XF 1.4 Delete one user's IP addresses

[Alexander Firth]

I've had a request from a user to delete their stored IP addresses. I believe under UK law I now have to do this, so how can I?

I don't know if this is a feature in 1.5 (I'm still running 1.4 for now), but if it isn't it should be really

 

[Mr Lucky]

I didn't know that about UK law. Which law is it?

Someone had better tell the government:

https://www.gov.uk/help/privacy-policy

 

[Alexander Firth]

I didn't know that about UK law. Which law is it?

Someone had better tell the government:

https://www.gov.uk/help/privacy-policy

They collect it yeah, and so do we without them signing anything etc. That isn't the issue. The issue is that if a user actually comes and asks you to delete a piece of data of theirs that you hold, I believe you have to under data protection.

"An IP address in isolation is not personal data under the Data Protection Act, according to the Information Commissioner. But an IP address can become personal data when combined with other information or when used to build a profile of an individual, even if that individual's name is unknown."

As well as IPs XenForo stores email addresses and usernames, which build up a profile. This qualifies the IP as personal data under the Data Protection Act 1998, as ruled in case law.

Because we have the ability to do so, we must remove personal data on request under the data protection act.

P.S. no need to be rude.

 

[Martok]

I'm guessing that the user wants the IP addresses deleted because they believe them to be personal data.

An IP address isn't necessarily personal data as several people can be accessing the Internet from one or multiple devices from the same IP address. Also the IP addresses are used for legitimate purposes, not for targeting adverts etc at users. Also IP addresses are only retained for a period of time set in the ACP (I think).

You have probably read these but if not, they have some useful information in them.

https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf

https://ico.org.uk/media/for-organi...networking-and-online-forums-dpa-guidance.pdf

 

[Martok]

As a follow-up to my last post, IP addresses are really only kept on forums to check for problems like the same user registering multiple accounts, particularly spammers.

You can change the length of time that IP addresses are retained for. In ACP > Options > Logging Options it's "Delete IP usage data after X days".

 

[Mr Lucky]

The issue is that if a user actually comes and asks you to delete a piece of data of theirs that you hold, I believe you have to under data protection.

Thanks for clarifying. I didn't know that either.

P.S. no need to be rude.

I agree totally. There's never any need to be rude. IMO.

You can change the length of time that IP addresses are retained for. In ACP > Options > Logging Options it's "Delete IP usage data after X days".

So presumably setting it to 1 day would comply with this law for that user, but not ideal if you want to use other stored IP addresses for the reasons you mention. It can be useful for the reasons you mention, identifying spammers, banned users rejoining etc.

A per user or user group setting would be more useful.

 

[Dakota Storm]

All you really have to do is disassociate the profile from the ip address, change the profile name, email address etc