Viewing Thread:
"DPA and member-based sites"

Hi,

If I was to build a member-based site (i.e. login based), would I have to register under the Data Protection Act?

I would not hold any mailing address or telephone details. I would not take or hold any financial details as this (if any) would be handled by the likes of Paypal etc.

Neil

Hi,

If I was to build a member-based site (i.e. login based), would I have to register under the Data Protection Act?

I would not hold any mailing address or telephone details. I would not take or hold any financial details as this (if any) would be handled by the likes of Paypal etc.

Neil

Hi Neilj99,

That’s a good question.

I’ve done a bit of research and although I can’t find anything that relates specifically to login information I think if you apply the principles of the DPA to the information you hold then you will have your answer.

The following are the DPA principles (Source: Information Commissioners Office (ICO)

[b]The Data Protection Act[/b] gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly.
The Act works in two ways. Firstly, it states that anyone who processes personal information must comply with eight principles, which make sure that personal information is:

� Fairly and lawfully processed
� Processed for limited purposes
� Adequate, relevant and not excessive
� Accurate and up to date
� Not kept for longer than is necessary
� Processed in line with your rights
� Secure
� Not transferred to other countries without adequate protection
The second area covered by the Act provides individuals with important rights, including the right to find out what personal information is held on computer and most paper records.

[b]Your legal Obligations[/b]
� Do I really need this information about an individual? Do I know what I'm going to use it for?
� Do the people whose information I hold know that I've got it, and are they likely to understand what it will be used for?
� If I'm asked to pass on personal information, would the people about whom I hold information expect me to do this?
� Am I satisfied the information is being held securely, whether it's on paper or on computer? And what about my website? Is it secure?
� Is access to personal information limited to those with a strict need to know?
� Am I sure the personal information is accurate and up to date?
� Do I delete or destroy personal information as soon as I have no more need for it?


I also have a members website and my reading of this is, the fact that you’re not holding any personal information other than [presumably] login name and password then there would be no need to register with the ICO however I am just a dog with no legal qualifications so best check this ICO self assessment guide out.

I hope this helps.

JTD