[solved] Does the GDPR apply to a forum?

[FordGT90Concept]

If you use GDPR-compliant forum software, it should cover most of the bases (especially consent and notice).

 

[Mindweaver]

I mean how big of a forum are you expecting qubit? 1 or 2 hundred million users? I mean are we talking user count Facebook size or something smaller? I mean I already have you in jail over this GDPR. I know it's in place for people like you.. heheh j/k I think everyone is over thinking this forum. Just use the KISS method. Something like Username, password and maybe age verification. Once, your forum start generating real money then look into how to expand it and seek help from a real Laywer not users on a tech forum.. I mean really that will hold up in court. -you, "No really a guy on TPU told me it was ok..."..

 

[dorsetknob]

"No really a guy on TPU told me it was ok..."..

Wot we are a respectfull lot

 

[qubit]

Lots of great responses here people. I'll hopefully have time to reply properly this evening. If not, tomorrow evening.

@Mindweaver Look, nothing less than 20 million users is good enough for me, muhahaha! But seriously, it could be that this applies down to even one user for all I know. Also, as someone said, it might depend on what registration info I ask for. EDIT: In practice, if I have 100 users after a couple of months I'll probably be doing well, lol.

 

[jsfitz54]

I work for a large national charity and our volunteers are not exempt from legal exposure.

Any thoughts on if it's run as a private members club?

 

[dorsetknob]

Private members Club or even if its just a Family only website i expect data laws still Apply
I'm afraid that's the way things are rolling these days

 

[Bill_Bright]

Edit: "qubit" is a volunteer at a non-profit.

It is not a "non-profit" unless legally set up as a non-profit organization and properly registered with and recognized by the Charity Commission (in the UK), IRS (in the US), and so forth depending on the country you live in.

You can't just claim an organization you start is a "non-profit" - even if it never makes a penny in profits.

The exception might be if absolutely no money exchanges hands for any services rendered by that organization. That means no ad money, no donations accepted, no fees charged or accepted, including "in-kind" exchanges, etc. 100% of all expenses would have to come out of your own pocket.

I say "might be" because that is a very gray area so guess what? You need to consult a lawyer or solicitor.

Once, your forum start generating real money then look into how to expand it and seek help from a real Laywer not users on a tech forum.

So it is okay to take the advice from "users on a tech forum" before the company starts generating real money??? And only after it starts making money do you seek legal advice to learn how you should have set it up correctly in the first place??? Ummm, no!

You are starting a business. Learn how to do it right from day 1.

“It’s better to beg for forgiveness than to ask for permission” does not work when taxes (for profits or write-offs) and legal liabilities are involved.

 

[Mindweaver]

So it is okay to take the advice from "users on a tech forum" before the company starts generating real money??? And only after it starts making money do you seek legal advice to learn how you should have set it up correctly in the first place??? Ummm, no!

You are starting a business. Learn how to do it right from day 1.

“It’s better to beg for forgiveness than to ask for permission” does not work when taxes (for profits or write-offs) and legal liabilities are involved.

Clearly, I said it was not ok to take legal advice from a tech forum. Plus, he is asking about a forum and not how to start a money making "business". This thread is starting to get way out of hand and off topic. If it keeps going in this direction I'll close the thread. Stay on topic

 

[Bill_Bright]

Plus, he is asking about a forum and not how to start a money making "business".

Except he specifically stated in his opening post he does plan to accept money from ads to help pay the bills. That's a business so it is part of the topic.

Whether it makes a profit, a loss or breaks even, that's really immaterial because of the potential tax issues that will arise. And if any personally identifiable information is collected (to include email addresses and IP addresses) then potential liability issues could arise too.

While I have taken some business courses, and have my own LLC for my little computer repair shop (which, BTW, cost me less than $800 to set up), I sure am not a lawyer or an expert on taxes, LLCs or non-profits.

Unless someone on this site steps up and claims to be such an expert and offers to give such legal advice, any advice we give - except to see a real expert - is just a waste of everyone's time, especially qubit's since he will be the one stuck with any fees or fines or both, should some issue arise.

I am not trying to run this thread OT. I just don't want qubit to get into any legal troubles for something that could have easily, and inexpensively been prevented from the get go. That's all I'm saying.

 

[qubit]

Clearly, I said it was not ok to take legal advice from a tech forum. Plus, he is asking about a forum and not how to start a money making "business". This thread is starting to get way out of hand and off topic. If it keeps going in this direction I'll close the thread. Stay on topic

Everyone: this is a really interesting and helpful thread for me, with some great replies and I'll read through it properly within the next 24 hours and give a proper reply, so please don't do anything that could trigger a thread closure like MW has said, or other mod action.

 

[Tatty_Two]

Any thoughts on if it's run as a private members club?

I doubt that it would be given Charitable status by the Charities commission and if so we would likely have to hand back about £60 Mil worth of donations and also pay a lot more VAT

 

[jsfitz54]

I doubt that it would be given Charitable status by the Charities commission and if so we would likely have to hand back about £60 Mil worth of donations and also pay a lot more VAT

I did not mean your charity, sorry for the confusion.

I meant this for qubit's plan, the OP. That's what I meant by "if it's run as private members club?"

 

[qubit]

Ok peeps, my reply is a bit later* than billed, but I've finally read through the whole thread and I'm really grateful for all the helpful replies.

Here's the takeway that I've gotten from all your responses.

- Ask hosting company and lawyer about the legalities and do it before setting anything up
- Possible insurance policy against getting sued or other legal action
- Type of data stored matters - some of the data types listed by Sasqui, eg IP address, email address etc will certainly be used by any forum software. I do plan to have people register anonymous accounts, like on TPU, which will use this data
- Technical security against intruders matters. I was already very aware of this already and won't go ahead with it until this sorted and proper database backups are in place. This is also a critical requirement
- Brexit could change the picture dramatically over time, just to keep things "interesting" so I'll have to keep a close eye on this. Please don't start talking brexit/politics though which could get this thread shut down. It's a factor, so I mention it here
- After all this, according to @the54thvoid, the full weight of the GDPR would apply to me, so the project may never take off. Time to shoot the messenger...

Again, I'll certainly be taking professional legal advice before creating a live forum.

Finally, a special thanks to @Bill_Bright for stressing the importance over several posts and in detail, of understanding the legalities and of covering my ass so I don't get nailed.

*All my real life friends know that my timekeeping for anything is often terrible. If I promise to come over between, say, 8:30-9pm, I'll probably be there at 9:30pm...

 

[sandramorgan]

Trying to simplify GDPR is something I've been trying to get my head around the past few months! I found this useful free GDPR Checklist download here that's helped me as a small business owner, you may also find useful https://www.infinitygroup.co.uk/gdpr-checklist/

 

[qubit]

Wicked, thankyou. Getting pro legal advice is something that takes time and I still haven't gotten round to yet.

 

[qubit]

Ok, I've finally got my definitive answer and it's not what I wanted to hear: as I suspected, the GDPR does apply to an individual who's running a forum in a non-profit manner, even with no ads. This means that all the onerous conditions and sanctions will apply.

As I'm just one guy with shallow pockets who wants to run a hobby forum, that dream is now gonna have to die as I don't want to be liable for potentially getting sued with possible heavy sanctions applied to me. You can just imagine a disgruntled member who's just been banned wanting to get their own back at me through the GDPR for the kind of trouble that this can cause.

The answer is definitive, because today I asked a couple of people at work who manage the GDPR for the organisation (a fairly large one) who are experts in this. This saved me the expense and inconvenience of going to a lawyer.

I may resurrect this dream one day if my circumstances change, but don't hold your breath.

I see that TPU has now become GDPR compliant with that consent screen that came up the other day before I could go any further, so W1z and his management team now also have that responsibility on their shoulders.

MODS, please don't close the thread, as I want to people to be able talk about this if they want.

 

[Vayra86]

It really doesn't matter. Everyone who handles personal data and aggregates it in a database is subject to GDPR. And rightly so.

The intent of GDPR is precisely that: everyone who has access to other peoples' personal and privacy sensitive data is subject to the same principles. The idea of this is to effect a change in how we think about data and privacy because the way it is now realistically is boundless and causing lots of issues, the half of which we haven't even remotely seen or considered.

But then again complying to GDPR really isn't rocket science. Especially if you are right now starting something new, it is MUCH easier to comply to GDPR standards than it is coming from an existing database with all its quirks, flaws and lost safeguards over time. The longer a database exists the higher the risk that somewhere along the way some critical information is leaked; either intentionally or unintentionally, even just simply because you make use of the data and because people tend to ask for help on things.

 

[FordGT90Concept]

GDPR is regulation, regulations have cost, and GDPR has implementation costs that serve as an impediment to free speech. Feels @qubit, feels. Hopefully the GDPR noose will loosen some day so small sites like you're aiming to make will become feasible again.

 

[Bill_Bright]

I am all for free speech but not at the expense of others - especially if that speech involves falsehoods.

Freedom of speech does not imply the freedom to say whatever you want, whenever you want, wherever you want.

Freedom isn't free. My right to privacy supersedes your right to expose my private information while I maintain my status as a private citizen. And for sure, you should not be able to profit from my personal information I did not give you permission to have or use.

The intent of freedom of speech is to give free people to right to protest their governments and unfair practices imposed on those free people by their governments and other "organizations" - not fellow "private" citizens.

 

[qubit]

@Vayra86 Sure, GDPR is great if you're the user who's organisation has data on you, but not so when you're a small operator. Of course it's not rocket science, but the fact that a user can demand all data held on them and in particular this right to be forgotten are problematic. Imagine a user with 5000 posts who's been banned or had some other infraction imposed on them demanding that all their posts be deleted. They now have that right and could compel the forum in law, which would put big holes in the forum threads. It could well happen to TPU at some point, so what do they do then?

Thanks @FordGT90Concept, I hope this becomes more practical at some point for me without worrying about liability too much.

What I'll do is let the situation stabilize and then take stock, whenever that will be. It could well be that there will be services that are willing to take on this responsibility and liability for a monthly fee and it's likely that forum software itself will be hardened and tuned to be GDPR compliant. All this put together might mitigate the risk and liability sufficiently that I'll be satisfied with the level it's at and would consider doing this again. I reckon it's gonna be longer than shorter though before this happens, if it does.

@Bill_Bright Sure, it's great for protecting us against the likes of Facebook and Cambridge Analytica and it's those kinds of abuses which have rightly helped shaped this regulation. It's just unfortunate that it places a big burden of liability on someone wanting to start up a small hobby forum such as me, as I've explained above. Can't be helped, I guess.

 

[Bill_Bright]

It's just unfortunate that it places a big burden of liability on someone wanting to start up a small hobby forum such as me, as I've explained above. Can't be helped, I guess.

Yes, it does put the burden on you, but I don't really see that as such a burden as it appears at first glance. You can minimize your risks by minimizing the amount of personal information you collect. For example, I assume your real name is not qubit. I also assume you have not provided your phone number, street address or your SSN/IN. If you don't collect those, you don't have to worry about protecting that data.

What do need to ensure is you do due diligence in keeping your software current and data safe. If you demonstrate a lack of concern or care, like Equifax did, then you need to worry - unless you can afford their shysters... err... I mean nice lawyers.

 

[qubit]

Yes, it does put the burden on you, but I don't really see that as such a burden as it appears at first glance. You can minimize your risks by minimizing the amount of personal information you collect. For example, I assume your real name is not qubit. I also assume you have not provided your phone number, street address or your SSN/IN. If you don't collect those, you don't have to worry about protecting that data.

What do need to ensure is you do due diligence in keeping your software current and data safe. If you demonstrate a lack of concern or care, like Equifax did, then you need to worry - unless you can afford their shysters... err... I mean nice lawyers.

Did you know that even a username is considered to be personal data under the GDPR? An IP address, too. This wasn't the case before.

Sure, storing a minimum amount of data will help to shield against liability and the due diligence, but the risk is still there and the other things I've mentioned are still an issue. As I said, I'll look at this again when the new system has settled down.

Oh and why do you think my real name isn't qubit?! I'm a quantum animal.

 

[Bill_Bright]

I understand IP address, but user names are a bit different. Bill Bright is my real name so for sure that. But if there is no link between a made up and a real name, I have my doubts that is enforceable.

But governments, especially in free societies, need small businesses to succeed. So they just won't put such restrictions on them to prevent them from even starting to get off the ground. If you make a sincere effort to protect your client's data, your liabilities will limited too. You might still be forced out of business if hacked, but clients cannot come take your first born.

 

[FordGT90Concept]

GDPR is written to protect companies like Facebook and Google. Now, instead of facing litigation like they should, they'll just point to GDPR and say "we complied."

The point of this thread isn't to debate policy; however, that's probably better placed in The Lounge on its own thread.

 

[MrGenius]

I am all for free speech but not at the expense of others...

Define "expense". If it hurts your feelings, or offends you, I shouldn't be allowed to say it? Wrong. That's precisely why the freedom to speak my opinions is protected.

Freedom of speech does not imply the freedom to say whatever you want, whenever you want, wherever you want.

As long as you're not breaking any laws by doing so, it most certainly does imply such freedom.

The intent of freedom of speech is to give free people to right to protest their governments and unfair practices imposed on those free people by their governments and other "organizations" - not fellow "private" citizens.

Talk about falsehoods. Like I said, I'm free to speak whatever, about whomever, whenever, and wherever I want. So long as I keep said speech within the bounds of the law. That speech being about or directed at a government, an "organization", or a "private" citizen is totally irrelevant.

Listen, I get your points. But you're crossing some definitive lines and being a little hypocritical in doing so.