Burnetts logo

Friends Reunited

Friends Reunited

Information law solicitor Natalie Ruane discusses old social media site Friends Reunited and the data protection issues surrounding it's closure.

Friends Reunited was one of the first social media platforms whereby you uploaded your personal details to a website and long lost friends could search and reunite with each other. When the Company declared that it was closing the website there were many friends and even now married couples reminiscing as to how they had reconnected through the site.  The question, however, that  remains is what will happen to the thousands of people’s information the website stored.

The website has the potential to use the data in 3 permitted ways under the Data Protection Act 1998 (DPA):

Sale:

This is only permitted provided it is provided for in the website’s privacy policy, which it is. Should the Company be purchased then the buyer may buy the data as part of the sale of the Company in order to continue running the site.

Retention:

The website should retain all the records for a reasonable length of time after closure for legal and administrative purposes. This is explained in the websites privacy policy and is normal in the course of data retention.  There is no definitive timescale and the legislation only refers to a ‘reasonable period’ of time.  This, however, could be up to 7 years due to legal limitations.

Even where data is retained there is an ongoing duty that the data is stored safely and securely. Friends Reunited servers are based in Scotland, but also some third parties store data in the US. If data is to be retained for a prolonged period then provisions need to be in place to ensure that the above security is maintained. With regard to the storage in the US this equally interesting in relation to the breakdown of US Safe Harbour rules.

Deletion:

Following the retention period, all records must be deleted. This is in line with the legislation that data must only be kept for as long as the purpose dictates. The purpose for the collection of the information was for the website to reunite friends. When the website no longer functions, the purpose for the data no longer exists. Even where the Company has deleted its data, public information may have been copied by fellow users, third parties etc. and so other copies may exist.

Users of the website may ask ‘but this is my data – why should they (Friends Reunited) be able to delete this’?  For those concerned about the data which may be lost, Friends Reunited has agreed to provide users with the option to download some of their personal data, but only for a limited time and only a limited amount of data. This is not mandatory and in other instances where social media firms close, it may not be offered.

The above highlights that whilst we may use sites such as Facebook, Instagram, Twitter to record events in our life, that storage could be deleted at any point. Whilst your data is at the very crux of it, the companies running them are engineered to create profit and so, if they fail, the company and its data could be lost.

About the author

Natalie Ruane profile photo

Natalie Ruane

Natalie leads the Employment Law & HR team and specialises in education.

Published: Friday 18th March 2016
Categorised: Information Law

All Factsheets