Offering Customer Wi-Fi - Legal Obligations?

[bitchstewie]

As a private company, if we wanted to offer our customers Wi-Fi access does anyone know with certainty what our obligations are so far as logging their activities?

Our data protection chap is under the impression that we have to have them login and we have to log all their activities so that if we ever get a knock on the door saying that someone did something bad, we have logs to show that they did or didn't.

I've done some digging and it would appear that we only need to do this if we have been informed that we are a "Public Communications Provider" by the Secretary of State

http://www.purplewifi.net/update-legal-implication...
http://futurethinking.ee.co.uk/what-small-business...
http://www.francisdavey.co.uk/2009/04/data-retenti...

Now I'm not a lawyer, but I'm also applying the rather simple acid test which is that I can walk into McDonalds or Tesco and use their wi-fi without them knowing who I am, and I doubt they'd be doing this if they were legally obliged to do otherwise.

Please note I'm not in need of technical info on what to log and how to secure wi-fi etc. I'm simply asking for the legal situation regards what we do or don't need to log

Does anyone know the score please?

[hdrflow]

Don't know the score but I was under the impression places like McDonalds use Wifi providers for business (O2 in their case), and don't run it themselves, so problem sorted. I wouldn't run it off the back of my broadband service.

[TheEnd]

"Our data protection chap is under the impression that we have to have them login and we have to log all their activities so that if we ever get a knock on the door saying that someone did something bad, we have logs to show that they did or didn't."

Now, is that part actually needed? In other words, are you obliged to keep records, or can you just say there's no log-in or recording, so you can't help.

[marshalla]

TheEnd said:

"Our data protection chap is under the impression that we have to have them login and we have to log all their activities so that if we ever get a knock on the door saying that someone did something bad, we have logs to show that they did or didn't."

Now, is that part actually needed? In other words, are you obliged to keep records, or can you just say there's no log-in or recording, so you can't help.

If you're classed as a CSP (communications service provider), you may have an obligation to record who is using your network. I don't recall any requirement to log which services they are using though.

[WatchfulEye]

Here's a page that some lawyers have put up:
Link

Essentially, you do not have to keep ID details of any users, or logs - unless you have been sent an official notice requiring you to do this (something intended for large commercial ISPs).

However, be aware of data protection issues - it is a grey area whether you would be liable for the disclosure personal information of users of your wifi.

Also be aware that although no specific action regarding copyright infringement is required for small wifi operators, this may change in the future. It also doesn't mean that lawyers for copyright holders may not cause you legal hassle.

It may be preferable to sub-contract this out to a commercial provider of public wifi services, rather than manage this yourself. If you do want to manage it yourself, then you should ensure that someone with knowledge of wifi security configures the system to ensure that data cannot leak from any internal system to the public wifi, and that individual devices on the public wifi are ring-fenced from each other. You should also have some sort of filter to block sites and traffic that may cause you trouble - e.g. you want to have some sort of anti-bittorrent and probably an anti-porn filter

[miniman]

If you do go ahead, have a look at Fusion WiFi - very slick sign-up mechanism.

http://www.fusionwifi.com/