn't what they said.

powerful_Rogue

tommytynan123 wrote: »

OK so far - but what if the site in question then use your email to contact you to ask if you wish to rejoin after you have asked for total deletion and they replied that they don't do that but will never use the info.

As ive already said, chnage your email address to a dummy one in the account settings and then move on.

If thats too much hassle, go into your account settings and tick the box that says you dont wish to receive any emails.

tommytynan123

powerful_Rogue wrote: »

As ive already said, chnage your email address to a dummy one in the account settings and then move on.

If thats too much hassle, go into your account settings and tick the box that says you dont wish to receive any emails.

Thanks all. Thats enough now. Can't get into the account to change anything because I've been deleted so can't log on.

paddyrg

I suspect the key will be PII - Personally Identifiable Information - so name, credit card number, NI number are PII whereas forum username, avatar, posts probably aren't.

InsideInsurance

There is no right to demand that data is deleted under the DPA. It has been suggested in Europe that there should be a right to be forgotten but it hasnt made it into statute yet.

As you say the DPA does have a requirement that data kept is accurate, complete, necessary etc and things should be updated or deleted as appropriate but that still doesnt give you a right to demand its deletion.

There are a lot of company that are supposed to sign up to the ICO scheme and pay the fee but its nothing more than a stealth tax. It doesnt change their obligations, other than to pay the fee, and doesnt change how the DPA applies to them.

Historically the ICO have accepted fairly weak rationalisations of why its necessary to retain data and in addition to the above comment about keeping it for "undesirables" trying to come back and reregister with a new username you could also add in things like responding to police or other regulatory body's demands to know the identity of a poster should their posts become part of a criminal investigation and/ or libel suit etc.

It may be easier if you say what your concerns are and if there are possibly better ways to address them beyond the already suggested "go in and change the details" option.