UK Information Commissioner's Office Clarifies Rules For Social Networking And Online Forums

In June 2013, the UK Information Commissioner's Office (ICO) published new guidance entitled "Social networking and online forums—when does the DPA apply?" (Guidance). The document explains what must be considered by organisations that run social media sites, as well as by individuals who upload or download personal data from online forums, social networking sites, message boards, or blogs.

The DPA does not apply when personal data is processed by an individual for the purposes of their personal, family or household affairs. The Guidance makes it clear that the "household exemption", which permits an individual to process personal data for his or her own use, does not apply to organisations, even if the organisation uses an employee to undertake the processing through his or her personal networking page. Individuals and groups of individuals (including clubs or societies) may only rely on the exemption if they process the data merely for domestic purposes.

Where the exemption does not apply, organisations as well as individuals will be treated as the data controller and will have primary responsibility for compliance with the DPA. The ICO suggests that those running networking sites will be controllers in relation to any contact information or other personal data about the users or subscribers. Equally, the site operator may be responsible for third-party posts. The ICO relied on the case of The Law Society and Others v Rick Kordowski, [2011] EWHC 3185 (QB), to...