Urgent help from uk xenforo users

[ineedhelp]

Someone said they can have my site shut down because I don't offer members an account deleting option.

I'm obviously using the xenforo forum system.

So under the UK Data Protection Act. Is this true? Xenforo forums doesn't offer this open to users. So how is it the site owners fault?

I Can delete people's account if they request but it's not mentioned on the forums that members can request to have there account deleted.

Does the data protection act really apply in this situation? Surely xenforo must have thought all this through ?
Please reply.

 

[Paul B]

Unless the user in question has a static IP address, banning a single IP address won't affect them.

If you ban an IP range then anyone using an address within that range will be affected.

IP addresses are not allocated by street, they are allocated in blocks to ISPs.

 

[Floris]

IPv4 range is single to three digits, in four blocks.

0.0.0.0 to 255.255.255.255 *to keep it simple

Assuming someone has a dedicated IP and they're the only ones using it: 213.23.45.187 would then be that individual's modem at home using the assigned IP. (or whatever the setup situation is)

If you ban 213.23.45.*
Then you ban 213.23.45.0 to 213.23.45.255, blocking out potentially up to 254 others.

Of course, if someone has a dynamic range, such as 213.23.45.*, and despite an individual ban they return and return, you can limit his options by using * (wildcard) to cover that dynamic range.

Note that if you ban 213.23.* that you ban every combination of 213.23.0.0 to 213.23.255.255 => that's a damn lot of potential users that most likely have nothing to do with this one individual.

Note that a user that's abusive and doesn't take the request to no longer visit the site (if they dont like it, why bother right) is turning malicious by deliberately bypassing a placed ban, you could perhaps consider this unauthorized access. Anyway, note that the user is persistent can just use any of the millions of proxy or tor hosts, get a random shared host with php shell file and bounce through it, etc. There are basically unlimited methods to bypass a ban, unless you run your site as an intranet with deny everybody, and only allow a unique set of ip addresses to join (or whatever).

I think it's bad practice to ban a complete range over an individual.

Btw, create a log file with a timeline of the events, linking to screenshots and .txt log files.
If abuse happens, you remember it later and have a more detailed record of it than the other party.
And if abuse continues, you grow a log file that you can use if it ever goes to court.

Make it clear to the user that you two clash, and appear to be unable to resolve it. That since it's your site you prefer to discontinue communications and that the user isn't welcome to the site anymore. That bypassing a set ban is considered unauthorized access.

That way your log file also has an email reference that you've done your best and to your upmost ability to clarify on a mature level that someone's not welcome on your site. Any attempt beyond that could be considered deliberate.

Anyway.

Don't accept the nonsense from a user, don't focus on it too much. Don't publicly fight it out or discuss it on your site.

Consequences are not yours, it's the abusive user who's simply not welcome. Ban the accounts, over and over again. Keep a log of it. Ban the IP and email addresses used, over and over again. etc.

Don't lie awake at night over some douche that is causing you problems. Sleep well at night knowing you're not doing anything wrong and that the abusive user might sleep a bit lighter than you.

 

[ineedhelp]

I've added the following text to the T&C:

We do not delete member accounts once they are created nor do we delete any posts made by the user if the user ever decides to leave the site.

This is fine? Any improvements?

 

[Floris]

This is what I've put in my ToS: And we also have a line that says we're constantly improving our ToS and by participating on the site they've automatically agreed to any ToS changes. As a courtesy we always announce bigger changes. Users can always disagree to the new terms and opt-out by no longer using the site.

As a policy we do not prune user accounts, unless they have zero posts, or their content. We believe a user has actively decided to participate in a community, and understands that submitted content such as a profile, or a post, can be retained at our discretion (usage rights). In return we can offer to change your username and email address if you desire to nullify your account.

 

[MGSteve]

She said as my website is a hobby and for personal use then it doesn't fall under the DPA.

Ah, that's a point worth remembering....

 

[Slavik]

I've added the following text to the T&C:

We do not delete member accounts once they are created nor do we delete any posts made by the user if the user ever decides to leave the site.

This is fine? Any improvements?

You are exempt from notification and most of the other provisions of the Data Protection Act.

Specifically you are exempt because:

Processing for the purposes of keeping accounts relating to any business or other activity carried on by you, or deciding whether to accept any person as a customer or supplier, or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments and deliveries are made or services provided by you or to you in respect of those transactions, or for the purpose of making financial or management forecasts to assist you in the conduct of any such business or activity.