4

I will soon be running an internet-based public service which will physically be hosted in the UK on a virtual server. The virtual server is provided by the ISP. I was wondering if there is/are any legal requirement(s) to keep access logs, and if yes - for how long?

There is a Wikipedia article that touches this subject but I'm afraid my brain just can't grasp the legislative gibberish.

I believe there's EU law and there's UK law; and I do need to comply to both, right?

Can somebody explain this in pure layman's terms?

4
  • 1
    You're asking an internet forum for legal advice? Of a non-hypothetical nature?
    – jldugger
    Apr 17, 2010 at 17:51
  • It's hard to decide whether to close this as off-topic or too localised. I can only suggest you seek appropriate legal advice. Apr 17, 2010 at 21:41
  • 1
    @jldugger: People make decisions: business, technical, legal. They seek advices, and (surprisingly!) they do it in this forum, too. There are chances that somebody gets misguided in a technical question/answer, and this will cost money to the business. And same applies to this legal question. I would understand your point if this was some unique situation, but this is pretty standard stuff, affecting literally tens (if not hundreds) of thousands of websites hosted in UK. Is it so hard just not to respond if you don't know the answer?
    – mindas
    Apr 18, 2010 at 12:26
  • On the Internet, there are many armchair lawyers. However, the advice you get from any or all of them would not be worthy of the trust you're looking for. The problem is that with any given situation, there's probably a loophole or a rarely-applied provision of some law, and inevitably it will apply to your situation. This is why we pay lawyers big money: to catch all of these twists and apply the correct one to our situation.
    – Kevin M
    Apr 21, 2010 at 16:27

1 Answer 1

1

UK law and Statutory Instruments implement EU law (although the Government can be taken to court if it implements a law which contravenes EU law).

The most relevant pieces of legislation are the Regulation of Investigatory Powers Act 2000, the Data Protection Act 1998, and The Data Retention (EU Directive) Regulations. The Statute Law database is a good place to start.

RIPA specifies when you need to retain information, the DPA specifies when you need to get rid of it (unless you have a good reason not to). For most intents and purposes, the RIPA and DRR trumps the DPA: that is, the RIPA and DRR specifies the “good reasons not to” in the preceding sentence. Note, however, that if you’re just operating a website, then you’re not operating a Public Electronic Communications Network (PECN) or a Public Electronic Communications Service (PECS). You're definitely not a network, and a PECS is defined in the Communications Act 2003 as:

In this Act “electronic communications service” means a service consisting in, or having as its principal feature, the conveyance by means of an electronic communications network of signals, except in so far as it is a content service.

Thus, an ordinary website is a “a content service” and so not a PECS.

(Additionally, most of the regulations don’t apply to you unless the Secretary of State has written to you to tell you to apply them).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .