ROBERT GORDON UNIVERSITY

ABERDEEN BUSINESS SCHOOL

DEPARTMENT OF INFORMATION MANAGEMENT

INFORMATION GOVERNANCE

SOCIAL NETWORKING SITES: INFORMATION GOVERNANCE ISSUES

By
EVAGGELOS (VAGELIS) VARFIS

WORD COUNT: 2,775

2010-03-20

1
TABLE OF CONTENTS
1. INTRODUCTION……………………………………………………………………………………3
2. INFORMATION GOVERNANCE (OVERVIEW)……………………………………….4
3. PII (PERSONAL IDENTIFIABLE DATA)………………………………………………..5
4. SOCIAL NETWORKING AND TEENAGERS…………………………………………..6
5. SOCIAL NETWORKING AND ADULTS………………………………………………….7
5.1 THREATS ON PRIVACY/PERSONAL DATA AND SECURITY FLAWS…7
5.1.1 FACEBOOK……………………………………………………………………………………….7
5.1.2 TWITTER………………………………………………………………………………………….8
5.1.3 GOOGLE BUZZ…………………………………………………………………………………8
5.1.4 MYSPACE………………………………………………………………………………………..9
5.1.5 LINKEDIN………………………………………………………………………………………..9
6. IMPLICATIONS………………………………………………………………………………………10
6.1 DATA MINING…………………………………………………………………………………..10
6.2 TARGETED ADS…………………………………………………………………………………10
6.3 EMPLOYMENT…………………………………………………………………………………….10
6.4 IDENTITY THEFT…………………………………………………………………………………11
6.5 SPAMMING………………………………………………………………………………………….11
6.6 ETHICAL ISSUES/CONTROVERSIES………………………………………………….11
6.7 CYBEBULLYING AND CYBERSTALKING……………………………………………….12
7. RECORDS MANAGEMENT AND FREEDOM OF INFORMATION (FOI)………..13
8. DATA PROTECTION-SUGGESTIONS…………………………………………………………14
8.1 LEGAL ASPECT……………………………………………………………………………………..14
8.2 TECHNOLOGICAL ASPECT…………………………………………………………………….14
REFERENCES/BIBLIOGRAPHY
APPENDICES
APPENDIX 1
APPENDIX 2
APPENDIX 3
APPENDIX 4
APPENDIX 5
APPENDIX 6

2
 1. INTRODUCTION
An important role, on bringing people together closer, are the online social networking
sites (SNS) like Facebook, Twitter, LinkedIn, MySpace and more recently Google Buzz.
Some of the features of these SNSs allow to users to display pictures –from their
personal background-, comments, thoughts, ideas, opinions. There are functions from
the very same sites which tend to allow, for their users, to expose their personal data,
like address, telephone. Albeit, the SNSs provide all the necessary guarantees –
information security- that these personal data are secure and visible to a selected
number of users, according to the settings that have been made by each user.
Despite the fact that all measures have been taken by the SNSs some crevices on their
security have damaged their reliability. However, the personal data of their users have
been exposed publicly–maybe-, without their consent.

3
 2. INFORMATION GOVERNANCE –An overview-
“Information governance is the specification of decision rights and an accountability
framework to encourage desirable behavior in the valuation, creation, storage, use,
archival and deletion of information. It includes the processes, roles, standards and
metrics that ensure the effective and efficient use of information enabling an
organization to achieve its goals.” (Logan 2010).

4
 3. PERSONAL IDENTIFIABLE INFORMATION (PII)
“Personal identifiable information (PII) is information which can be used to distinguish or
trace an individual’s identity either alone or when combined with other information that
is linkable to a specific individual.” (Krishnamurthy, Wills 2009).
Based on this definition, users’ personal data are available to third-party servers without
the prior knowledge of the users.

5
 4. SNSs AND MINORS
One of the most active communities regarding SNSs are the teenagers and at the same
time they are more vulnerable due to their age. Without realizing the consequences
teenagers are willing to reveal online their thoughts, behavior, pictures. Lenhart in a
search quoted by Barnes (2006) reports that: “81 per cent of parents and 79 per cent of
online teens are not careful enough about giving out their personal information”.
Parents who give their permission to their children so that they can be connected online
and probably use SNSs should be more aware of the dangers that lurk.
The European Commission in a report, quoted by Hart (2010), shows that “50 per cent
of European teens give out personal information online. It also found that only a third of
SNSs responded to user reports asking for help, and 11 of 22 social networking sites
allow private profiles to be usable through search engines”. The lack of efficient and
sufficient information security on behalf of SNSs is sustained by the fact that sexual
predators locate their victims through SNSs.
One of the basic principles of information governance is the deletion of information
under certain conditions. Especially, for the SNSs it is vague if there is policy on deleting
all personal information after the decision of a user to deactivate or delete his/her
account. On the SNSs privacy policy there is not any provision regarding the disposal of
the teenagers’ personal information in case they delete their accounts. The latter
indicates, suggests that the teenagers’ personal data are being kept stored, which could
be detrimental for their current life but for their future life, as well, as adults.

6
 5. SOCIAL NETWORKING AND ADULTS
5.1 THREATS ON PRIVACY OF PERSONAL DATA AND SECURITY FLAWS
When it comes to information governance some of the key areas that define this field
are the information security, the privacy personal data. Any leakage, flaw could be
detrimental for the organizations-SNSs- and for their users.
“The relation between privacy and a person’s social network is multi-faceted. In certain
occasions we want information about ourselves to be known only by a small circle of
close friends and not by strangers. In other instances we are willing to reveal personal
information to anonymous strangers but not to those who know us better”. (Gross and
Acquisti 2005)

5.1.1 FACEBOOK
One of the weaknesses that the Facebook has is the fact that the abundant provision of
data, from its users, on their profile information, residence, phone number is possible for
a stalker to locate the user. It would be a form of cyberstalking.
Facebook’s privacy settings and its weaknesses could be located on the search settings:
“When I checked my search settings the option to index my profile by search engines
had been turned on. This is despite the fact that I had explicitly turned off this setting
when Facebook launched public search listings two years ago. If you do not want search
engines like Google and Bing to index your profile, do yourself a favor and make sure
those settings are still set the way you want them to be. “(Paul 2009)
Another weakness, regarding Facebook’s private settings is the password protection
layer:
“Once I had chosen to exclude my Facebook profile from public search engines, I left my
privacy settings page and returned to my profile (your settings are saved automatically).
But, when I went to my privacy settings, the pages were wide open with no password
requirement. I tested this out on several browsers and operating systems, I also signed
out and back several times to see if that would change anything. The password
protection eventually came back after half an hour or so, but that was far too long.
“(Paul 2009)
“Facebook’s “advanced search” allows one to query the database of users, using any of
the fields in a profile. The problem is that when people hide their profile page, they
expect the information on it to remain private. An MIT student could write “getting
drunk” as an interest and set their profile so that only their friends could see their
profile, expecting that this information is secure. This information is not actually secure
unless they also exclude their profile from searches. An advanced search for “getting

7
drunk” would still associate the student’s name with this string” (Jones and Soltren
2005).
Another problem, on Facebook security:
“A high school student at an MIT summer program discovered that by changing the
server in the query URL from “mit.facebook.com” to “school.facebook.com” he could
perform the query on any school without having a valid account for that school. He also
discovered that most fields are indexed by ID number, so he was able to systematically
query who lived in dorm “101”, “102” etc, until he had a comprehensive list of where
everyone said they lived in profiles.” (Jones and Soltren 2005).

5.1.2 TWITTER
Twitter is another popular SNS. Some of its security flaws, its vulnerability history is
illustrated by the following flaws:
“Regarding the phishing attacks, when you get an email: “hey! Check out this funny blog
about you…” when clicking on the link you get redirected to a Twitter look-a-like site.
Once you enter your login name and password, the fake site captures these details and
probably redirected to the original Twitter site” (BlogSec News 2009)
Another security flaw has been found on Twitter’s flash widget, according to Perez
(2010): “the security flaw in Twitter’s flash-based website widget may have allowed
attackers access to the login credentials of any Twitter user”.
Another security failure –of Twitter- is that the specific SNS failed to deal effectively with
the URL shortening. According to Goodchild (2009): “the URL shortening makes it much
easier for hackers to send out faulty or malicious links”.

5.1.3 GOOGLE BUZZ

A new SNS which was launched quite recently is Google Buzz. The most important
security and privacy flaw is trace on the following:
“By default the people you follow and the people that follow you are made public to
anyone who looks at your profile. In other words, before you change ay settings in
Google Buzz someone could go into your profile and see the people you email and chat
with most.” (Carlson 2010)

8
5.1.4 MYSPACE
Another information governance issue on security flaws and privacy of personal data,
concerning MySpace is the fact that:
“A backdoor in MySpace’s architecture allows to anyone who is interested to see the
photographs of some users with private profiles – including those under 16- despite
assurances from MySpace that those pictures can only be seen by people on a user’s
friend list. Information about the backdoor has been circulating on message boards for
months.” (Poulsen 2008)

5.1.5 LINKEDIN
Another social networking site whose vulnerability exposes its users is LinkedIn.
“The flaw which affects only the IE (Internet Explorer) version of the toolbar, would
allow a malicious website to hijack the user’s browser and potentially their PC.” (Security
Watch 2007).

9
 6. IMPLICATIONS
6.1 DATA MINING
“Data mining is the process where from financial services companies to marketers are
collecting personal data from social networks for their own unique use” (TechNews World
2010). This phenomenon, of data mining namely, is due to the fact that people are
willing to share their personal information. The non-restricted privacy policy of the SNSs
has enabled these companies to collect all these personal data which are useful for their
commercial purposes. “The next step will be the analysis of your online friends’ data for
example, scoring credit ad other data mining uses that involve the ‘birds of a feather
flock together’ idea”. (TechWorld News 2010)

6.2 TARGETED ADS

A problem located on users’ privacy, is located on SNSs. This means that:
“Companies are able to create user profiles by serving and tracking cookies from
hundreds of websites using sophisticated algorithms, they assign users to different
categories by interest, but they never identify you specifically. Based on the collected
information they are able to show you and other people, like you, relevant advertising.
“(Iskold 2007)

6.3 EMPLOYMENT
Millions of people use social networking sites. Most of these people work for an
organization (company, university, government etc.) or people who are searching for a
job. By virtue of the fact that there are some crevices on the privacy settings and policy
– by extension on information governance- on behalf of the SNSs, the employees (or
potential employees) are under a pending danger.
At the same time it is an ethical issue. However, an information governance issue is the
fact that there are some gaps regarding the SNSs’ personal data and privacy policy.
“The use of Facebook by potential employers is not addressed the Terms of Use for
Facebook. It does not mean a employer cannot access your information for commercial
purposes, like research to make a hiring decision.”(Potter 2008)

10
6.4 IDENTITY THEFT
Another implication caused by SNSs due to security flaws at the expense of their users is
the phenomenon of identity theft.
“When a person’s hometown is known, the window of the first three digits of the user’s
Social Security Number (SSN) can be identified with probability decreasing with the
home state’s populousness. When that person’s birthday is also known and an attacker
has access to SSNs of other people with the same birth date in the same state as the
target (for example obtained from the SSN death index or from the stolen SSNs ), it is
possible to pin down a window of values in which the two middle digits are likely to fall.
The last four digits (often used in unprotected logins and as passwords cab be retrieved
through social engineering. Since the vast majority of the Facebook profiles not only
include birthday and hometown information, but also current phone number and
residence (often used for verification purposes by financial institutions and other credit
agencies), users are exposing themselves to substantial risks of identity theft.” (Gross
and Acquisti 2005)

6.5 SPAMMING
Security flaws from SNSs allow to spammers to find ways to access to users’ personal
data. “That means that the personal email can be hacked” (Virzi 2009).

6.6 ETHICAL ISSUES/CONTROVERSIES

Some of the ethical issues that have been arisen:
“Facebook is changing what it seems to be Publicly Available Information (PAI) with
almost no recourse for the user to control this – a change that does not sit well with the
EFF (Electronic Frontier Foundation). Information under the PAI umbrella includes your
profile picture, friends list, fan pages, gender, geographic region, and networks (school,
work). There is no almost no recourse to protect any of this information. To illustrate
how important this setting could be, the EFF points out that you may belong to a fan
page that supports or condemns gay marriage. Since this is such a controversial issue,
that may be a position you are not willing to share with co-workers, fellow church
members, or other Facebook friends.” (Paul 2010)
One other information governance issue related to records management is the question
whether “the SNSs gather personally identifiable information from the users should store
or share it” . (Oak 2008)

11
6.7 CYBERBULLYING AND CYBERSTALKING
For more details, about cyberbullying, please refer to Appendix 1.
For more details about cyberstalking, please refer to Appendix 2.

12
 7. RECORDS MANAGEMENT AND FREEDOM OF INFORMATION (FOI)
With the extensive use of social networking sites, somebody would logically assumed
that the sites themselves would have developed a complete records management policy,
as every other organization would in public or private sector. The case in point, the
question is whether these sites maintain records or not.
For example, public services which use social media (social networks are included) for
the purposes of their service are liable to certain rules for electronic records
management (see Appendix 3).
The logical question is whether the SNSs use electronic records management policy, on
the personal information that they hold. Another question that accrues is what happens
with the user’s personal data in case the user decides to terminates his/he account or if
the user is deceased. For how long are his/her data going to be stored by the SNSs. Is
there a policy on disposing the information after a certain period of time?
These are some of the obscure areas that should highlight.
FOI is addressed and can be applied to public services. However, FOI does not apply to
SNSs. Some of the obscure areas that need to be highlighted is about what happens id
elected officials use SNSs. Do their comments on SNSs constitute public records? It is
vague on whether the users have the right to demands from SNSs all their personal data
any time. It is an ongoing issue which can only be clarified, not by individual opinions
but by enacting the right legislation.

13
 8. DATA PROTECTION-SUGGESTIONS
8.1 LEGAL ASPECT
SNSs should comply according to their users’ need. In case they do not comply, then it
is the legislatures’s turn to impose to these companies to follow certain rules.
Therefore, realizing the need to follow the current technological developments the
authorities proposed the enactment of the “Social Networking Safety Act” (appendix 4).
Highlighting the most important excerpts, there is provision for important issues.
“The proposed legislation creates a civil right of action for customers who are offended
by what they read on MySpace or Facebook. It allows the social network provider to sue
customers who post “sexually offensive” or” harassing” communications.
The bill requires social network providers to design their user interfaces with icons that
they will allow customers to report “sexually offensive” or “harassing” communications.
Moreover, the social network provider must investigate complaints, call the police when
“appropriate” and banish offenders.
Finally if the social network provider fails to take action, it can be sued ofr consumer
fraud.” (Barber 2009)
Moreover, according to an advisory body of the European Union about protection and
privacy (appendix 5), suggests what measures should be taken in order for SNSs to be
more efficient on data protection. Epigrammatically, this advisory body based on EU data
protection regulation gives guidance, advices on certain –obscure- areas:
• Security and default privacy settings
• Information to be provided by SNSs
• Processing data of non members
• Third party access
• Legal grounds for direct marketing
• Retention of data
• Right of the users

8.2 TECHNOLOGICAL ASPECT

For all these users who have been facing problems, regarding their professional or
personal life, by the extensive use SNSs, they could resolve this problem by themselves.
With the usage of a software (appendix 6) they could delete themselves –if they are
users of Facebook, Twitter- and consecutively their names/nicknames will stop
appearing on public search engines. Moreover, in case the users want to carry on with
14
their social networking activity, they should enforce to the maximum the privacy
restrictions which are given by the SNSs in order to ensure to a certain extent that there
will not be any malevolent act by another user or third party company. Also, the users
should generate safe, strong and secure passwords in order to maintain the certainty
that they are safe from other users.

15
BIBLIOGRAPHY/REFERENCES

1.BARBER, G. 2009. A social networking safety act. [online] 25 March 2009. Available
from: http://www.freedom-to-tinker.com/blog/grayson/social-networking-safety-act
[Accessed 3 March 2010]

2. BARNES B., SUSAN, 2006. A privacy paradox: social networking in the United States.
First Monday. [online]. 11 (9). Available from:
http://firstmonday.org/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/1394/1312
[Accessed 1 March 2010]

3. BRADLEY, T., 2009. Protect your privacy settings on Facebook and Twitter. [online].
San Franscisco, CA: PCWorld. Available from:
http://www.pcworld.com/article/172604/protect_your_privacy_on_facebook_and_twitter
.html [Accessed 3 March 2010].

4. CARLSON, N., 2010. Warning: Google Buzz has a huge privacy flaw. [online]. Silicon
Valley: Business Insider. Available from: http://www.businessinsider.com/warning-
google-buzz-has-a-huge-privacy-flaw-2010-2 [Accessed 2 March 2010].

5. Council Regulation (EC) 01189/09 on online social networking

6.FITZGERALD, M., 2009. How Facebook and Twitter are changing data privacy rules.
[online]. Oslo: ComputerWorld. Available from:
http://news.idg.no/cw/art.cfm?id=D14C9B49-1A64-6A71-CEBB8DE087527FB6
[Accessed 4 March 2009].

7.GOODCHILD, J., 2009. 3 ways Twitter security falls short. [online]. Framingham, MA:
CSO online. Available from:
http://www.csoonline.com/article/481236/3_Ways_Twitter_Security_Falls_Short
[Accessed 1 March 2010]

8.GROSS, R. and ACQUISTI, A., 2005. Information revelation and privacy in online
social networks. Available from:
http://privacy.cs.cmu.edu/dataprivacy/projects/facebook/facebook1.pdf Workshop on
Privacy in the Electronic Society (WPES). 7 November 2005. Alexandria: Virginia
16
9.HOWARD B., A., 2009. Twitter security risks popularity spark regulatory concerns.
[online]. Needham, MA: TechTarget. Available from:
http://searchcompliance.techtarget.com/news/article/0,289142,sid195_gci1359732,00.h
tml [Accessed 2 March 2010].

10. ISKOLD, A., 2007. Privacy and personalization: from clickstream to targeted
advertising. [online]. ReadWriteWeb. Available from:
http://www.readwriteweb.com/archives/privacy_and_personalization.php [Accessed 2
March 2010]

11.JONES, H., SOLTREN H., J., 2005. Facebook: threats to privacy. [online].
Dissertation, MIT. Available from:
http://groups.csail.mit.edu/mac/classes/6.805/student-papers/fall05-
papers/facebook.pdf [Accessed 1 March 2009]

12.KRISHNAMURTHY, B., WILLS E., C., 2009. On the leakage of personally identifiable
information via online social networks. Available from:
http://www2.research.att.com/~bala/papers/wosn09.pdf 3rd Workshop of Online Social
Networks. 17 August 2009. Barcelona: ACM SIG COMM. pp. 7-12

13. LOGAN, D., 2010. What is information governance and why is it so important?
[online]. 11 January 2010. Available from:
http://blogs.gartner.com/debra_logan/2010/01/11/what-is-information-governance-
and-why-is-it-so-hard/
[Accessed 1 March 2010]

14.OAK, M., 2008. Ethical issues of internet privacy. [online]. Buzzle. Available from:
http://www.buzzle.com/articles/ethical-issues-of-internet-privacy.html [Accessed 2
March 2010].

15.OPSAHL, A., 2010. Twitter and government transparency. [online]. Folsom, CA:
Government Technology. Available from: http://www.govtech.com/gt/articles/738213
[Accessed 2 March 2010].

16.PAUL, I., 2009. Facebook’s new privacy settings: 5 things you should know [online].
San Fransisco, CA: PCWorld. Available from:
17
http://www.pcworld.com/article/184188/facebooks_new_privacy_settings_5_things_you
_should_know.html?loomia_ow=t0:s0:a38:g26:r2:c0.001062:b29593330:z0 [Accessed
2 March 2010].

17.PCMAGAZINE.SECURITY WATCH 2007. LinkedIn vulnerability exposes users. [online].

New York: PC Magazine. Available from:
http://blogs.pcmag.com/securitywatch/2007/07/linkedin_vulnerability_exposes.php
http://searchcompliance.techtarget.com/news/article/0,289142,sid195_gci1359732,00.h
tml [Accessed 2 March 2010]

18.PEREZ , S., 2010. Security flaw found in Twitter’s flash widget. [online]. 25 January
2010. Available from:
http://www.readwriteweb.com/archives/security_flaw_found_in_twitters_flash_widget.p
hp [Accessed 1 March 2010].

19.POTTER, L., 2008. Legal and ethical issues when employers check applicants’ social
networking sites. [online]. 22 February 2008. Available from:
http://lespotter001.wordpress.com/2008/02/22/legal-and-ethical-issues-with-
employers-checking-social-networking-sites/
[Accessed 2 March 2010]

20.POULSEN, K., 2008. MySpace buy leaks “private” teen photos to voyers. [online].
Wired News. Available from:
http://www.wired.com/politics/security/news/2008/01/myspace
[Accessed 1 March 2010].

21. SCHNEIER, B., 2009. Social networking identity theft scams. [online] 8 April 2009.
Available from: http://www.schneier.com/blog/archives/2009/04/social_networki.html
[Accessed 2 March 2010].

22. SMITH, J., 2009. 10 powerful ways to target facebook ads every performance
advertiser should know. [online]. Palo Alto, CA: InsideNetwork. Available from:
http://www.insidefacebook.com/2009/07/27/10-powerful-ways-to-target-facebook-ads-
that-every-performance-advertiser-should-know/

[Accessed 2 March 2010].

18
23.SNOL, L., 2009. 2010s top security threats: Facebook, Twitter and iphone apps.
[online]. San Fransisco, CA: PC World. Available from:
http://www.pcworld.com/article/185661/2010s_top_security_threats_facebook_twitter_
and_iphone_apps.html [Accessed 1 March 2010].

24. SUICIDEMARCHINE, 2010. Web 2.0 suicide machine. [online]. Rotterdam: Suicide
Machine. Available from:
http://www.monstersandcritics.com/tech/features/article_1528934.php/Dutch-software-
helps-kill-personal-data-on-internet

[Accessed 3 March 2010]

25.VIRZI M. , A., 2009. Twitter, spam and security. [online]. New York. ClickZ. Available
from: http://www.clickz.com/3634497 [Accessed 2 March 2009]

26.TECHNEWSWORLD. SKIPEASE 2010. Data mining of personal information from social

network profiles on the rise. [online]. 21 January 2010. Available from:
http://www.skipease.com/blog/data-mining/data-mining-information-from-your-social-
network-profile/ [Accessed 2 March 2010]

19
Appendix 1
Cyberbullying

Safe to Learn: Embedding

anti-bullying work in schools
This guidance was developed for the Department for Children, Schools and Families (DCSF) by Childnet
International and in consultation with the DCSF Cyberbullying Taskforce, on which representatives of the
following organisations sit (in alphabetical order):

Anti-Bullying Alliance (ABA) Mobile Broadband Group

AOL (UK) limited National Association of Head Teachers (NAHT)
Association of School and College Leaders (ASCL) The National Association of Schoolmasters / Union of
Association of Teachers and Lecturers (ATL) Women Teachers (NASUWT)
BBC National Governors’ Association (NGA)
Beatbullying National Society for the Prevention of Cruelty to Children
Bebo (NSPCC)
Becta National Union of Teachers (NUT)
Child Exploitation and Online Protection Centre (CEOP) O2
Childnet International Orange
Children's Charities' Coalition for Internet Safety Parent Governors Representatives Network
Cyberspace Research Unit, University of Central Professional Association of Teachers (PAT)
Lancashire The Carphone Warehouse
Department for Business, Enterprise and Regulatory The Samaritans
Reform (BERR) T-Mobile UK
Fox Interative Media / MySpace Unison
Get Connected Unit for School and Family Studies, Goldsmiths, University
Google / YouTube of London
Home Office Vodafone
Kidscape Yahoo! UK & Ireland
London Councils Youth Justice Board (YJB)
Microsoft (MSN and Windows Live services) York St John University
Ministry of Justice (MoJ)

The Department would also like to thank the staff and pupils at Avenue Primary School, Leicester, and Hamilton
Community College, Leicester, for contributing to the development of this guidance.
 01

Contents
GUIDANCE

Executive summary 03

1. Understanding cyberbullying 06
• What is cyberbullying and why do schools need to take it seriously? 06
• The context: young people and technology 10
• Forms that cyberbullying can take 11
• How is cyberbullying different to other forms of bullying? 13
• Brief introduction to the technology 15

2. Preventing cyberbullying
• Taking a whole-school community approach 22
• Understanding and talking about cyberbullying 23
• Updating existing policies and practices 24
• Making reporting cyberbullying easier 25
• Promoting the positive use of technology 27
• Evaluating the impact of prevention activities 28
3. Responding to cyberbullying 30
• Cyberbullying is a form of bullying 30
• Support for the person being bullied 31
• Investigation 35
• Working with the bully and applying sanctions 37

FURTHER RESOURCES

A. Key advice to parents and carers on cyberbullying 40

B. Key advice to children and young people on cyberbullying 42
C. What children and young people say 44
D. Useful websites and resources 46
E. Case study: Letter inviting parents to cyberbullying information event 48
F. Case study: Information letter on sanctions 50
G. Case study: Example Acceptable Use Policy (AUP) 51
02 Safe to Learn: Embedding anti-bullying work in schools

cyberBullying:
Guidance

As more and more schools are having to respond to
the growing challenge of cyberbullying, it is vital that
schools understand the issue, know how to prevent
and respond to incidents, and are updated on the
legal issues surrounding this challenging subject.
Quote from a pupil:
“I felt that no-one understood what I was going
through. I didn’t know who was sending me these
messages, and I felt powerless to know what to do.”

The DCSF has worked with children’s charity
Childnet International to provide this guidance,
which forms part of the anti-bullying guidance Safe
to Learn: Embedding Anti-Bullying Work in Schools.
You will be able to find important information and
clear advice on the subject, and review how your
school takes action.
Quote from a parent:
“Having my daughter show me text messages from
nearly everyone in her class all saying derogatory
things about her was devastating.”
Quote from a staff member:

“The internet and mobile phones have such positive “The accusation about me which the students put on
power to transform children’s lives for the better. their website was horrendous. Within hours it seemed
However, when they are misused, they can cause real that the whole school had read this message.”
pain and distress. Childnet is delighted to have worked
with the DCSF and with members of the Cyberbullying
Taskforce in drawing up this guidance which we hope
will be of real practical help to schools.”
Childnet International

Childnet has produced a summary of this guidance

and a film for schools to use in addressing this issue,
which are available at www.digizen.org

Executive summary
Understanding cyberbullying
1. Cyberbullying can be defined as the use of
Information and Communications Technology (ICT),
particularly mobile phones and the internet,
deliberately to upset someone else. It can be an
extension of face-to-face bullying, with technology
providing the bully with another route to harass their
target. However, it differs in several significant ways
from other kinds of bullying: the invasion of home
and personal space; the difficulty in controlling
electronically circulated messages; the size of the
audience; perceived anonymity; and even the profile
of the person doing the bullying and their target.
2. Research into the extent of cyberbullying
indicates that it is a feature of many young people’s
lives. It also affects members of school staff and other
adults; there are examples of staff being ridiculed,
threatened and otherwise abused online by pupils.
3. Cyberbullying, like all bullying, should be taken
very seriously. It is never acceptable, and a range of
Education Acts and government guidance outline
schools’ duties and powers in relation to bullying.
The Education and Inspections Act 2006 (EIA 2006)
includes legal powers that relate more directly to
cyberbullying; it outlines the power of head teachers
GUIDANCE 03
Executive summary
to regulate the conduct of pupils when they are
off-site and provides a defence in relation to the
confiscation of mobile phones and other items.
4. Although cyberbullying is not a specific criminal
offence, there are criminal laws that can apply in
terms of harassment and threatening and menacing
communications. Schools should contact the police
if they feel that the law has been broken.
5. Cyberbullying takes different forms: threats
and intimidation; harassment or “cyber-stalking”
(e.g. repeatedly sending unwanted texts or instant
messages); vilification / defamation; exclusion or
peer rejection; impersonation; unauthorised
publication of private information or images
(including what are sometimes misleadingly referred
to as ‘happy slapping’ images); and manipulation.
6. Some cyberbullying is clearly deliberate and
aggressive, but it is important to recognise that
some incidents of cyberbullying are known to be
unintentional and the result of simply not thinking
about the consequences. What may be sent as a joke,
may not be received as one, and indeed the distance
that technology allows in communication means the
sender may not see the impact of the message on
the receiver. There is also less opportunity for either
04 Safe to Learn: Embedding anti-bullying work in schools
party to resolve any misunderstanding or to feel
empathy. It is important that pupils are made aware
of the effects of their actions.
7. In cyberbullying, bystanders can easily become
perpetrators – by passing on or showing to others
images designed to humiliate, for example, or by
taking part in online polls or discussion groups. They
may not recognise themselves as participating in
bullying, but their involvement compounds the
misery for the person targeted. It is recommended
that anti-bullying policies refer to those ‘bystanders’
– better termed ‘accessories’ in this context – who
actively support cyberbullying and set out sanctions
for this behaviour. It is important that pupils are
aware that their actions have severe and distressing
consequences and that participating in such activity
will not be tolerated.
Preventing cyberbullying
8. It is important to decide on the roles and
responsibilities for cyberbullying prevention work.
This will typically involve a named lead from the
senior management team (usually the person with
overall responsibility for anti-bullying work), as
well as IT staff, pastoral care staff, and school
council members.
9. Essential elements of prevention are awareness-
raising and promoting understanding about
cyberbullying. Awareness can be raised and
understanding promoted through discussion and
activity around what cyberbullying is and how it
differs from other forms of bullying. The activities
could include staff development activities; home-
school events such as special assemblies with
parents; and addressing cyberbullying within
curriculum delivery and the Social and Emotional
Aspects of Learning (SEAL) programme.
10. It is important to review and update existing
anti-bullying, behaviour and pastoral care policies
to include cyberbullying. Ensure that learners,
parents and staff are all aware of the procedures
and sanctions for dealing with cyberbullying,
including bullying that takes place out of school.
11. It is advised that schools establish, or review
existing, Acceptable Use Policies (AUPs), referencing
responsible use of school IT networks and
equipment, Virtual Learning Environments (VLEs)
and mobile phones. It is also recommended that
schools review how the school network is monitored
and check whether existing procedures are
adequate.
12. It is recommended that schools record and
monitor incidents of cyberbullying in the same way
as all other forms of bullying. Schools can use this
information to develop their policies and practices.
13. Publicising reporting routes is an important
element of prevention, raising awareness of the issue
but also ensuring that any incidents can be stopped
before they become too serious or upsetting. Make
sure that learners, parents and staff are all aware of
the different ways available to report cyberbullying
incidents. In addition, schools can signpost
information about external reporting routes,
providing information about contacting service
providers directly.
14. Education and discussion around the
responsible use of technologies and e-safety are
key to preventing cyberbullying and helping
children and young people deal confidently with
any problems that might arise, whether in or out
of school. Technology can have a positive role in
learning and teaching practice, and there is a need
for staff to be confident about ICT in order to model
the responsible and positive use of technologies and
to respond to incidents of cyberbullying
appropriately.

15. Stay up to date – prevention and responding
strategies require continuous review and refinement
as new technologies and services become popular.
This guidance, similarly, will be updated periodically
as technologies develop.
16. It is useful to publicise progress and
cyberbullying prevention activities to the whole-
school community. Keep cyberbullying a live issue
and celebrate your successes.
Responding to cyberbullying
17. Cyberbullying is a form of bullying, and as such
schools should already be equipped to deal with
the majority of cyberbullying cases through their
existing anti-bullying and behaviour policies and
procedures. However, schools should recognise the
ways in which cyberbullying differs from other forms
of bullying and reflect that in how they respond to it.
In addition to considerations about the invasiveness
of cyberbullying, the size of the audience, and other
such factors, cyberbullying yields evidence in a way
that other forms of bullying do not.
18. The person being bullied will usually have
examples of texts or emails received, and should be
encouraged to keep these to aid in any investigation.
There are also additional reporting routes available,
through mobile phone companies, internet service
providers and social networking sites. Detailed
information on retaining evidence, containing
incidents, and contacting the relevant organisations
is provided in this guidance.
19. Some forms of cyberbullying involve the
distribution of content or links to content, which
can exacerbate, extend and prolong the bullying.
There are advantages in trying to contain the spread
of these, and options here include contacting the
service provider, confiscating phones, and contacting
the police (in relation to illegal content).
GUIDANCE 05
Executive summary
20. Advise those experiencing cyberbullying on
steps they can take to avoid recurrence – for
example, advise those targeted not to retaliate or
reply; provide advice on ‘blocking’ or removing
people from ‘buddy lists’; and ask them to think
carefully about what private information they may
have in the public domain.
21. Take steps to identify the person responsible
for the bullying. Steps can include looking at the
school system and computer logs; identifying and
interviewing possible witnesses; and, with police
involvement, obtaining user information from the
service provider.
22. Once the person responsible for the
cyberbullying has been identified, it is important
that, as in other cases of bullying, sanctions are
applied. Steps should be taken to change the
attitude and behaviour of the bully, as well as
ensuring access to any help that they may need.
Schools will have existing sanctions in place for
bullying behaviour, and these should apply equally
to cyberbullying. In addition, it is important to refer
to any Acceptable Use Policies (AUPs) for internet
and mobile use, and apply sanctions where
applicable and practical. Technology-specific
sanctions for pupils engaged in cyberbullying
behaviour could include limiting internet access
for a period of time or removing the right to use
a mobile phone on the school site, for example.
06 Safe to Learn: Embedding anti-bullying work in schools
1. Understanding
cyberbullying
1.1 WHAT IS CYBERBULLYING AND WHY
DO SCHOOLS NEED TO TAKE IT SERIOUSLY?
A definition
1.1.1 Cyberbullying can be defined as the use
of Information and Communications Technology
(ICT), particularly mobile phones and the internet,
deliberately to upset someone else. As with a school’s
general definition of bullying, however, it is advised
that schools involve the whole school community in
agreeing an accessible and meaningful definition.
In this way, the school will secure greater awareness
of the phenomenon and buy-in for its overall policy
and strategies to tackle cyberbullying.
1.1.2 Cyberbullying is a sub-set or ‘method’ of
bullying. It can be used to carry out all the different
‘types’ of bullying (such as racist bullying,
homophobic bullying, or bullying related to special
educational needs and disabilities), but instead of
the perpetrator carrying out the bullying in person,
they use technology as a means of conducting the
bullying. Cyberbullying can include a wide range of
unacceptable behaviours, including harassment,
threats and insults. And like face-to-face bullying,
cyberbullying is designed to cause distress and harm.
1.1.3 Cyberbullying can be an extension of face-to-
face bullying, with technology providing the bully
with another route to harass their target. However,
cyberbullying does differ in several significant ways
to other kinds of bullying: for example, the invasion
of home/personal space; the difficulty in controlling
electronically circulated messages; and even in the
profile of the bully and target. These differences are
important ones for people working with children
and young people to understand (see section 1.4).
1.1.4 Cyberbullying takes place between children;
between adults; but also across different age groups.
Young people can target staff members or other
adults through cyberbullying: there are examples of
school staff being ridiculed, threatened and
otherwise abused online.
Quote from a head teacher:
“One of my staff members was recently the victim of
cyberbullying – some of the students created a web
site about them which contained nasty comments
and accusations…As a direct result the member of
staff suffered from depression and stress, and was
actively planning to leave the school. I can honestly
say that this episode nearly destroyed this man”.

How common is cyberbullying?
1.1.5 There have been some studies looking at the
extent of cyberbullying amongst children and
young people:
• Research carried out for the Anti-Bullying
Alliance (ABA) by Goldsmiths, for example, found
that 22% of 11-16 year-olds had been a victim
of cyberbullying1.
• The MSN cyberbullying report (2006) found
that 11% of UK teens had experienced
cyberbullying2 .
• Noret and River’s four year study on bullying
(2007) found that 15% of the 11,227 children
surveyed had received nasty or aggressive texts
and emails, and demonstrated a year on year
increase in the number of children who are
being bullied using new technology.
• Research conducted as part of the DCSF
cyberbullying information campaign found
that 34% of 12-15 year olds reported having
been cyberbullied.
• Qualitative evidence gathered by NASUWT
through a survey of teachers has demonstrated
that cyberbullying affects the working lives of
staff and impacts severely on staff motivation,
job satisfaction and teaching practice.
1.1.6 Although there is variation in the figures, all
the research indicates that cyberbullying is a
feature of many young people's lives. There is also
concern that the level of cyberbullying is increasing.
1 P. Smith, J. Mahdavi et al 2006
2 www.msn.co.uk/customercare/protect/cyberbullying/default.asp?MSPSA=1
3 www.teachernet.gov.uk/wholeschool/behaviour/schooldisciplinepupilbehaviourpolicies/
4 www.teachernet.gov.uk/wholeschool/behaviour/schooldisciplinepupilbehaviourpolicies/
GUIDANCE 07
Understanding cyberbullying
Legal duties and powers: Education law
1.1.7 Bullying (and this includes cyberbullying) is
never acceptable. The school community has a duty
to protect all its members and provide a safe, healthy
environment. These obligations are highlighted in a
range of Education Acts and government initiatives
(see section 2 of the overarching Safe to Learn:
Embedding Anti-Bullying Work in Schools guidance).
1.1.8 In addition, the Education and Inspections
Act 2006 (EIA 2006) outlines some legal powers
which relate more directly to cyberbullying. Head
teachers have the power “to such extent as is
reasonable” to regulate the conduct of pupils when
they are off-site or not under the control or charge of
a member of staff. This is of particular significance to
cyberbullying, which is often likely to take place out
of school but which can impact very strongly on the
school life of those pupils involved. Section 3.4 of the
School Discipline and Pupil Behaviour Polices guidance
provides more advice on when schools might
regulate off-site behaviour3 .
1.1.9 EIA 2006 also provides a defence for school
staff in confiscating items from pupils. This can
include mobile phones when they are being used to
cause a disturbance in class or otherwise contravene
the school behaviour / anti-bullying policy. More
information on confiscation can be found in section
3.8 of the School Discipline and Pupil Behaviour Polices
guidance 4. School staff may request a pupil reveal a
message or show them other content on their phone
for the purpose of establishing if bullying has
occurred, and a refusal to comply might lead to the
imposition of a disciplinary penalty for failure to
follow a reasonable instruction. Where the text or
image is visible on the phone, staff can act on this.
Where the school’s behaviour policy expressly
provides, a member of staff may search through the
phone themselves in an appropriate case where the
pupil is reasonably suspected of involvement.
08 Safe to Learn: Embedding anti-bullying work in schools
Legal duties and powers: Civil and
criminal law
1.1.10 Although bullying is not a specific criminal
offence in UK law, there are criminal laws that can
apply in terms of harassment or threatening
behaviour. For example – and particularly pertinent
for cyberbullying – threatening and menacing
communications.
1.1.11 In fact, some cyberbullying activities could be
criminal offences under a range of different laws,
including the Protection from Harassment Act 1997
which has both criminal and civil provision, the
Malicious Communications Act 1988, section 127 of
the Communications Act 2003 and the Public Order
Act 1986. The age of criminal responsibility in the UK
starts at 10.
• Protection from Harassment Act 1997: This
Act is relevant for incidents that have happened
repeatedly (i.e. on more that two occasions).
Section 1 prohibits behaviour amounting to
harassment of another. Section 2 provides a
criminal offence and section 3 provides a civil
remedy for breach of the prohibition on
harassment in section 1. Section 4 provides a
more serious offence of someone causing
another person to fear, on at least two occasions,
that violence will be used against them5. A civil
court may grant an injunction to restrain a
person from conduct which amounts to
harassment and, following conviction of an
offence under section 2 or 4, restraining orders
are available to protect the victim of the offence.
5 www.opsi.gov.uk/acts/acts1997/1997040.htm
6 www.opsi.gov.uk/acts/acts2003/20030021.htm
7 Where cyberbullying occurs by messages transmitted via a public electronic communications network, it may amount to an offence under section
127(1) or (2). However, if the bullying is by means of a school intranet and the message is sent and received on the same school site, the message is
unlikely to have been transmitted via the public network.
8 www.opsi.gov.uk/ACTS/acts1988/Ukpga_19880027_en_1.htm. This offence can be committed via an intranet which is not part of a public system.
9 www.opsi.gov.uk/si/si1987/Uksi_19870198_en_2.htm
10 Depravity and corruption are not confined to sexual depravity and corruption.
• Communications Act 2003: Section 127 covers
all forms of public communications, and
subsection (1) defines an offence of sending
a ‘grossly offensive…obscene, indecent or
menacing’ communication6. Subsection (2)
defines a separate offence where for the
purposes of causing annoyance, inconvenience
or needless anxiety, a person sends a message
which that person knows to be false (or causes it
to be sent) or persistently makes use of a public
communications system7.
• Malicious Communications Act 1988: Section
1 makes it an offence to send an indecent,
grossly offensive or threatening letter, electronic
communication or other article to another
person with the intention that it should cause
them distress or anxiety8.
• Public Order Act 1986: Section 5 makes it an
offence to, with the intent to cause harassment,
alarm and distress, use threatening, abusive or
insulting words, behaviour, writing, signs or other
visual representation within the sight or hearing
of a person likely to be caused harassment,
alarm or distress9. This offence may apply where
a mobile phone is used as a camera or video
rather than where speech writing or images
are transmitted.
• Obscene Publications Act 1959: It is an offence
under this Act to publish an obscene article.
Publishing includes circulating, showing, playing
or projecting the article or transmitting that data,
for example over a school intranet. An obscene
article is one whose effect is such as to tend to
deprave and corrupt persons who are likely to
read, see or hear the matter contained or
embodied in it10.

• When cyberbullying takes the form of hacking
into someone else’s account, then other criminal
laws will come into play, such as the Computer
Misuse Act 1990 11, in addition to civil laws on
confidentiality and privacy.
• An anti-social behaviour order (ASBO) under the
Crime and Disorder Act 199812 could be used
for cyberbullying. An ASBO is a civil order which
prohibits an individual from engaging in specific
anti-social acts. An ASBO can be made against
any person, aged 10 years or over, where there is
evidence that their behaviour caused, or is likely
to cause, harassment, alarm or distress to others
and where an order is needed to protect
person(s) from further anti-social acts. Whether
a course of conduct is anti-social in nature is
primarily measured by the consequences and
the effect it has, or is likely to have, on a member
or members of the community within which
it is taking place. An ASBO can be used in
conjunction with other measures as part of a
tiered approach to tackling anti-social behaviour.
Prohibitions should be precise, targeted at the
specific behaviour complained of, and
proportionate to the legitimate aim of
protecting the community from further abuse.
ASBOs can be extremely effective in preventing
further escalation into criminal behaviour.
Breach of an Anti-Social Behaviour Order is a
criminal offence and criminal penalties apply.
• Defamation: Defamation is a civil “common law”
tort in respect of which the Defamation Acts
of 1952 and 1996 provide certain defences.
It applies to any published material that
damages the reputation of an individual or an
organisation, and it includes material published
on the internet. A civil action for defamation can
be brought by an individual or a company, but
not by a public authority. It is up to the claimant
to prove that the material is defamatory.
11 www.opsi.gov.uk/acts/acts1990/Ukpga_19900018_en_1.htm
12 www.opsi.gov.uk/acts/acts1998/19980037.htm
13 www.opsi.gov.uk/acts/acts1996/1996031.htm
GUIDANCE 09
Understanding cyberbullying
However, the claimant does not have to prove
that the material is false – the burden of proof on
that point lies with the author/publisher, who
has to prove that what they have written is true13.
Where defamatory material is posted on a
website the person affected can inform the host
of its contents and ask the host to remove it.
Once the host knows that the material is there
and that it may be defamatory, it can no longer
rely on the defence of innocent dissemination in
the Defamation Act 1996. This means that the
person affected could (if the material has been
published in the jurisdiction, i.e. in England and
Wales) obtain a court order (an injunction) to
require removal of the material, and could sue
either the host or the person who posted the
material for defamation.
Cyberbullying in the school community
1.1.12 Cyberbullying is not a new phenomenon,
but as mobile phone and internet use become
increasingly common, so does the use of technology
to bully.
1.1.13 Schools are already addressing bullying,
discrimination and behavioural issues. This guidance
on cyberbullying is designed to help school leaders
and staff who may not be familiar with the ways in
which technologies are currently being used by
young people, and their potential abuse.
1.1.14 Taking a whole-school community approach,
ensuring that the issues are discussed and the school
community shares an understanding of what
cyberbullying is and what the consequences and
sanctions for it are, is key to effectively preventing
and dealing with cases.
1.1.15 A lot of the material covered in this guidance
is equally applicable to the cyberbullying of school
staff as to pupils. Members of the school workforce
10 Safe to Learn: Embedding anti-bullying work in schools
suffering from or concerned about cyberbullying
can also contact their trade union or professional
association for support and advice.
1.2 THE CONTEXT: YOUNG PEOPLE
AND TECHNOLOGY
The role of technology in young people’s
everyday lives
1.2.1 Today’s children and young people have
grown up in a world that is very different from that of
most adults. Subsequently, how young people use
technology is not always understood by parents,
carers and staff members.
1.2.2 Digital media, computers, mobile phones and
the internet have been a taken-for-granted part of
most children and young people’s upbringing and
environment. Many rely on technology not just to
keep in touch, but as a way of developing their
identities, socialising, and belonging to groups.
Technology can play a positive, productive and
creative part of young people’s activities,
development and social participation.
1.2.3 Engagement with technology involves feelings
as well as actions – above all it is a social activity that
allows young people to feel connected to their peers.
Telling a young person who has been cyberbullied to
keep their mobile phone switched off or to stay off
the internet can be interpreted as a disruption of
their social life and perceived as a punishment.
1.2.4 Barring or restricting school network access to
particular sites that young people use, such as social
networking and gaming sites, does not necessarily
prevent young people from using them. They will still
access them, via their own devices and connections,
by bypassing blocks, or by finding new, unrestricted
sites. Whatever policies and practices individual
schools might have around computer access, mobile
phones, or game consoles, it is important to
recognise how important technology is to young
people. Education and discussion around
responsible use and e-safety is key to helping them
deal confidently with any problems that may arise,
whether in or out of school.
Adults are not always aware of how
technologies can be used and abused
1.2.5 Teacher training is changing to incorporate
and account for e-safety issues, and to equip new
teachers with the information they need to make
the most of technologies to support their learning
and teaching practice. The Government’s e-strategy
supports ICT for continuing professional
development for both teachers and leaders. Recently,
Becta have become the Government’s key partner
in the strategic delivery and implementation of the
strategy. There are many partner agencies working at
national, regional and local level to support the best
use and understanding of technology to support
learning and teaching.
1.2.6 Technology constantly changes, and the pace
of change can be off-putting for adults: new sites,
crazes and fashions come and go continually. It may
seem daunting or demanding of time that just isn't
available to keep up with what young people are
doing.
1.2.7 As technology develops, children will be
experimenting with new environments and
exploring where the boundaries of behaviour lie.
In order to engage in a discussion about acceptable
and responsible use, it is necessary to be informed
about these technologies, in order to help identify
where the limits are and what the potential impacts
of certain behaviours are. It is not necessary to know
about every application or site – but it is important
to keep up to date with a broad understanding of
the different ways that young people are using or
abusing, technologies.
1.2.8 Understanding children and young people’s
online lives and activities can help adults respond to
situations appropriately and effectively. Talking to
students about what they do with technology, and

what their concerns and experiences are, is an
essential starting point. Asking children and young
people to show adults how technologies and
services work is a useful strategy that can provide
an important learning opportunity and context for
discussing online safety.
1.3 FORMS THAT CYBERBULLYING
CAN TAKE
1.3.1 Cyberbullying takes different forms, some
of which are harder to detect or less obviously
associated with bullying than others. Schools should
already have policies and practices in place for
dealing with some of these.
Threats and intimidation
1.3.2 Serious threats can be sent to both staff and
pupils by mobile phone, email, and via comments on
websites, social networking sites or message boards.
Harassment or stalking
1.3.3 Repeated, prolonged, unwanted texting,
whether it is explicitly offensive or not, is a form of
harassment. Online stalking (sometimes referred to
as ‘cyberstalking’), where a person’s online activities
are constantly monitored, can cause psychological
harm and fear. Previously safe and enjoyable
environments can be experienced as threatening,
and online activity may become a source of anxiety.
1.3.4 Harassment and stalking can take several and
often multiple forms online, and may or may not be
a continuation of offline harassment or lead to
physical harassment and stalking. Forms of
harassment include:
• repeatedly sending unwanted text or instant
messages, or making phone calls (including
silent calls);
• using public forums, such as message boards or
chatrooms, to repeatedly harass, or to post
GUIDANCE 11
Understanding cyberbullying
derogatory or defamatory statements in order to
provoke a response from their target (sometimes
referred to as ‘flaming’);
• tracking targets by using spyware;
• sending viruses.
Vilification / defamation
1.3.5 Cyberbullying can include posting upsetting or
defamatory remarks about an individual online, or
name-calling using a mobile device for example.
These may be general insults, or include prejudice-
based bullying. Pupils may use their mobile phones
or email to send sexist, homophobic and racist
messages, for example, or they may attack other
kinds of difference – a physical or mental disability,
cultural or religious background, appearance, or
socio-economic position.
Ostracising / peer rejection / exclusion
1.3.6 Online exclusion can be harder to detect than
children obviously being marginalised in a space,
such as a classroom, where there are adults present.
1.3.7 Social networking sites, such as Bebo and
MySpace, provide a platform for young people to
establish an online presence and to talk with other
network members. They can be an important
extension of a young person’s social space and
activity. Most social networking sites work as gated
communities, only allowing contact between
members, so it is common for only a small number of
social networking sites to be popular amongst any
individual school’s students. It is possible for a group
of students to set up a closed group, which can
protect them from unwanted contact. It also means
that excluding someone – by refusing to return or
acknowledge messages; deleting them from their
friendship lists; or using 'ignore' functions – can be
extremely hurtful.
12 Safe to Learn: Embedding anti-bullying work in schools
Identity theft, unauthorised access
and impersonation
1.3.8 ‘Hacking’ generally means accessing someone
else’s account by finding out or guessing their
username and password information. The majority
of children and young people consulted (see ‘What
children and young people say’ in the Resources
section) during the production of this guidance were
aware of such incidents.
1.3.9 Hacking into systems, accounts or files is not
automatically a form of cyberbullying, but it is always
a serious issue. Hacking is illegal under the Computer
Misuse Act 1990 (see information on the civil and
criminal law).
1.3.10 Examples of how hacking can be used to
cyberbully include:
• Accessing and copying someone's information,
for example emails or pictures, in order to harass
or humiliate them. This could include posting
private information on public sites, emailing or
forwarding data by mobile phone, or printing
and circulating paper copies.
• Deleting someone's information – for example,
electronically submitted or stored assignments
and homework, or important emails.
• Impersonating someone – for example
pretending to be the person whose account has
been hacked in order to post abusive comments
and bad language. This might include posting
messages to the school's Virtual Learning
Environment (VLE), sending Instant Messages or
emails, or may involve using someone's mobile
phone to send abusive calls, texts or images.
There have been cases where a bully has sent
out nasty messages to everyone on a pupil's
buddy list, and it can be difficult for the person
targeted to make their friends believe the
messages did not come from them. People
have also discovered their images and contact
details have been posted to public sites along
with invitations to contact them.
1.3.11 You don’t need to be able to access
someone’s account details to impersonate them.
There are examples of people discovering websites,
profiles or comments written in their name and
pretending to be by them.
1.3.12 Identifying perpetrators using technology is
often a time-consuming process, and it may not
always be possible for the school to prove who the
responsible party is (see ‘Investigation’ section of the
‘Responding to cyberbullying’ chapter). Identifying
who has been cyberbullying may depend on more
traditional ways of investigating incidents –
circumstantial evidence, a witness report, or an
admission of responsibility.
Publicly posting, sending or forwarding
personal or private information or images
1.3.13 Once electronic messages or pictures are
made public, containing them becomes very difficult.
Video or pictures can be passed between mobile
phones either by a local wireless connection (which
allows free messages to be sent between devices
that are close to each other), sent by text to other
phones, uploaded to websites, or posted to public
video-hosting sites. Most young people are aware of
‘Happy Slapping’, a term which has been used to refer
to physical assaults that are recorded and circulated,
usually via mobile phone. The DCSF does not
promote the use of this term, although it recognises
that its popular currency has at least allowed
discussion around this form of cyberbullying to
begin to take place. The term is inaccurate and
misleading, and risks minimising serious and illegal
incidents of physical assault. People who record
attacks can be actively engaging in cyberbullying.
Circulating images of attacks can also be a form of
harassment, and will certainly compound the harm
of the original attack.

1.3.14 Websites are potentially viewable by millions
of people. Even after pages or comments have been
removed,‘cached’ copies may still be available. For
example, Google creates a copy of the pages in its
index which are stored as a cached version that can
be accessed via its search results pages, unless a site
owner has requested otherwise.
1.3.15 Creating, possessing, copying or distributing
images of children and young people under the age
of 18 which are of an indecent or sexual nature is
illegal under the Protection of Children Act 1978.
These images are illegal even if they were taken in
‘fun’ or by ‘willing’ parties. Section 160 of the Criminal
Justice Act 1988 criminalizes the possession of
electronic or hardcopy images. These laws also apply
to indecent ‘pseudo-photographs’ – images which
have not been taken but have been created or
adapted, for instance using digital imaging software.
Manipulation
1.3.16 Manipulation is an often under-considered
form of bullying, but unfortunately there have been
many cases of manipulative cyberbullying. Examples
include putting pressure on someone to reveal
personal information or to arrange a physical
meeting. This can be done by using online friendship
status – for example, suggesting that a genuine
friend would give out personal information.
1.3.17 It can be difficult to negotiate online
relationships – some people will find using ignoring
and blocking tools easy, others will hesitate to
demote the status of people they have already
thought of as friends. Manipulation is a very difficult
type of cyberbullying to detect, since the person
being bullied often feels implicated in and
responsible for their own victimisation, and may feel
guilty or ashamed. Some forms of manipulation may
involve getting people to act or talk in a provocative
way. Rude images or conversations can be very
embarrassing to young people, and their fear that
14 Tech Abuse in Teen Relationships Study, January 2007: http://loveisnotabuse.com/pdf/06-208%20Tech%20Relationship%20Abuse%20TPL.pdf
GUIDANCE 13
Understanding cyberbullying
other people, including their family members, might
find out can make them vulnerable to further
manipulation. There is also evidence that mobile
phones and the internet are being used to try to
control, track and manipulate within abusive teen
relationships14.
1.3.18 Manipulation is also used by adults with a
sexual interest in children to ‘groom’ children they
have contacted online to meet up. This guidance
concentrates on bullying and does not go into
‘grooming’ or wider child protection issues. For
further information on this, see www.ceop.gov.uk
or www.chatdanger.com.
1.4 HOW IS CYBERBULLYING DIFFERENT
TO OTHER FORMS OF BULLYING?
Impact
1.4.1 In cyberbullying, the audience for the bullying
can be very large and reached rapidly. This means
that the degree and seriousness, as well as possible
risks and repercussions, have to be evaluated
differently than in cases of other types of bullying.
If content is shared across mobile phones or posted
online, it becomes difficult to control who might see
it or have copies of it. Not being able to be certain
that the event has been contained and will not recur
/ resurface may make it harder for the person being
bullied to gain a sense of 'closure' over an event.
1.4.2 This is a particularly significant way in which
cyberbullying is different from other forms of
bullying: a single incident can be experienced as
multiple attacks. For example, a humiliating video
posted to the web can be copied to many different
sites. A single instance of bullying – the creation of a
nasty website or the forwarding of a personal email –
can have repeated and long-term consequences, as
content that is taken off the internet can reappear or
be circulated again.
14 Safe to Learn: Embedding anti-bullying work in schools
1.4.3 It is also worth noting that some of those being
bullied may not be aware that they have been or are
being cyberbullied. For example, they may not have
seen, or be aware of, content about them that has
been posted online.
Targets and perpetrators
1.4.4 Children and young people are not the only
ones that may be subject to cyberbullying. School
staff have also been victimised and have suffered
distress at the hands of school-aged bullies. The
seeming anonymity and distance that technology
provides means size and age are not necessarily
relevant. People who cyberbully do not need to be
physically threatening to cyberbully. They don’t need
to be stronger, taller or older than the person they
are cyberbullying – they may never be in the same
physical space as the person they are bullying.
1.4.5 Cyberbullying can be used by a person
bullying offline to extend their aggression, but can
equally be used as a form of 'revenge'. There have
been some cases where the person cyberbullying
had been previously bullied, and used the
technology to respond.
1.4.6 Bystanders to cyberbullying can easily become
perpetrators – by passing on or showing to others an
image designed to humiliate another child or staff
member, for example, or by recording an assault/act
of bullying on a mobile phone and circulating this.
As with other forms of bullying, it is important that
the whole-school community understands their
responsibility to report cyberbullying and support
the person being bullied. It is advisable that anti-
bullying policies refer to those ‘bystanders’ – better
termed ‘accessories’ in this context – who actively
support cyberbullying incidents and set out
sanctions for this behaviour.
15 www.teachernet.gov.uk/wholeschool/behaviour/schooldisciplinepupilbehaviourpolicies/
Location
1.4.7 Cyberbullying can take place at any time and
can intrude into spaces that might previously have
been regarded as safe or personal – the person being
cyberbullied can be left feeling that there is no place
to hide and that they might be attacked at anytime.
Sending abusive text messages, for example, means
that cyberbullying can take place any time of the day
or night, and the target of the cyberbullying can be
reached in their own home, even their own bedroom.
1.4.8 Traditionally, young people have been told to
walk away from someone who is trying to bully
them. However, it is not possible to walk away from
constant phone messages or from a website which
has been created to hurt you.
1.4.9 Cyberbullying will have an impact on the
education and wellbeing of the person being bullied,
and the physical location of the bully at the time of
their action is irrelevant in this. Schools now have
broad new powers to discipline and regulate the
behaviour of pupils even when they are off the
school site – these are set out in the Education and
Inspections Act 2006 (see information on the law and
also section 3.4 of the School Discipline and Pupil
Behaviour Policies guidance15).
Anonymity
1.4.10 People who cyberbully may attempt to
remain anonymous and this can be extremely
disturbing for those that are being bullied. Although
the person being bullied may know that their bully is
from within their circle of friends or pupils at their
school, they may not know the actual identity of the
bully and this can make them uneasy, distrustful, and
suspicious of all their relationships.
1.4.11 However, perpetrators are not as anonymous
as they might think and there are ways of identifying
cyberbullies. Having said that, although there is likely
to be an evidence trail (‘digital footprints’) left by the

bully, finding out further information that might help
identify who is responsible – by tracking down the
person’s email or IP address (their unique computer
address) – is time consuming and usually requires
the involvement of other agencies (the police and
the service provider, for example). And in some cases,
finding out this information will not clearly identify
an individual. See the ‘Responding to cyberbullying’
section for further information.
Motivation for bullying
1.4.12 Some cyberbullying is clearly deliberate
and aggressive. However, some instances of
cyberbullying are known to be unintentional and the
result of not thinking or a lack of awareness of the
consequences. Online behaviours are generally less
inhibited than offline behaviour, and some children
report saying things to others online that they would
not have done offline. Two other factors may be
involved here:
• The distance between the bully and the person
being bullied: The lack of context can mean that
what might intended as a joke may not be
received as such, and indeed may be deeply
upsetting or offensive to the recipient.
Additionally, because the bully cannot see the
person being bullied, and the impact that their
message has had, there is less chance for either to
resolve any misunderstanding or to feel empathy.
• A single act can have unintended consequences:
Sending a 'funny' (i.e. embarrassing or
humiliating) picture of a fellow pupil (even a
friend) to someone could be viewed as a one-off
incident, but the nature of the technology means
that the sender loses control of the image they
have sent. It can be sent on, posted up online
and have a wide circulation. For this reason, a
one-off action can turn into a repetitive action,
and have consequences for the person being
bullied far beyond what the original sender may
have anticipated.
16 www.msn.co.uk/customercare/protect/cyberbullying/default.asp?MSPSA=1
GUIDANCE 15
Understanding cyberbullying
1.4.13 Schools need to ensure that ignorance of
the consequences and potential seriousness of
cyberbullying is not a defence – that all pupils are
aware of the issues and rules, for example through
induction procedures, awareness days and
Acceptable Use Policies (see the ‘Preventing
cyberbullying’ section).
Evidence
1.4.14 Unlike other forms of bullying, many
cyberbullying incidents can themselves act as
evidence – in the form of text messages or computer
‘screen grabs’, for example. As well as evidence that
an incident has taken place, they may also provide
information about who the perpetrator is. A nasty
text message, for example, will contain the message,
the date and time that it was sent, and information
about the phone it was sent from.
1.4.15 Having proof that they are being bullied
might make it easier for some targets of bullying to
come forward – however, a recent MSN report found
that 74% of teens did not try to get help the last time
they were cyberbullied16. Adults and young people
may not know how important the evidence could be,
or how to preserve it. You can find out more about
preserving evidence in section 3.3 of the
‘Responding to cyberbullying’ chapter.
1.5 BRIEF INTRODUCTION TO THE
TECHNOLOGY
Mobile phones
1.5.1 Children and young people use their mobile
phones for much more than talking and texting.
The most additional common uses include telling
the time, downloading and forwarding pictures and
film clips, checking email and accessing the internet,
listening to music, and playing games. The wide
range of activities phones are used for, coupled with
the phone’s role in managing young people’s
different social networks, makes the phone a
powerful and important tool.
16 Safe to Learn: Embedding anti-bullying work in schools
1.5.2 As well as being able to store music, take
photos and video and send these to other phones,
children can also share this content with other
phones via short range wireless connections.
Wireless personal area network technology uses
radio waves, providing a free way for enabled devices
(phones, computers, handheld game consoles) in
close range of each other to share information.
Benefits
Mobile phones allow children to stay in touch with,
and be contacted by friends and family, parents and
carers. They can be useful in emergency situations,
and they can allow children a greater sense of
independence. They can be used for storing files,
taking notes, capturing evidence, and research via
an internet connection.
Risks
Supervising a young person’s use of their mobile
phone is far harder than, for example, their use of
the family computer, since phones are rarely shared
and potentially always on.
It is very easy for children to create and circulate
content, including inappropriate content. Using
a short range wireless connection, content can
be sent for free between enabled devices. Once
forwarded, content is almost impossible to control,
and can easily spread by being passed on.
Mobiles and bullying
Mobiles have been used to cyberbully in a number
of different ways: making nasty calls; sending nasty
text messages; taking and sharing humiliating
images; videoing and sharing acts of bullying and
assault via camera phone (sometimes misleadingly
called ‘Happy Slapping’, see note at 1.3.13). Content
can be posted online or sent from phone to phone,
or shared using a short range wireless connection
between devices, bypassing the phone network
altogether.
Instant Messenger and Voice Over
Internet Protocols
1.5.3 Instant messenger (IM) is an application that
allows the pupil to chat in real time (i.e. live) with
people on a pre-selected friend/buddy list. IM
programmes usually require you to download an
application to your computer, although there are
some web-based services available which do not
need installing.
1.5.4 IM programmes let you see which of your
contacts are online when you are, and let you chat
using text while you are using your computer. Like
social networking sites, IM services work between a
network of people who have signed up to the same
service and given each other permission to see and
talk to each other when they are online. Unlike
chatrooms, which are typically public and open to
anyone signed up to the chat service, IM is more
private, usually taking place between two people.
Windows Live Messenger (previously called MSN
Messenger) is a popular IM programme; however,
there are several different types of IM services.
1.5.5 Voice Over Internet Protocols (VOIP)
programmes are becoming increasingly popular
since they offer unlimited free phone calls anywhere
in the world, using an internet connected computer
and microphone. Again, calls can only take place
between people who have downloaded the same
application. Services like Windows Live Messenger
include IM, voice calling and video conferencing.

Benefits
Typically children use instant messenger as an
extension of their regular social lives, to talk to
friends outside of school. IM is a quick and effective
way of keeping in touch, and is a good social tool.
IM is also used by some teachers to keep in touch
with students – in order to check through
homework, for example. IM is extremely useful for
some types of collaborative work and research.
Some IM programmes keep records of IM
conversations or at least offer this facility, which can
be used as evidence of work or as an example of
problem solving (it is a good idea to activate this
function as it serves as the best evidence when
making a report of cyberbullying).
Risks
Some Instant Messenger products can hold up to
600 ‘buddies’, or contacts, and some children may
see having as many ‘friends’ as possible as
important. It is usually common for people with
large buddy lists to know only a small proportion
of the people on their list.
IM and bullying
Bullies can use IM to send nasty messages or
content to other users. People can also ‘hack’ into
IM accounts and send nasty messages to contacts.
Chatrooms and Message Boards
1.5.6 There are many chat sites online, hosted by
major service providers such as AOL as well as by
smaller independent websites. Typically chatrooms
are thematically organised around interest, age, or
location. Chatrooms allow groups of people from
across the world to hold text (and sometimes voice)
conversations in real time.
GUIDANCE 17
Understanding cyberbullying
Benefits
Most chatrooms have a theme or topic, so it is
possible to meet others from all around the world
with the same interest as you and exchange ideas.
Often people assume different identities in
chatrooms, which means they can be free from
real world stereotypes, such as age, race and
appearance. For young people this can be an easy
way to meet new people, or explore issues which
they are too shy to talk about in person. Since many
people can join in and observe a conversation at
one time, chatrooms are very useful for
collaborative work. Most chatroom programmes
record conversations too.
Message boards allow different people to add
replies to discussion topics, creating chains of
replies around particular topics, which make take
place over several months. Some message boards
are moderated – no new messages will be
published publicly until the owner reviews them –
but many others are monitored only by users, who
are expected to report any inappropriate messages.
Risks
Public chatrooms can be populated by anyone,
since accounts usually only require an email address
to verify a user’s identity. Most chatrooms do not
carry age verification; therefore children can visit
chatrooms of an adult nature. People can behave
inappropriately or abusively. The nature of
chatroom exchanges tends to be less inhibited than
when people meet in the real world for the first
time, and children can be persuaded to give out too
much personal information and contact details.
Chatrooms are not necessarily moderated (by a
person observing conversations as they happen) or
monitored (by someone reviewing previous chat
session transcripts). There have been cases of adults
using public chatrooms to begin relationships with
children and young people in order to sexually
abuse them (see Resources section for educational
and awareness materials in this and other internet
safety areas).
18 Safe to Learn: Embedding anti-bullying work in schools
Chatrooms and Message boards and
bullying
Nasty or threatening messages can be sent, without
the target necessarily knowing who they are from.
Groups may ostracise and ignore individual
children. Children and young people may be
persuaded to give out private information, or enter
into apparent friendships with people who are
lying to them about who they are in order to
develop a friendship which they later exploit.
Email
1.5.7 Email is now an essential part of most people’s
working lives. Email accounts are provided by
schools, broadband providers or other internet
companies.
Benefits
As well as the obvious communication benefits,
web-based email addresses do not require external
verification and such ‘disposable’ accounts can
be extremely useful for entering competitions
and other activities that generate unwanted or
spam email.
Risks
Email can be used to send inappropriate images
and to forward private information. Computer
viruses and spam are common email hazards.
Web-based email can also be used by people
wanting to remain anonymous in order to send
malicious or nasty mail.
Email and bullying
People can send bullying or threatening messages
via email, or repeatedly send unwanted messages.
Unsuitable images or video clips can be passed on.
Personal emails can be forwarded inappropriately.
The majority of computer viruses are forwarded
by email.
Webcams
1.5.8 Webcams are small digital cameras which
work with computers. They can be used to record
photographs or video, which can then be posted on
the internet or forwarded. Most commonly, they are
used to see someone that you are talking to online.
Benefits
Webcams let you see, in real time (i.e. live), people
you are chatting to, places or events. They can have
educational value – they can bring far-off places to
life; be used to view experiments; be used for video-
conferencing; and be used to facilitate collaboration
between schools in different parts of the country or
the world. They can also help families to keep in
touch with friends and relatives.
Risks
Children have been persuaded to take or send
inappropriate photographs of themselves, either
by their friends or by people they have only had
contact with online. Webcam use can be difficult to
supervise if the computer is in a child’s bedroom or
private space. Although fairly rare, there have been
cases of people using virus programmes that can
‘hijack’ the output of a remote webcam and send
the images to their own computers.
Webcams and bullying
Children can be persuaded or threatened into
doing things on a webcam that they might not
have otherwise done – undressing or acting in
unsuitable ways, for example. Once someone else
has content the child or young person would not
like their parents to know about or be made public,
they are at risk of being further manipulated or
threatened.
 GUIDANCE 19
Understanding cyberbullying

Social network sites
1.5.9 Popular social networking websites such as
MySpace and Bebo let users create their own
homepages, set up ‘blogs’ and add friends.
1.5.10 Social network sites typically allow users to
set up a profile page, listing their interests and other
details, and they enable contact with other users.
Many focus on interests or services – for example,
photo storage and sharing (like Flickr), music
preferences (like last.fm) or education (like
EduSpaces). They may also provide ‘blogging’ or
other website creation tools.
1.5.11 Social network sites are designed to help
people find and make friends, and to make it easy to
stay in touch.
Benefits
Young people use online space in much the same
way that they use offline space – they socialise with
friends and other people online, express
themselves, and meet up in much the same way as
they might do at youth clubs or shopping centres.
These sites provide them with public and private
space, and let them express themselves creatively
by selecting and creating content. Young people
can usually set permissions, giving them control
over who can access their profiles and pages.
available sites as private and personal places, and
may post photographs for their immediate friends
which may be inappropriate or embarrassing in
other contexts. Sites which are not made private, or
registered as belonging to an over 18 year old, are
easy to search for and may be indexed and cached
by search engines such as Google. Staff members
and parents may view the time spent on social
network sites as inappropriate and excessive, since
many young people will check their sites several
times a day for messages and to view their friends’
activity.
Social networking and bullying
Social Network sites can be abused in a number of
ways. Most allow comments to be left (although
some sites enable users to review / approve content
before it is shown), and nasty comments may be
posted. People might use their own sites to spread
rumours or make unpleasant comments about
other people, or post humiliating images or video
of them. Fake profiles are also fairly common, and
these might be used to pretend to be someone else
in order to bully, harass or get them into trouble.

Risks
Many young people view the social network site
they use as the hub of their online activity and will
spend a lot of time on the look and content of their
pages. Profiles and blogs may contain a lot of
detailed and personal information – about
themselves and their friends. This can be misused
by bullies and sexual predators to gain information
about an individual, their interests and tastes as well
as their location or contact details. Children and
young people often mistakenly view publicly
20 Safe to Learn: Embedding anti-bullying work in schools
Video-hosting sites
1.5.12 Images and video can be posted to blogs,
social networking sites, and sent by email. There has
been a tremendous rise in the popularity of video-
hosting sites, such as YouTube, where clips are
uploaded and shared. Popular video clips can be
seen by hundreds of thousands of visitors to the
sites, and clips are rated by viewers and comments
(including video comments) can be posted about
them. The video footage can also be embedded in
other sites and pages.
Benefits
There can be a lot of good content to view on
these sites – music videos, funny clips and other
entertainment, as well as useful resources, including
educational resources. Even internet safety and
anti-bullying videos can be found on these sites.
Video is stored on and streamed from the sites
themselves, which means that viewing is very easy.
Risks
There are two ways that children may be exposed
to risk on video-hosting sites: children may access
inappropriate material (for example, violent or
pornographic content), and they may post
inappropriate material, which might make them
contactable and vulnerable or which might lead
to embarrassment of themselves or others.
Video-hosting and bullying
Video-hosting sites can be misused for
cyberbullying, and staff as well as pupils have been
victim to content posted up on such sites. The
cyberbullying may take the form of video taken
without the subject’s knowledge, even from within
class, that is then posted and shared, and/or acts of
violence against people or property.
Virtual Learning Environments (VLEs)
1.5.13 Many schools now use software that creates
a site especially designed for education, called a
Virtual Learning Environment (or VLE). Programmes
such as Moodle allow school staff to set assignments,
tests and activities and to track their students’
progress. A VLE might only be available from the
school network, or might be accessible from any
internet connection (i.e. from home).
Benefits
VLEs provide a structured way for staff to set work and
deadlines, and for students to complete activities,
submit assignments, and to communicate and
collaborate with others from their school community.
These sites are typically password protected, to
enable closed working environments and to track the
learners’ progress through tasks. They can enable
students to access resources from home.
Risks
If the site is accessible from any internet location,
schools will want to ensure that a specific
‘Acceptable Use Policy’ is in place – although users
are tracked, students need to be aware of appropriate
and acceptable behaviour. It is also important that
staff are aware of data protection issues, and how
to respond to reports or discovery of offensive
messages or images. Ensuring that passwords are
kept private is important, so that accounts are not
accessed or misused by anyone else.
VLEs and bullying
Although users are tracked, students may still
misuse the platform or post inappropriate
messages or images. VLEs usually consist of a range
of tools – for example, message boards, chatrooms,
and Instant Messaging – that can be misused in
the same ways as services outside of the school
environment. Hacking can provide a range of
opportunities for cyberbullying – including sending
nasty messages from someone’s account, posting
inappropriate comments, and deleting schoolwork.
 GUIDANCE 21
Understanding cyberbullying

Gaming sites, consoles and virtual worlds
1.5.14 A significant amount of the time young
people spend using technology is taken up playing
the wide variety of computer games that are
available. Computer games can be accessed through
online gaming sites, where chat between players
across the world is facilitated, or on handheld
consoles which use a wireless connection to enable
people in the same location to play against each
other or to message one another. Virtual worlds –
2 or 3D online sites where users are encouraged
to design their own avatars (the figures that
represent them in the virtual world), explore and
create their own environments – are becoming
increasingly popular.
Gaming sites, consoles and virtual
worlds and bullying
As with other programmes that allow people to
communicate with one another, there have been
instances of name-calling and abusive / derogatory
remarks. Additionally, players may pick on weaker
or less experienced users, repeatedly killing their
character. Wireless-enabled consoles can be used
to forward unwanted messages to other
compatible devices.

Benefits
Gaming has been shown to help develop many
positive skills – leadership and decision-making,
puzzle solving, teamwork and collaboration. Games
that involve physical movement (dance mats, for
example) can provide children and young people
with a fun way to exercise. There are now many
ways of using game software within education –
e.g. Wordshark, which is a collection of games
designed to support students with dyslexia.

Virtual worlds can be used to explore and bring to

life a range of topics – for example, recreating
ancient cities or building virtual prototypes.

Risks
Many games are designed for the adult market and
are inappropriate for children and young people,
containing adult themes and explicit imagery,
although games should carry labels which indicate
the age they are appropriate for. Parents will often
want to limit the amount of time spent on games,
since completing levels and finishing will be fairly
addictive in any effective game. Games and virtual
worlds accessed online will be harder to monitor for
appropriateness of content.
22 Safe to Learn: Embedding anti-bullying work in schools
2. Preventing
cyberbullying
2.1 TAKING A WHOLE-SCHOOL
COMMUNITY APPROACH
2.1.1 This section looks at prevention strategies
and activities that are designed to support the
whole-school community. By this, we mean learners,
teachers, support staff, parents, school leaders,
governors, and all the people who provide support –
including teaching assistants, break and lunchtime
supervisors, and extended school provision staff.
Each activity should include a consideration of who
can contribute to development, consultation and
implementation, and how to best inform and involve
as many people as possible. Some activities will be
targeted at particular groups – however, effectively
addressing cyberbullying means making sure the
whole-school community knows that cyberbullying
is not acceptable and knows how to identify and
take action against cyberbullying.
2.1.2 Schools can take pro-active measures to help
prevent cyberbullying from occurring, and to reduce
the impact of any incidents that do happen. Schools
are already required to have a clear policy on tackling
all forms of bullying, which is owned, understood and
implemented by the whole-school community.
Cyberbullying prevention can build on this (see
section 2.3 on reviewing and updating policies to
include cyberbullying), promoting and maintaining a
safe and welcoming environment as a responsibility
and function of the whole-school community.
Co-ordinating responsibility
2.1.3 The first step is to decide who within the
school community takes responsibility for the
coordination and implementation of cyberbullying
prevention and responding strategies. To be most
effective, it is likely that the person nominated will be
a member of the senior management team and/or
the staff member responsible for coordinating
overall anti-bullying activity. An effective approach
requires clearly defined responsibilities, reporting
lines and communication – essential in the context
of the time and other resource challenges that staff
have to manage. School staff with responsibility for
pastoral care, behaviour and IT systems, as well as
the school council, parents and teacher unions /
professional associations representing staff, will
need to work together.
2.1.4 It is useful to identify key partners from outside
agencies who can support your school in tackling
cyberbullying – the police, your Local Safeguarding
Children Board, and a member of your local
Broadband Consortia (if they are providing you
with internet services) are recommended. Local
Safeguarding Children Boards (LSCBs) play a key role

in coordinating and ensuring the effectiveness
of work to safeguard and promote the welfare
of children in their areas. Where instances of
cyberbullying present a significant problem, and
are considered a local priority for action, LSCBs
may work with local authorities, schools and other
organisations to support the development of
effective policies to address the problem.
2.1.5 Sharing resources, practices and ideas with
anti-bullying leads from other schools is also
recommended. This can help ensure joined up and
effective prevention planning and ensure that good
practice is disseminated.
Case study:
Norfolk County Council have adopted a range of
strategies for dealing with cyberbullying, focusing
particularly on raising the awareness of adults who
may not be aware of the potential for misuse of
technology and the implications of this misuse.
Among other things, Norfolk has: provided training
for school staff and parents; organised a two-day
conference for school staff on e-learning, including
workshops on cyberbullying and e-safety; asked a
group of young people to design assemblies on the
topic of cyberbullying for primary and secondary
schools for Anti-Bullying Week; and organised a
conference for parents on the topic.
Preventing cyberbullying
2.1.6 There is no single solution to the problem of
cyberbullying; it needs to be regarded as a live and
ongoing issue. This section outlines a prevention
framework made up of the five essential action areas
that together offer a comprehensive and effective
approach to prevention:
• Understanding and talking about cyberbullying
• Updating existing policies and practices
GUIDANCE 23
Preventing cyberbullying
• Making reporting cyberbullying easier
• Promoting the positive use of technology
• Evaluating impact of prevention activities
2.1.7 The approach you take will reflect the culture,
needs and preferences of your school community.
However, your cyberbullying strategy will need to
align with existing anti-discrimination work,
curriculum delivery within Citizenship and PSHE,
and the work you undertake as part of the Social
and Emotional Aspects of Learning programme
(SEAL) (see the general Safe to Learn guidance, in
particular annex C, for more information on using
the curriculum and the SEAL programme to
address bullying).
2.1.8 As with other issues that potentially impact on
the whole-school community, wherever possible and
appropriate policies and processes should be
discussed, agreed and developed collectively.
2.2 UNDERSTANDING AND TALKING
ABOUT CYBERBULLYING
2.2.1 Cyberbullying is an issue that is already on your
school’s agenda. Cyberbullying prevention is an
important way of working towards the Every Child
Matters outcomes, and of safeguarding the health
and wellbeing of your school community.
2.2.2 Developing and agreeing on a shared
understanding of what cyberbullying is, and
supporting school-wide discussion around the issue
of cyberbullying provides a key foundation to all
your prevention activities.
2.2.3 How can you make sure that the whole school
is confident and clear in its understanding of
cyberbullying?
24 Safe to Learn: Embedding anti-bullying work in schools
Promote awareness and understanding
about cyberbullying
2.2.4 It is important that the whole-school
community has a shared, agreed definition of
cyberbullying. All should be aware of the impact of
cyberbullying and the ways in which it differs from
other forms of bullying.
2.2.5 We advise that the whole-school community
has an opportunity to contribute to and be a part
of a policy and practice development and review
discussion about cyberbullying.
2.2.6 As with other forms of bullying, it is vital to
include discussion of prejudice-driven bullying.
Sexist, racist and homophobic cyberbullying, as
well as cyberbullying related to SEN and disabilities,
should be addressed within any discussion and
understanding.
Case study:
Mossley Hollins school in Manchester recently held
a cyberbullying conference for their year 9 pupils – a
whole day event including information, activities and
workshops which focused on tackling cyberbullying.
Following their work with the pupils, they invited
parents to attend a one-hour information meeting
(see item E in the Resources section for a copy of the
letter to parents).
Publicising Sanctions
2.2.7 Pupils need to be aware of the importance of
a safe environment and how to behave responsibly
when using ICT. Pupils, parents, staff and governors
should all be aware of the consequences of
cyberbullying. Young people and their parents
should be made aware of pupils’ rights and
responsibilities in their use of ICT, and what the
sanctions are for misuse.
Case study:
Kesteven and Sleaford High School in Lincolnshire has
produced information for learners and parents on
sanctions for cyberbullying. You can review these for
ideas about communicating your schools sanctions
(see item F in ‘Resources’ section).
Provide information about out-of-school
bullying
2.2.8 Under the Education and Inspections Act 2006,
the school has new powers in relation to out-of-
school bullying (see information on the law). Staff
members and governors will need to understand
what these are, so that they can deal with or refer
cases appropriately. Students and parents will need
to know that the school can provide them with
support if cyberbullying takes place out of school.
2.3 UPDATING EXISTING POLICIES
AND PRACTICES
2.3.1 This section deals with recording incidents,
adapting existing policies and making sure everyone
knows about any changes. Reviewing existing anti-
bullying policies and school behaviour policies so
that they cover cyberbullying incidents is an
important part of your regular review of these
documents. Cyberbullying issues will also impact on
a range of other policies – staff development, ICT
support and infrastructure, and e-learning strategies,
for example.
Review and update policies to
include cyberbullying
2.3.2 School governors, head teachers and senior
managers should audit existing policies and
procedures to decide which need to be changed
or adapted in order to include cyberbullying
prevention and how to respond to incidents.

2.3.3 The school’s anti-bullying policy and/or school
behaviour policy will certainly need to address
cyberbullying if they do not already do so. It is
important too that cyberbullying is addressed in ICT
and other relevant lessons, and is brought to life
through activities. As with other whole-school
policies, it is important to include and empower
young people to take part in the process.
Log all cyberbullying incidents
2.3.4 Keeping good records of any incidents
of cyberbullying is essential, and can help to
monitor the effectiveness of your school’s prevention
activities. The use of technology in any incident
can be recorded using your existing incident
report forms and these can be logged as
cyberbullying incidents.
Review your existing Acceptable Use
Policies (AUPs)
2.3.5 AUPs are the rules that students have to agree
to follow in order to use ICT in school. If you only
have these online, you might want to produce a
paper form that can be sent home for parents to see.
You may want to produce separate AUPs for using
different kinds of technology – e.g. for use of the
school network; use of a school Virtual Learning
Environment (VLE) or other learning platforms /
interactive tools; and use of mobile phones on school
premises. Policies should outline the rules and
responsibilities of use, sanctions for misuse, and
issues around confiscation and retention.
2.3.6 It is for schools to decide if they wish to ban or
restrict the use of mobile phones or certain internet
sites during school hours. It is open for schools to
include in their behaviour / anti-bullying policies
measures to restrict the use of mobile phones and
websites and strong sanctions for their misuse.
Cyberbullying should be taken very seriously and
schools should take such action as they consider
GUIDANCE 25
Preventing cyberbullying
appropriate to prevent it. However, it is important
that such rules are well-publicised and that parents
are aware of such measures (parents may currently
contact their child via mobile to arrange suitable
after-school collection times, for example, and need
to know if phones will be required to be switched
off during school hours) and that the school takes
into account other implications as discussed in
paragraph 1.2.4.
2.3.7 Staff who have a role in moderating and
monitoring VLEs and other online environments
should have clear guidance on how to respond to
reports of cyberbullying or the discovery of offensive
or upsetting material. If offensive material is posted
on your institution’s website, the school may face
potential liability if they fail to take it down promptly
once they are made aware of it. The AUP is a positive
step the school can take towards ensuring material is
not published, along with anti-cyberbullying and
‘responsible use’ activities. It is very important that
action is taken as soon as the staff member
responsible or the school becomes aware of any
offensive material. Removing material needs to
involve the school IT staff, since data may be required
by a third party for investigation.
Case study:
An example of an Acceptable Use Policy for pupils
from a secondary school in Manchester can be found
in item H in the ‘Resources’ section. Pupils need to sign
up to the policy to show both that they agree to the
rules in the AUP and understand the consequences if
they do not.
2.4 MAKING REPORTING
CYBERBULLYING EASIER
2.4.1 Reporting any incident of bullying can be really
hard for the person being bullied and for bystanders.
You can read some of the reasons given for not
reporting bullying in ‘What children and young
people say’ in the Resources section.
26 Safe to Learn: Embedding anti-bullying work in schools
2.4.2 It is important that adults in the community
are aware of potential non-verbal signs and
indications of cyberbullying. These include
depression, anxiety, or fear. Staff should be alert to
children seeming upset after using the internet or
their mobile phone. This might involve subtle
comments or changes in relationships with friends.
They might be unwilling to talk or be secretive about
their online activities and mobile phone use.
2.4.3 Making sure that all members of the school
community recognise that asking for help from
a person with greater authority is not a failing or
a weakness, but a strength which shows good
judgement. No one should feel that they have to
deal with cyberbullying alone.
2.4.4 Because reporting can be difficult, it is
important to have different ways for reporting
cyberbullying incidents. Making reporting as easy
as possible, and making sure everyone knows how
they can report incidents is also an excellent way of
raising awareness that cyberbullying is unacceptable.
Publicising school reporting routes
2.4.5 Schools are advised to provide parents and
carers with information about cyberbullying policies,
procedures and activities, and opportunities for
becoming involved in these. This could be done in
several ways – through an assembly or event which
parents are invited to attend, through letters home
and by posting information on the school website.
Children, young people and parents will need
information about all the ways they can report
concerns and incidents and what they should expect
to happen in return.
2.4.6 It is important to make sure that all staff,
including support staff, know who they should talk
to if they become aware of or suspect cyberbullying
is taking place, and they understand how important
reporting any cases can be.
Explore different reporting routes
2.4.7 There are a range of strategies, including pupil-
centred strategies, which schools have successfully
adopted to both raise awareness of bullying issues
and offer pupils alternative reporting routes (see
sections 4 and 5 of overarching Safe to Learn
guidance).
2.4.8 Where peer support programmes are already
in place, we advise that schools check what
information is provided about cyberbullying and
look at how cyberbullying can be included in
training and awareness.
2.4.9 Setting up a cyberbullying taskforce, made
up of pupils of all ages who are helped to identify
what the problems are and develop solutions in
conjunction with teaching staff, is a great awareness
raising activity. It could also be carried out within
existing groups – such as the school student
council or an existing bullying or healthy schools
student group.
Bystanders
Do not overlook the role and responsibility of
bystanders. In cases of cyberbullying, bystanders or
‘accessories’ to the bullying have a more active role –
they may forward on messages, contribute to
discussions in a chat room, or take part in an online
poll. So even though they may not have started the
bullying or think of themselves as bullying, they are
active participants, making the situation worse and
compounding the distress for the person subjected
to the bullying.
We know from talking to children that one of their
biggest fears in reporting incidents they know about
is that they will become the target of bullying. Schools
can involve children and young people in developing
‘bystander guidelines’ that provide information about
the responsibilities of bystanders in cyberbullying
incidents.

Signpost information about external
reporting routes
2.4.10 It may be appropriate to report incidents of
cyberbullying directly to the internet service
provider or mobile phone companies. There are
websites that provide contact details17 and schools
can provide this information by letter to parents or
from an area on their own websites. See our section
on ‘Responding to cyberbullying’ for information on
specific providers and technologies relating to
reporting incidents, deleting accounts and getting
offensive materials removed.
An example of one service provider:
“AOL offers bullying and general online safety advice
on our Kids and Teens channels and younger AOL
users can also speak to our agony aunt and uncle. In
addition, we clearly signpost how users can report
any inappropriate activity they come across. These
reports are sent to AOL’s Conditions of Service team,
which reviews them and takes the appropriate action”.
2.5 PROMOTING THE POSITIVE USE OF
TECHNOLOGY
2.5.1 It is important for the adults in the school
community to understand how children and young
people think about and use technology. ICT is
increasingly recognised as an essential life skill, and
embedding technology across the curriculum and
in learning and teaching delivery provides
opportunities and benefits for both learners and
staff members.
2.5.2 New technologies are being developed all the
time, so keeping up-to-date and informed about
young people’s use of technologies, as well as their
potential abuse and risks, is very important. While
children and young people are experts on their own
use and can be a valuable source of information
about the technology, they may not necessarily
understand all of the risks involved and the strategies
for keeping their experience of technology safe and
17 See, for example, www.stoptextbully.com.
GUIDANCE 27
Preventing cyberbullying
enjoyable (see ‘Understanding cyberbullying’
section).
2.5.3 Developing an organisational culture of
confident ICT users supports innovation, e-safety and
digital literacy skills, and helps to combat misuse and
high-risk activities.
Review existing staff development targets
and opportunities
2.5.4 Technology is successfully being used to
support engaging, positive and effective learning,
and to realise and increase the potential of
personalised learning. The embedding of
appropriate technologies within learning and
teaching practice is a powerful tool which can be
used to enhance learning opportunities for all –
making learning more flexible, creative, accessible
and engaging. Staff development around e-learning
and technology provides a great opportunity for
staff to both develop their own practice creatively
and to support children and young people in their
safe and responsible use.
2.5.5 As part of the performance management
process line managers will be working with teachers
to identify what professional development might
help them develop their practice further. Where
appropriate, schools should look at e-safety issues
as an important component of technology for
education for all members of the school community
including school leaders and governors, as well as
teachers, support staff and extended schools
provision staff.
Promote e-safety and digital literacy
2.5.6 Explore safe ways of using technology with
learners to support self-esteem, assertiveness, and
participation and to develop friendships. Young
people are more likely to report the misuse of
technology in an environment where positive use
is promoted.
28 Safe to Learn: Embedding anti-bullying work in schools
2.5.7 Appropriate, safe and responsible behaviour in
online environments may not be something that
your learners have previously discussed or been
supported in. Look at the ways in which you can
support and discuss ‘netiquette’, e-safety and
digital literacy.
2.5.8 Ensure that all staff and students are aware of
the importance of keeping passwords confidential
and user accounts secure. It is also important that
everyone knows how to properly log out of accounts,
and that students and staff members never leave
logged in accounts unattended.
Password protection:
Everyone in the school community needs to
understand the importance of keeping account
information private and secure – for example, by
using hard-to-guess passwords and changing them
frequently. Children who have online accounts of any
kind need to be aware that they should never share
their passwords (exceptions here could include a
parent or carer, teacher or ICT support staff member
at school), and never let anyone use their accounts.
The school’s Acceptable Use Policy (AUP) – the
agreement between pupils and the school which
outlines the responsibilities of learners using the
school’s computer network and equipment – may
usefully refer to password privacy (see item H in the
‘Resources’ section for an example AUP). We also
advise that it is covered in any internet safety lessons
or induction to school accounts that might be
password protected (e.g. the VLE).
2.5.9 Childnet International has produced a range
of resources which can be used in the classroom
or to support individual learners, staff members
and parents:
• For Primary schools, see www.kidsmart.org.uk.
For secondary schools, see
www.childnet-int.org/kia/schools/.
• The SMART Rules – five rules for keeping in
control of one’s online activity. For Primary
schools see www.kidsmart.org.uk/yp/smart/
default; for secondary schools, see
www.chatdanger.com/smart.
• For a resource for parents developed with
the DfES (now DCSF), see
http://www.childnet-int.org/kia/parents/.
• For a resource on online security developed
by a young person for young people see
www.childnet-int.org/sorted/.
Review how the school network
is monitored
2.5.10 The ability to conduct searches of internet
use records at school is an important part of being
able to investigate incidents of cyberbullying (see
‘Responding to cyberbullying’ section). Your school
may want to review and investigate available
software, for example monitoring software and key
logging programmes. It is important that learners are
aware of what monitoring procedures are in place.
Knowing that the school is taking such steps may
also act as a disincentive for bullies to misuse school
equipment and systems. However, it is important to
remember that using technology to monitor, block
or filter activity at school is only a partial solution.
2.6 EVALUATING THE IMPACT OF
PREVENTION ACTIVITIES
2.6.1 Tackling cyberbullying is an ongoing process,
and to get the most out of your prevention activities
regular reviews of impact are vital. Cyberbullying
should be included in your review processes, and
included wherever appropriate in new policies.
Monitoring your impact is an important way of
marking and celebrating your school’s progress.
 GUIDANCE 29
Preventing cyberbullying

2.6.2 The school should consider how it might most

effectively measure the impact of prevention
activities, and how it will communicate findings to
the whole-school community. It is important to
remember that when an issue is initially made visible
and people feel safe to discuss and identify incidents,
it is likely that the school will see the number of
reports go up. It is important to communicate to
parents and the whole-school community why this
happens in the short term, and to recognise that
reducing incidents is a longer-term goal.

Conduct a regular survey

2.6.3 The Children’s Commissioner has

recommended that all schools conduct an annual
survey of pupil’s experiences of bullying18.
Cyberbullying incidents could be included in such
a survey. This will provide schools with a good
overview of how common cyberbullying incidents
are amongst pupils, and highlight any areas that
need particular attention. It will also provide you
with a broad measure against which you can check
the progress and impact of your prevention
activities.

2.6.4 Many schools already use student and staff

satisfaction surveys. It is useful also to conduct a
parent satisfaction survey. Asking questions about
cyberbullying will provide you with an indication
about awareness and the success of your prevention
work. The Anti-Bullying Alliance (ABA) Audit
questionnaires are useful tools for evaluation19.

Publicise progress and activities to the

whole-school community

2.6.5 The staff members responsible for behaviour

and anti-bullying can review cyberbullying
prevention on an ongoing basis. Make sure you
keep parents informed, by letter home and via the
school website of your activities and the impact you
are making.
18 Bullying Today: A report by the Office of the Children's Commissioner (November 2006): www.childrenscommissioner.org/adult/consultationresponses.

cfm?id=1920.
19 www.anti-bullyingalliance.org.uk
30 Safe to Learn: Embedding anti-bullying work in schools
3. Responding to
cyberbullying
This section is designed to provide advice to schools
on the options available for responding to incidents
of cyberbullying.
3.1 CYBERBULLYING IS A FORM
OF BULLYING
3.1.1 It is important to recognise that cyberbullying
is a form of bullying, and as such schools should
already be equipped to deal with the majority of
cyberbullying cases through their existing anti-
bullying and behaviour policies and procedures (see
the ‘Preventing cyberbullying’ section for information
on including cyberbullying in these policies).
3.1.2 In all cases of bullying, incidents should be
properly documented, recorded and investigated;
support should be provided for the person being
bullied; other staff members and parents should be
informed as appropriate; and those found to be
bullying should be interviewed and receive
appropriate sanctions.
3.1.3 There are particular features of cyberbullying
that differ from other forms of bullying and need
to be recognised and taken into account when
determining how to respond effectively. The key
differences are:
• Impact – the scale and scope of cyberbullying
can be greater than other forms of bullying.
• Targets and perpetrators – the people involved
may have a different profile to traditional bullies
and their targets.
• Location – the 24/7 and anyplace nature of
cyberbullying.
• Anonymity – the person being bullied will not
always know who is attacking them.
• Motivation – some pupils may not be aware that
what they are doing is bullying.
• Evidence – unlike other forms of bullying, the
target of the bullying will have evidence of its
occurrence.
For more information on the differences between
cyberbullying and other forms of bullying, see
section 1.4 of the ‘Understanding cyberbullying’
chapter).

3.1.4 Practices and procedures to report and
respond to incidents of bullying and discrimination
should already be in place in the school, and the
majority of cyberbullying cases will be effectively
dealt with within existing protocols.
3.1.5 In addition to existing procedures, staff should
be particularly aware of the following during any
response to cyberbullying incidents:
• Supporting the person being bullied
• Recording and investigating incidents
• Working with the bully and sanctions
3.2 SUPPORT FOR THE PERSON
BEING BULLIED
3.2.1 As with other forms of bullying the target of
cyberbullying may be in need of emotional support.
Key principles here include reassuring them that
they have done the right thing by telling someone;
recognising that it must have been difficult for them
to deal with; and reiterating that no-one has a right
to do that to them. Refer to any existing pastoral
support/procedures for supporting those who have
been bullied in the school, and refer them to helpful
information and resources (see section 4 of the
overarching anti-bullying guidance, Safe to Learn).
3.2.2 Taking steps to ensure the school adopts a
culture that does not tolerate cyberbullying can help
to make the target of cyberbullying feel safe (see
section on ‘Preventing cyberbullying’).
Advice on online empowerment
3.2.3 It is important to advise the person being
bullied not to retaliate or return the message.
Replying to messages, particularly in anger, is
probably just what the bully wants, and by not
replying the bully may think that the target did not
GUIDANCE 31
Responding to cyberbullying
receive or see the message, or that they were not
bothered by it. Instead, the person should keep the
evidence and take it to their parent or a member of
staff (see section 3.3 on preserving evidence).
3.2.4 Advise the pupil to think about the information
they have in the public domain and where they go
online. It is important that pupils are careful about
who they give their mobile phone number to, and
that they consider whether they should stay
members of chatrooms, for example, where people
are treating them badly.
3.2.5 Advising the child to change their contact
details, such as their Instant Messenger identity or
mobile phone number, can be an effective way of
stopping unwanted contact. However, it is important
to be aware that some children may not want to do
this, and will see this as a last resort for both practical
and social reasons, and they may feel that they are
being punished.
Try to contain the incident
3.2.6 Some forms of cyberbullying involve the
distribution of content or links to content, which can
exacerbate, extend and prolong the bullying. There
are advantages in trying to contain the ‘spread’ of
this. If bullying content, e.g. embarrassing images,
have been circulated, it is important to look at
whether this content can be removed from the web.
3.2.7 Some steps can be taken to try to stop it
spreading:
• The quickest and most effective route to getting
inappropriate material taken down from the
web will be to have the person who originally
posted it remove it. If you know who the person
responsible is, ensure that they understand why
the material is hurtful and ask them to remove it
(see section 3.3 for advice on preserving
evidence).
32 Safe to Learn: Embedding anti-bullying work in schools
Quote from a parent:
“Thankfully my son’s school were very helpful, they
identified the child who posted the video from
another video he had posted, they have disciplined
the other child and had him remove the video, in fact
they took the matter very seriously and also had
any users who had posted anything with reference
to the school remove their videos so that was
very reassuring.”
• Contact the host (e.g. social networking site) to
make a report to get the content taken down
(see ‘When and how to contact the service
provider’ below). The material posted may
breach the service provider’s terms and
conditions of use and can then be removed.
• Confiscation of phones containing offending
content / asking pupils to delete the content
and say who they have sent it on to. School staff
can confiscate a mobile phone as a disciplinary
penalty, and have a legal defence in respect of
this in the Education and Inspections Act 2006
(s 94). However, staff do not have a right to search
through pupils’ mobile phones unless the
school’s behaviour policy expressly provides for
this and the pupil is reasonably suspected of
involvement in an incident of cyberbullying
which is of a sufficiently serious nature (see
section on Education Law for more information).
• Contact the police in cases of actual/suspected
illegal content. The police will be able to
determine what content is needed for evidential
purposes, potentially allowing the remaining
content to be deleted.
3.2.8 As previously stated, members of the school
workforce, as well as pupils, have been bullied online,
with insulting comments and material posted about
them. This material should be dealt with seriously
and incidents contained in the ways described above
to ensure the well-being of staff.
Preventing recurrence (e.g. blocking or
changing contact details)
3.2.9 There are some steps that the person being
bullied can take, depending on the service that the
bully has used, which can allow users to manage
who they share information with and also who can
contact them. These features can help a person
being bullied to stop further contact from the person
harassing them. For example, blocking the person
from their email or instant messenger buddy list will
mean that they will not receive messages from that
particular sender anymore.
3.2.10 Pupils or their parents should be advised
to contact the service provider or host (i.e. the
chatroom, the social network provider, or mobile
operator) to inform them of what has happened, and
get their advice on how to stop this happening
again. The service provider may be able to block
particular senders or callers (for landlines), or advise
on how to change contact details, and potentially
delete the accounts of those that are abusing the
service. This following section outlines what each
service provider can do and gives details on how to
contact them.
When and how to contact the service
provider
Mobile phones
3.2.11 All UK Mobile operators have nuisance call
centres set up and/or procedures in place to deal
with such instances. The responses may vary, but
possibilities for the operator include changing the
mobile number of the person being bullied so that
the bully will not be able to continue to contact them
without finding out their new number. It is not
always possible for operators to bar particular
numbers from contacting the phone of the person
being bullied, although some phone handsets
themselves do have this capability. Action can be
taken against the bully's phone account (e.g.
blocking their account), only with police
involvement.

3.2.12 Details of how to contact the phone
operators:
• O2: 08705214000 or ncb@O2.com
• Vodafone: call customer services on 191 from
a Vodafone phone or on any other phone call
08700700191 for Pay Monthly customers or on
08700776655 for Pay As You Go customers.
• 3: call 333 from a 3 phone, or 08707 330 333.
• Orange: call 450 on an Orange phone or 07973
100450 for Pay As You Go customers; call 150
from an Orange phone or 07973 100150 for
Pay Monthly customers.
• T-Mobile: call customer services on 150 from
your T-Mobile phone or on 0845 412 5000 from
a landline, or email using the 'how to contact us'
section of the T-Mobile website at www.t-
mobile.co.uk.
Social networking sites
(e.g. Bebo, MySpace, Piczo)
3.2.13 It is normally possible to block / ignore
particular users on social networking sites, which
should mean the user can stop receiving unwanted
comments. Users can do this from within the site.
3.2.14 Many social network providers also enable
users to pre-moderate any comments left on their
profile before they are visible by others. This can help
a user prevent unwanted or hurtful comments
appearing on their profile for all to see. The user can
also set their profile to ‘Private’, so that only those
authorised by the user are able to access and see
their profile.
3.2.15 It is good practice for social network
providers to make reporting incidents of
cyberbullying easy, and thus have clear, accessible
and prominent reporting features20. Many of these
20 The Home Office are publishing good practice guidance for social networking providers, drawn up by social network providers, children’s charities and
others, see http://www.police.homeoffice.gov.uk/operational-policing/crime-disorder/child-protection-taskforce
GUIDANCE 33
Responding to cyberbullying
reporting features will be within the profiles
themselves, so they are 'handy' for the user. If social
networking sites do receive reports about
cyberbullying, they will investigate and can remove
content that is illegal or breaks their terms and
conditions in other ways. They may issue conduct
warnings and they can delete the accounts of those
that have broken these rules. It is also good practice
for social network providers to make clear to the
users what the terms and conditions are for using
the service, outlining what is inappropriate and
unacceptable behaviour, as well as providing
prominent safety information so that users know
how to use the service safely and responsibly.
3.2.16 Contacts of some social network providers:
• Bebo: reports can be made by clicking on a
‘Report Abuse’ link located below the user’s
profile photo (top left hand corner of screen) on
every Bebo profile page. Bebo users can also
report specific media content (i.e. photos, videos,
widgets) to the Bebo customer services team by
clicking on a ‘Report Abuse’ link located below
the content they wish to report. Users have the
option to report suspicious online activity
directly to the police by clicking the 'Report
Abuse' link and then clicking the 'File Police
Report' button.
• MySpace: reports can be made via the ‘Contact
MySpace’ link, which is accessible at the bottom
of the MySpace homepage (http://uk.myspace.
com/), and at the bottom of every page within
the MySpace site.
• Piczo: reports can be made within the service
(there is a ‘Report Bad Content’ button at the top
of every member page). At the bottom of the
home page and on the ‘Contact Us’ page there is
a link to a ‘Report Abuse’ page. The ‘Report Abuse’
page can be found at http://pic3.piczo.com/
public/piczo2/piczoAbuse.jsp.
34 Safe to Learn: Embedding anti-bullying work in schools
Instant Messenger (IM) (e.g. Windows Live
Messenger or MSN Messenger)
3.2.17 It is possible to block users21, or change
Instant Messenger IDs so the bully is not able to
contact their target any more. Most providers will
have information on their website about how to do
this. In addition, the Instant Messenger provider can
investigate and shut down any accounts that have
been misused and clearly break their terms of
service. The best evidence for the service provider is
archived or recorded conversations, and most IM
providers allow the user to record all messages22.
3.2.18 It is also good practice for Instant Messenger
providers to have visible and easy-to-access
reporting features on their service (see the Home
Office good practice guidance for Instant Messenger
providers23).
3.2.19 Contacts of some IM providers:
• MSN: when in Windows Live Messenger, clicking
the ‘Help’ tab will bring up a range of options,
including ‘Report Abuse’ and there is also an
online feedback form at http://support.msn.
com/default.aspx?mkt=en-gb to report on a
range of products including MSN Messenger.
• Yahoo!: when in Yahoo! Messenger, clicking the
‘Help’ tab will bring up a range of options,
including ‘Report Abuse’.
E-mail providers (e.g. hotmail and GMail)
3.2.20 It is possible to block particular senders24, and
if the bullying persists an alternative is for the person
being bullied to change their email addresses. The
email provider will have information on their website
about how to create a new account.
21 See www.chatdanger.com/messenger/safetyadvice_learn2.aspx
22 See www.chatdanger.com/messenger/safetyadvice_learn.aspx
23 See http://police.homeoffice.gov.uk/news-and-publications/publication/operational-policing/ho_model.pdf?view=Binary
24 See www.chatdanger.com/email/learn1.aspx
3.2.21 Contacts of some email providers:
• Hotmail: there is an online contact form at http://
support.msn.com/default.aspx?mkt=en-gb.
• Gmail: there is an online contact form at https://
services.google.com/inquiry/gmail_security4.
• Yahoo! Mail: there is a ‘Help’ link available to users
when logged in, which contains a reporting
form. This can also be seen at http://help.yahoo.
com/l/uk/yahoo/mail/yahoomail/abuse/general.
html?from_url=http://help.yahoo.com/l/yahoo/
mail/yahoomail/abuse/abuse-15.html.
Video-hosting sites
3.2.22 It is possible to get content taken down from
video-hosting sites, though the content will need to
be illegal or have broken the terms of service of the
site in other ways. On YouTube, perhaps the most
well-known of such sites, it is possible to report
content to the site provider as inappropriate. In order
to do this, you will need to create an account (this is
free) and log in, and then you will have the option to
‘flag content as inappropriate’. The option to flag the
content is under the video content itself.
3.2.23 YouTube provides information on what is
considered inappropriate in its terms of service, see
www.youtube.com/t/terms section 5C.
Chatrooms, individual website owners / forums,
message board hosts
3.2.24 Most chatrooms should offer the user the
option of blocking or ignoring particular users. Some
services may be moderated, and the moderators will
warn users posting abusive comments or take down
content that breaks their terms of use. It is good
practice for chat providers to have a clear and

prominent reporting mechanism to enable the user
to contact the service provider25. Users that abuse
the service can have their account deleted.
Case study:
One young person was befriended by another player
on a gaming site, who initially wanted to trade game
items and was friendly. When the young person
declined the trade, the other player became nasty and
started threatening and swearing. The young person
took a ‘Print Screen’ copy of the abusive text and
blocked the other player to prevent any further
contact. They also reported the players name and
conduct to the game site administrator.
3.3 INVESTIGATION
Preserve the evidence
3.3.1 Schools should advise pupils and staff to try to
keep a record of the abuse: particularly the date and
time; the content of the message(s); and where
possible a sender’s ID (e.g. username, email, mobile
phone number) or the web address of the profile /
content. Taking an accurate copy or recording of the
whole web-page address, for example, will help the
service provider to locate the relevant content.
3.3.2 Keeping the evidence will help in any
investigation into the cyberbullying by the service
provider, but it can also be useful in showing what
has happened to those who may need to know,
including parents, teachers, pastoral care staff, and
the police.
How to do this
3.3.3 It is always useful to keep a written record,
but it is better to save evidence of bullying on the
device itself:
25 See http://police.homeoffice.gov.uk/news-and-publications/publication/operational-policing/ho_model.pdf?view=Binary
26 See www.chatdanger.com/messenger/safetyadvice_learn.aspx
27 See www.fkbko.co.uk/EN.php?lang=EN&&subject=3&&id=43&&level=2
GUIDANCE 35
Responding to cyberbullying
• On mobiles, ensure the person being bullied
keeps / saves any messages, whether voice,
image or text. Unfortunately forwarding
messages, for example to a staff member’s
phone, will result in information from the original
message, such as the sender’s phone number,
being lost.
• On instant messenger, some services allow the
user to record all conversations. The user could
also copy and paste, save and print these26. When
reporting to the service provider, or even to the
police, copied and pasted conversations are less
useful as evidence, as this can easily be edited.
Conversations recorded / archived by the instant
messaging service are better for evidence here.
Conversations can also be printed out in hard
copy or sections can be saved as a screen grab.
• On social networking sites, video-hosting sites, or
other websites, keep the site link, print page or
produce a screen grab of the page and save it. To
take a copy of what appears on the screen, press
Control and Print Screen, and then paste this into
a word-processing document.
• On chatrooms, print the page or produce a
screen grab of the page. To take a copy of what
appears on the screen, press Control and Print
Screen, and then paste this into a word-
processing document.
• On email, ask the person being bullied to print it;
forward the message on to the staff member
investigating the incident; and encourage them
to continue to forward and save any subsequent
messages. Preserving the whole message, and
not just the text, is more useful, as this will
contain ‘headers’ (information about where the
message has come from)27.
36 Safe to Learn: Embedding anti-bullying work in schools
A note about images:
If images are involved in the cyberbullying, it is
important to ascertain if these might be illegal or raise
child protection concerns. Indecent or sexual images
of children (defined as people under the age of 18)
are illegal to produce, circulate or possess in the UK.
These include images that children have taken of
themselves or their friends, using their mobile phone
for example.
Contact:
• Internet Watch Foundation, if the images are
internet content (see www.iwf.org.uk).
• The local police if illegal images have been taken of
a child and circulated.
Similarly if there is a recording of a crime, e.g. assault
on another child, contact the local police.
If the images are not illegal or of an illegal act, then
steps can be taken to try to contain the incident (see
‘Try to Contain the Incident’ above).
Identifying the bully
3.3.4 Although the technology seemingly allows
anonymity, there are ways to find out information
about where bullying originated. However, it is
important to be aware that this may not necessarily
lead to an identifiable individual. For instance, if
another person’s phone or school network account
has been used, locating where the information was
originally sent from will not, by itself, determine who
the bully is. There have been cases of people using
another individual’s phone or hacking into their IM
or school email account to send nasty messages.
3.3.5 In cases where you do not know the identity of
the bully, some key questions to look at:
• Was the bullying carried out on the school
system? If yes, are there logs in school to see who
it was? Contact the school ICT staff or ICT
support to see if this is possible.
• Are there identifiable witnesses that can be
interviewed? There may be children who have
visited the offending site and left comments,
for example.
• If the bullying was not carried out on the school
system, was it carried out on a mobile or a
particular internet service (e.g. IM or social
networking site)? As discussed, the service
provider, when contacted, may be able to take
some steps to stop the abuse by blocking the
aggressor or removing content it considers
defamatory or breaks their terms of service.
However, the police will need to be involved to
enable them to look into the data of another
user (see below).
• If the bullying was via mobile phone, has the
bully withheld their number? If so, it is important
to record the date and time of the message and
contact the mobile operator. Steps can be taken
to trace the call, but the mobile operator can
only disclose this information to the police, so
police would need to be involved. If the number
is not withheld, it may be possible for the school
to identify the caller. For example, another
student may be able to identify the number or
the school may already keep records of the
mobile phone numbers of their pupils. Content
shared through a local wireless connection on
mobile phones does not pass through the
service providers’ network, and is much harder
to trace (see ‘Brief introduction to technology’
section). Similarly text messages sent from a
website to a phone also provide difficulties for
tracing for the internet service or mobile
operator.
• Has a potential criminal offence been
committed? If so, the police may have a duty to
investigate. Police can issue a RIPA (Regulation of

Investigatory Powers Act 2000) request to a
service provider, enabling them to disclose the
data about a message or the person sending
a message. This may help to identify the bully.
Relevant criminal offences here include
harassment and stalking, threats of harm or
violence to a person or property, any evidence
of sexual exploitation (for example grooming
or inappropriate sexual contact or behaviour).
A new national agency called the Child
Exploitation and Online Protection Centre
(CEOP) was set up in 2006 to deal with child
sexual exploitation, and it is possible to report
directly to them online at www.ceop.gov.uk.
However, it is important to note that it is the
sexual exploitation of children and young
people, not cyberbullying, which forms the
remit of CEOP.
Information about cyberbullying and
civil and criminal laws:
It is very important for schools to take cyberbullying
seriously. It can be a very serious matter and can
constitute a criminal offence. Although bullying or
cyberbullying is not a specific offence in UK law, there
are criminal laws that can apply in terms of
harassment, for example, or threatening behaviour, or
indeed – particularly for cyberbullying – threatening
and menacing communications. See section on civil
and criminal law for more detail.
Investigating allegations against staff
3.3.6 Some messages might allege abuse against a
teacher or other member of staff. Online allegations
should be handled in the same way as other
allegations against staff, following the guidance
in chapter 5 of Safeguarding Children and Safer
Recruitment in Education28. The Department is
currently reviewing its guidance on handling
allegations against staff, and the issue of online
allegations is being considered as part of this review.
28 See http://publications.teachernet.gov.uk/default.aspx?PageFunction=productdetails&PageMode=publications&ProductId=DFES-04217-2006&
GUIDANCE 37
Responding to cyberbullying
3.4 WORKING WITH THE BULLY AND
APPLYING SANCTIONS
3.4.1 Once the person responsible for cyberbullying
has been identified, it is important that – as in other
cases of bullying – sanctions are applied, and the
range of sanctions include all those that are used in
response to other forms of bullying.
3.4.2 Steps should be taken to change the attitude
and behaviour of the bully, as well as ensuring access
to any support that they may need.
3.4.3 When determining the appropriate response
and proportionate sanctions, it is important to
consider the ways in which cyberbullying incidents
might differ in impact to other forms of bullying. The
key considerations here may include attempts by the
bully to disguise their identity; the public nature of
posted material (and the extent of the humiliation);
and the difficulty in controlling copies of the material
(the difficulty in gaining closure over the event).
3.4.4 It should also be recognised, where induction
and education activities are not in place, that some
cyberbullying has been known to be unintentional
or at least carried out with little awareness of the
consequences. Determining appropriate sanctions
for incidents will then require sensitivity to the
impact on the person being bullied as well as any
misunderstanding or thoughtlessness on the part
of the cyberbully.
3.4.5 Consideration should also be given to the
possibility that the cyberbullying could be a part
of retaliation to previous bullying endured by
the perpetrator.
38 Safe to Learn: Embedding anti-bullying work in schools

Sanctions for bullying behaviour Working with the bully

3.4.6 The aim of sanctions is to:
• Help the person harmed to feel safe again and
be assured that the bullying will stop.
• Hold the perpetrator to account, getting them to
recognise the harm caused and deter them from
repeating the behaviour.
3.4.10 It is important to ensure that the bully is
helped to recognise the consequences of their
actions, to help change their attitude, behaviour and
the way they use technology. Effective steps can be
taken here that reflect work done with other bullying
behaviour, including measures like restorative justice.
These are discussed in section 4 of the overarching
Safe to Learn guidance.

• Demonstrate to the school community that

cyberbullying is unacceptable and that the
school has effective ways of dealing with it, so
deterring others from behaving similarly.

3.4.7 In addition to any sanctions that are in existing

anti-bullying / behaviour policies, it is important to
refer to any Acceptable Use Policy or agreement for
internet and mobile use, and apply sanctions for
breaches where applicable and practical.

3.4.8 Technology specific sanctions for pupils

engaged in cyberbullying behaviour could include
limiting internet access for a period of time or
removing the right to bring a mobile phone into
school (although issues of child safety should be
considered in relation to the latter). For an example
of how one school has technology specific sanctions,
see item F in the ‘Resources’ section for a letter sent
out to all the parents of one school outlining the
sanctions that are in place.

3.4.9 For more information on disciplinary sanctions

in general, see the School Discipline and Pupil
Behaviour Policies guidance29.

29 www.teachernet.gov.uk/wholeschool/behaviour/schooldisciplinepupilbehaviourpolicies/
 FURTHER RESOURCES 39

CYBERBULLYING:
Further resources
40 Safe to Learn: Embedding anti-bullying work in schools

A. Key advice to
parents and carers
on cyberbullying

When a child is the target of cyberbullying – bullying Use the tools

via mobile phone or the internet – they can feel
alone and very misunderstood. It is therefore vital
that as a parent or carer you know how to support
your child if they are caught up in cyberbulling. This
short guide will help you.
1) PREVENT CYBERBULLYING
Where to start
The best way to deal with cyberbullying is to prevent
it happening in the first place. Although it may be
uncomfortable to accept, you should be aware that
your child may as likely cyberbully as be a target of
cyberbullying and that sometimes children get
caught up in cyberbullying simply by not thinking
about the consequences of what they are doing. It is
therefore crucial that you talk with your children and
understand the ways in which they are using the
internet and their mobile phone. In this guide there is
an anti-cyberbullying code which contains seven key
messages for children, which you may find a helpful
starting point for a discussion with them about
issues, such as being careful about posting images
on personal websites and where to go to get help.
Most software and services on the internet have in-
built safety features. Knowing how to use them can
prevent unwanted contact. For example, Instant
Messenger services such as MSN Messenger have
features which allow users to block others on their
contact list and conversations can be saved on most
Instant Messenger services. Social networking sites
such as MySpace and Bebo also have tools available
– young people can keep their profile set to ‘private’,
for example, so that only approved friends can see it.
With bullies using text and picture messaging, it is
also important to check with your children’s internet
or mobile phone provider to find out what
protections they can offer, including whether it is
possible to change your mobile number.
 FURTHER RESOURCES 41
A. Key advice to parents and carers on cyberbullying

2) RESPONDING TO CYBERBULLYING • The police: If the cyberbullying is serious and a

It is vital that you have strategies to help your child
if they come to you saying that they are being
cyberbullied.
The anti-cyberbullying code
Start by teaching your children the seven key
messages in the anti-cyberbullying code (see item B).
This includes advice on not replying or retaliating to
cyberbullying, as well as not assisting a cyberbully by
forwarding a message, even as a joke.
potential criminal offence has been committed
you should consider contacting the police.
Relevant criminal offences here include
harassment and stalking, threats of harm or
violence to a person or property, any evidence
of sexual exploitation, for example grooming,
distribution of sexual images or inappropriate
sexual contact or behaviour.
See item D for a list of useful websites and
resources.

Keep the evidence

Keeping the evidence of cyberbullying is helpful
when reporting an incident and may help in
identifying the bully. This means keeping copies
of offending emails, text messages or online
conversations.

Reporting cyberbullying
There are a number of organisations that can help
you if you need to report incidents of cyberbullying:

• The school: If the incident involves a pupil or

pupils at your child’s school, then it is important
to let the school know. All schools have a legal
duty to have measures in place to support the
person being bullied and to apply disciplinary
sanctions to the pupil doing the bullying.
Schools are increasingly updating these policies
to include cyberbullying.

• The provider of the service: Most service

providers have complaints and abuse policies
and it is important to report the incident to the
provider of the service – i.e. the mobile phone
operator (e.g. O2 or Vodafone), the instant
messenger provider (e.g. MSN Messenger or
AOL), or the social network provider (e.g. Bebo or
Piczo). Most responsible service providers will
have a ‘Report Abuse’ or a nuisance call bureau,
and these can provide information and advice
on how to help your child.
42 Safe to Learn: Embedding anti-bullying work in schools
B. Key advice to children
and young people on
cyberbullying
ANTI-CYBERBULLYING CODE
Being sent an abusive or threatening text message,
or seeing nasty comments about yourself on a
website can be really upsetting. This code gives you
seven important tips to protect yourself and your
friends from getting caught up in cyberbullying and
advice on to how to report it when it does happen.
1) Always respect others
Remember that when you send a message to
someone you cannot see the impact that your words
or images may have on the other person. That is why
it is important to always show respect to people and
be careful what you say online or what images you
send. What you think is a joke may really hurt
someone else. Always ask permission before you
take a photo of someone.
If you receive a rude or nasty message or picture
about someone else, do not forward it. You could
be assisting a bully, and even be accused of
cyberbullying yourself. You could also be breaking
the law.
2) Think before you send
It is important to think before you send any images
or text about yourself or someone else by email or
mobile phone, or before you post information on
a website. Remember that what you send can be
made public very quickly and could stay online
forever. Do you really want your teacher or future
employer to see that photo?
3) Treat your password like your toothbrush
Don’t let anyone know your passwords. It is a good
idea to change them on a regular basis. Choosing
hard-to-guess passwords with symbols or numbers
will help stop people hacking into your account and
pretending to be you. Remember to only give your
mobile number or personal website address to
trusted friends.
4) Block the Bully
Most responsible websites and services allow you
to block or report someone who is behaving badly.
Make use of these features, they are there for
a reason!
5) Don’t retaliate or reply!
Replying to bullying messages, particularly in anger,
is just what the bully wants.
 FURTHER RESOURCES 43
B. Key advice to children and young people on cyberbullying

6) Save the evidence

Learn how to keep records of offending messages,
pictures or online conversations. These will help you
demonstrate to others what is happening, and can
be used by your school, internet service provider,
mobile phone company, or even the police, to
investigate the cyberbullying.

7) Make sure you tell

You have a right not to be harassed and bullied
online.

There are people that can help:

• Tell an adult you trust, who can help you to

report it to the right place, or call a helpline like
ChildLine on 0800 1111 in confidence.

• Tell the provider of the service you have been

bullied on (e.g. your mobile phone operator or
social network provider). Check their websites to
see where to report.

• Tell your school. Your teacher or the anti-bullying

co-ordinator at your school can support you and
can discipline the person bullying you.

Finally, don’t just stand there – if you see

cyberbullying going on, support the victim and
report the bullying. How would you feel if no-one
stood up for you?
44 Safe to Learn: Embedding anti-bullying work in schools
C. What children and
young people say
What did children and young people
tell us about their experiences of
cyberbullying?
During the consultation process, carried out while
developing this guidance for schools, Childnet staff
talked to primary- and secondary-aged pupils
from London and Leicester about their views on
cyberbullying. These views are included to give
a young person’s perspective on the issue of
cyberbullying.
Many of the pupils had experienced cyberbullying
personally, or had friends who had been
cyberbullied. The vast majority of the children and
young people used mobile phones and the internet
on a regular basis. Most of them believed that they
understood the technology better than their
teachers and parents, and many reported helping
teachers or parents with mobile phones and
websites.
Reasons given for why young people
might not tell someone they are being
cyberbullied:
• They were scared of making the situation worse,
for themselves or for other people.
• They had been threatened about what would
happen if they did tell anyone.
• They felt ashamed about their own behaviour.
• If it was something rude, they often did not want
to tell their mum – they felt too embarrassed to
have conversations about things like that.
• They were worried it might be their fault and
that they would also get punished, or that they
had done something to deserve it.
• They were worried that grown-ups would not
understand what had happened to them and
that they would not be able to explain it
properly.
• They were worried that grown-ups would be
dismissive of cyberbullying because it ‘was only
words’ and that their feelings would be
dismissed as silly.

• They were scared that the person cyberbullying
them might hurt them physically.
• They didn’t know who to tell.
• They felt “closed up inside”, and didn’t know how
to explain what was happening to them.
• They felt too depressed to be able to do
anything about the cyberbullying.
• The thing they were being cyberbullied about
was true and they didn’t want everyone to know.
• They were being ganged up on by a group and
were too scared to tell anyone.
• They were worried that adults would not believe
them.
What did children and young people say
they would do to help someone they
knew was being cyberbullied?
Positive approaches:
• Some of the young people saw that supporting
and befriending the victim was very important –
making sure that the victim did not feel alone,
talking through what had happened with them
and trying to cheer them up. They identified that
feeling isolated and depressed made positive
action more difficult for the person involved.
• Nearly all the children and young people
recognised that telling someone with more
authority than them would be the best way to
help the victim. They named a range of people,
including the police, teachers, grown-ups they
liked, their parents, and their head teacher.
• In some cases they felt safer contacting expert
groups – they talked about phoning ChildLine,
and also emailing Childnet International.
FURTHER RESOURCES 45
C. What children and young people say
• Many of the children said that they would report
what had happened to the people running the
website or to the phone company.
• Giving advice to the person being cyberbullied
was seen as a useful thing that they could do –
this included telling the person being bullied not
to reply or get involved; to save any messages;
and to take ‘print screen’ images for evidence.
Approaches to be cautious of:
• Some children and young people said that
they would take responsibility for sorting the
problem out themselves directly. This included
talking with the person doing the cyberbullying
and trying to get them to see what they were
doing was wrong.
• Some young people suggested passing the
problem on to older brothers and sisters to
sort out.
Young people need to know that they are not
expected to sort out problems on their own, but that
they will be helped and supported by adults.
Dangerous Approaches:
• Some children and young people said that they
would cyberbully the person back, or beat up the
person doing the cyberbullying.
• Others said that they would do nothing – they
would be too scared of being bullied themselves
to get involved.
46 Safe to Learn: Embedding anti-bullying work in schools

D. Useful websites
and resources

Research • Get Connected – free confidential helpline for

young people (open 1pm-11pm every day).
• Research by Nathalie Noret (York St John) and Tel: 0808 8084994.
Professor Ian Rivers (Queen Margaret's University
Edinburgh), 200730. • Samaritans – helpline for those in distress,
offering multi-channel support.
• Research carried out for the Anti-Bullying Tel: 08457 90 90 90. Email: Jo@samaritans.org.
Alliance (ABA), Cyberbullying: its forms and impact SMS text: 07725 909090.
in secondary school pupils by P. Smith, J. Mahdavi
et al, 200631. Useful websites:

• MSN cyberbullying report, 200632. • Childnet – a range of resources for primary and
secondary schools, for children and young
• UK Children Go Online study by Sonia people, for teachers and for parents
Livingstone and Magdalena Bober (LSE), 200533. (www.childnet-int.org).

Helplines • StopText bully – a website dedicated to mobile

phone bullying, contains advice for young
• Childline – free 24 hour helpline for children and people including how to contact your operator
young people. Tel: 0800 1111. (www.stoptextbully.com).

• Kidscape – run a telephone advice line

exclusively for parents and carers giving advice
about bullying. Tel: 08451 205 204 (10am-4pm
weekdays).

30 See http://www2.yorksj.ac.uk/default.asp?Page_ID=4330

31 See http://www.dfes.gov.uk/research/data/uploadfiles/RBX03-06.pdf

32 See http://www.msn.co.uk/customercare/protect/cyberbullying/default.asp?MSPSA=1

33 See http://www.children-go-online.net

• Cyberbullying.org – one of the first websites
set up in this area, for young people, providing
advice around preventing and taking action
against cyberbullying. A Canadian-based site
(www.cyberbullying.org).
• Chatdanger – a website that informs about the
potential dangers online (including bullying),
and advice on how to stay safe while chatting
(www.chatdanger.com).
• Anti-Bullying Alliance – the Alliance brings
together over 60 organisations into one network
with the aim of reducing bullying. Their website
has a parents section with links to recommended
organisations who can help with bullying issues
(www.anti-bullyingalliance.org.uk).
• Many of the internet service providers, mobile
phone companies and social networking sites
have useful advice and safety tips for users and
parents on their own websites.
• Please see section I of the ‘Resources’ section
in Safe to Learn, the over-arching anti-
bullying guidance, for more organisations
that can help.
Internet safety resources
• For more information on policies around ICT in
schools, including Acceptable Use Policies (AUPs)
for staff and pupils, see www.becta.org.uk/
schools/esafety.
• The Child Exploitation and Online Protection
Centre (CEOP), has produced a set of resources
around internet safety for secondary schools called
Think U Know, see www.thinkuknow.co.uk. CEOP
also provide resources and training in delivering
the Think U Know presentation in schools.
34 see http://www.police.homeoffice.gov.uk/operational-policing/crime-disorder/child-protection-taskforce.
35 see http://police.homeoffice.gov.uk/news-and-publications/publication/operational-policing/ho_model.pdf?view=Binary
36 See http://police.homeoffice.gov.uk/news-and-publications/publication/operational-policing/moderation.pdf?view=Binary
37 See www.imcb.org.uk/assets/documents/10000109Codeofpractice.pdf
FURTHER RESOURCES 47
D. Useful websites and resources
• Childnet International have a range of resources
for primary and secondary schools. The website
also has a sample family agreement which can
be printed out (see www.childnet-int.org/kia/
parents – click on see sample content from
Know IT All for Parents).
Good practice guidance
For the providers of internet services:
• The Home Office are publishing good practice
guidance for social networking providers, drawn
up by social network providers, children’s
charities and others34.
• The Home Office have already published such
guidance for chat, instant messenger and web-
based services providers35. And on moderating
interactive services36. These good practice
guidance documents contain a range of
recommendations for service providers,
including around education of their users;
making reporting an easy and prominent facility
for users; and providing tools for their users (such
as blocking tools).
For UK mobile operators:
• UK code of practice for the self-regulation of new
forms of content on mobiles37. This code outlines
the mobile operators commitment to deal
vigorously with malicious communications.
48 Safe to Learn: Embedding anti-bullying work in schools

E. Case study:
letter inviting parents
to cyberbullying
information event
Dear Parent/Carer,

CYBER BULLYING PARENTS’ INFORMATION EVENING – TUESDAY 6TH MARCH 2007

Cyber Bullying is a form of bullying that is on the increase nationally. It is where a child is tormented,
threatened, harassed, humiliated, embarrassed or targeted by another child using the Internet, mobile phone,
or other type of digital technology. We do not have any specific concerns in relation to our own school, but we
do want to ensure that issues faced by children nationally are addressed.

Both the local education authority and the Cyberspace Research Unit (CRU) at the University of Central
Lancashire have encouraged our school to take a lead in this area, given their view of our strong record on
anti-bullying thus far.

With this in mind, we are holding an intensive full day Cyber Bullying Conference for all of our Year 9 pupils in
school on Wednesday, March 7th. During the four sessions, the students will be given valuable information
about how to deal with this type of bullying as well as being able to participate in workshops covering
various aspects of this unacceptable behaviour.

As Mossley Hollins is pioneering this type of event, representatives of Childline, Childnet, UCLAN, DfES and
Tameside MBC will be joining us on the day to share their expertise. Nationally, it has been noted that much of
this type of bullying occurs in the home via mobile phones and the internet and so it is vital that you, as
parents, are informed and aware of what steps you can take to prevent any such problem. Therefore, we
would like to invite you (no students) to attend an information giving evening on Tuesday, 6th March
in the School Arts Theatre at 6:30pm.
 FURTHER RESOURCES 49
E. Case study: letter inviting parents to cyberbullying information event

We expect that this meeting will last for approximately one hour, but we really feel that it will be an hour well
spent and of great value.

Please make every effort to attend this meeting and we would be grateful if you could complete the attached
reply slip.

Thank you as always for your support.

Head of Upper School/Deputy Head of Year 9

I/we will/will not be attending the Cyber Bullying Information Meeting at 6:30pm on Tuesday 6th March.
Please return by Friday, 2nd March.

Refreshments will be provided.

Signed

Parent/Carer of Form
50 Safe to Learn: Embedding anti-bullying work in schools

F. Case study:
information letter
on sanctions

Kesteven & Sleaford High School

Dear Parents/Guardians

As you may already know, as part of our procedures for monitoring unsafe activity on the internet and by
email, and in order to promote responsible computer use, the school monitors its network using a monitoring
software product. This system allows all student activity on our network to be monitored and inappropriate
use to be identified.

Use of this product has dramatically reduced instances of abuse on our network. However, when
inappropriate use occurs, the school has a framework of sanctions as outlined below:

Internet abuse: 2-4 weeks limited internet access, depending on the severity of the abuse.

Email abuse: 2-4 weeks withdrawal of email privileges, depending on severity.

Network abuse: 2-4 weeks limited access or total withdrawal depending on the severity.

Please note these sanctions have been designed so that they will not impact on the education of our
students. Limited internet access status confines the internet access to a predefined list of websites needed
for their studies. This list is maintained by department heads and is updated on a regular basis.

In serious instances a copy of the incident is sent home with an accompanying letter.

Although these incidents are a rarity, this framework of sanctions, accompanied in each case by an interview
with a member of the pastoral team, provides an opportunity to reinforce a responsible use ethic that will
prepare pupils for ICT use outside the school environment.

The school is happy to answer any questions about this policy, so please feel free to contact us if there is
anything you would like to discuss.
 FURTHER RESOURCES 51
G. Case study: example acceptable use policy

G. Case study:
example acceptable
use policy

Mossley Hollins High School

Information and Communications Technology

Acceptable Use Policy

Pupil Guidelines for Internet Use

General

Pupils are responsible for good behaviour on the internet just as they are in a classroom or a school corridor.
General school rules apply.

The internet, primarily, is provided for pupils to conduct research and backup their work. Parents/carer’s
permission is required before a pupil is granted access. Access is a privilege, not a right and that access
requires responsibility.

Individual users of the internet are responsible for their behaviour and communications over the network.
Users must comply with school standards and honour the agreements they have signed.

Computer storage areas (including any external storage media you bring to school) will be treated like school
lockers. Staff may review files and communications to ensure that users are using the system responsibly.
Users should not expect that files stored on servers or storage media are always private.

During school, teachers will guide pupils towards appropriate materials. Outside of school, families bear
responsibility for such guidance as they must also exercise with information sources such as television,
telephones, movies, radio and other potentially offensive media.
52 Safe to Learn: Embedding anti-bullying work in schools

The following are not permitted within the school environment:

1. Sending or displaying offensive messages or pictures.

2. Using obscene language.

3. Harassing, insulting or attacking others.

4. Damaging computers, computer systems or computer networks.

5. Violating copyright laws.

6. Using others’ passwords or accounts

7. ‘Hacking’ into others’ folders, work or files for any reason.

8. Intentionally wasting limited resources, including printer ink and paper.

Sanctions

1. Violations of the above rules will result in a temporary or permanent ban on internet/computer use.

2. Your parents/carers will be informed.

3. Additional disciplinary action may be added in line with existing practice on inappropriate language or
behaviour.

4. When applicable, police or local authorities may be involved.

5. If necessary, external agencies such as Social Networking or Email Member sites may be contacted and
informed.
 FURTHER RESOURCES 53
G. Case study: example acceptable use policy

Pupils

• You must have your parent’s / carer’s permission before using the internet.

• You must have a supervising teacher or member of staff with you at all times when using the internet.

• Do not disclose any password or login name to anyone, other than the persons responsible for running
and maintaining the system.

• Do not upload/send personal addresses, telephone / fax numbers or photographs of anyone (staff or
pupil) at the school.

• Use of names of pupils, or photographs of students will require parents to have been informed about
such use.

• Do not download, use or upload any material which is copyright. Always seek permission from the owner,
before using any material from the internet. If in doubt, do not use the material.

• Under no circumstances should you view, upload or download any material which is likely to be
unsuitable for children. This applies to any material of a violent dangerous or inappropriate context. If you
are unsure ask the supervisor.

• Always respect the privacy of files of other users.

• Be polite and appreciate that other users might have different views than your own. The use of strong
language, swearing or aggressive behaviour is not allowed. Do not state anything which could be
interpreted as libel.

• Ensure that you have followed the correct procedures for using the internet.

• Report any incident which breaches these rules to the I.T. Network Manager or Co-ordinator of ICT.

I have read and agree to abide by the rules stated in the I.C.T. Acceptable Use Policy. I understand the
consequences if I do not.

Name: Form:

Signed: Date:
You can download this publication or order copies online at
www.teachernet.gov.uk/publications

Search using the ref: DCSF-00658-2007

Copies of this publication can also be obtained from:

DCSF Publications
PO Box 5050
Sherwood Park
Annesley
Nottingham NG15 0DJ
Tel: 0845 60 222 60
Fax: 0845 60 333 60
Textphone: 0845 60 555 60

Please quote ref: 00658-2007DOM-EN

ISBN: 978-1-84775-028-0

PPBEL/D21/0907/53

Crown Copyright 2007

Extracts from this document may be reproduced for

non-commercial research, education or training purposes on
the condition that the source is acknowledged. For any other
use please contact hmsolicensing@opsi.x.gsi.gov.uk

This publication is printed

this publication please recycle it
Appendix 2
 The National Center for Victims of Crime - Library/Document Viewer

Home | Members Only | About the Center | Support Our Work | Store | Contact Us |

Conferences and TrainingsVictim AssistanceProvider SupportCivil LitigationPublic PolicyResource LibraryPress Center

Search
THIS SITE BEST VIEWED IN INTERNET EXPLORER 6.0 (free download ) OR HIGHER.

You are here: Home > Library > Document Viewer

Documents Submit
Printable Version
Resource Centers Back to previous view

Help for Crime Victims Cyberstalking

● Definition
VictimLaw ● Overview
● Cyberstalking and the Law
Conferences and Trainings ● If you are a victim of Cyberstalking
● Potential effects of Cyberstalking
● For more information
Stalking Resource Center ● Resources on the Internet
● References
Parallel Justice ● A U.S. Department of Justice report estimates that there may be tens or even hundreds of thousands of
cyberstalking victims in the United States (Report on Cyberstalking, 1999).
Youth Initiative ● A 1997 nationwide survey conducted by the University of Cincinnati found that almost 25% of stalking
incidents among college age women involved cyberstalking (Report on Cyberstalking, 1999).

DNA Resource Center

Definition
Cyberstalking can be defined as threatening behavior or unwanted advances directed at another using the
Resilience Project Internet and other forms of online and computer communications.

Dating Violence Resource

Center
Overview
Cyberstalking is a relatively new phenomenon. With the decreasing expense and thereby increased availability of
computers and online services, more individuals are purchasing computers and "logging onto" the Internet,
making another form of communication vulnerable to abuse by stalkers.

Cyberstalkers target their victims through chat rooms, message boards, discussion forums, and e-mail.
Cyberstalking takes many forms such as: threatening or obscene e-mail; spamming (in which a stalker sends a
victim a multitude of junk e-mail); live chat harassment or flaming (online verbal abuse); leaving improper
messages on message boards or in guest books; sending electronic viruses; sending unsolicited e-mail; tracing
another person's computer and Internet activity, and electronic identity theft.

Similar to stalking off-line, online stalking can be a terrifying experience for victims, placing them at risk of
psychological trauma, and possible physical harm. Many cyberstalking situations do evolve into off-line stalking,
and a victim may experience abusive and excessive phone calls, vandalism, threatening or obscene mail,
trespassing, and physical assault.

Cyberstalking and the Law

With personal information becoming readily available to an increasing number of people through the Internet
and other advanced technology, state legislators are addressing the problem of stalkers who harass and threaten
their victims over the World Wide Web. Stalking laws and other statutes criminalizing harassment behavior
currently in effect in many states may already address this issue by making it a crime to communicate by any
means with the intent to harass or alarm the victim.

States have begun to address the use of computer equipment for stalking purposes by including provisions
prohibiting such activity in both harassment and anti-stalking legislation (Riveira, 1,2). A handful of states, such
as Alabama, Arizona, Connecticut, Hawaii, Illinois, New Hampshire and New York have specifically including
prohibitions against harassing electronic, computer or e-mail communications in their harassment legislation.
Alaska, Oklahoma, Wyoming, and more recently, California, have incorporated electronically communicated
statements as conduct constituting stalking in their anti-stalking laws. A few states have both stalking and

http://www.ncvc.org/ncvc/main.aspx?dbName=DocumentViewer&DocumentID=32458 (1 of 3) [8/3/2010 8:46:42 μμ]

The National Center for Victims of Crime - Library/Document Viewer

harassment statutes that criminalize threatening and unwanted electronic communications. Other states have
laws other than harassment or anti-stalking statutes that prohibit misuse of computer communications and e-
mail, while others have passed laws containing broad language that can be interpreted to include cyberstalking
behaviors (Gregorie).

> Recent federal law has addressed cyberstalking as well. The Violence Against Women Act, passed in 2000,
made cyberstalking a part of the federal interstate stalking statute. Other federal legislation that addresses
cyberstalking has been introduced recently, but no such measures have yet been enacted. Consequently, there
remains a lack of legislation at the federal level to specifically address cyberstalking, leaving the majority of
legislative prohibitions against cyberstalking at the state level (Wiredpatrol.org).

If you are a Victim of Cyberstalking

● Victims who are under the age of 18 should tell their parents or another adult they trust about any
harassments and/or threats.
● Experts suggest that in cases where the offender is known, victims should send the stalker a clear written
warning. Specifically, victims should communicate that the contact is unwanted, and ask the perpetrator to
cease sending communications of any kind. Victims should do this only once. Then, no matter the response,
victims should under no circumstances ever communicate with the stalker again. Victims should save copies
of this communication in both electronic and hard copy form.
● If the harassment continues, the victim may wish to file a complaint with the stalker's Internet service
provider, as well as with their own service provider. Many Internet service providers offer tools that filter or
block communications from specific individuals.
● As soon as individuals suspect they are victims of online harassment or cyberstalking, they should start
collecting all evidence and document all contact made by the stalker. Save all e-mail, postings, or other
communications in both electronic and hard-copy form. If possible, save all of the header information from
e-mails and newsgroup postings. Record the dates and times of any contact with the stalker.
● Victims may also want to start a log of each communication explaining the situation in more detail. Victims
may want to document how the harassment is affecting their lives and what steps they have taken to stop
the harassment.
● Victims may want to file a report with local law enforcement or contact their local prosecutor's office to see
what charges, if any, can be pursued. Victims should save copies of police reports and record all contact
with law enforcement officials and the prosecutor's office.
● Victims who are being continually harassed may want to consider changing their e-mail address, Internet
service provider, a home phone number, and should examine the possibility of using encryption software or
privacy protection programs. Any local computer store can offer a variety of protective software, options
and suggestions. Victims may also want to learn how to use the filtering capabilities of email programs to
block e-mails from certain addresses.
● Furthermore, victims should contact online directory listings such as www.four11.com, www.switchboard.
com, and www.whowhere.com to request removal from their directory.
● Finally, under no circumstances should victims agree to meet with the perpetrator face to face to "work it
out," or "talk." No contact should ever be made with the stalker. Meeting a stalker in person can be very
dangerous.

Potential Effects of Cyberstalking

Just because cyberstalking does not include physical contact with the perpetrator does not mean it is not as
threatening or frightening as any other type of crime. Victims of cyberstalking often experience psychological
trauma, as well as physical and emotional reactions as a result of their victimization. Some of these effects may
include:

● changes in sleeping and eating patterns

● nightmares
● hypervigilance
● anxiety
● helplessness
● fear for safety
● shock and disbelief

Victims experiencing these reactions and many others might consider seeking out support from friends, family
and victim service professionals in order to cope with the trauma resulting from cyberstalking. In order to locate
local victim service professionals that may be able to offer assistance, safety suggestions, and information and
referrals, please contact the Helpline of the National Center for Victims of Crime at 1-800-FYI-CALL, 8:30 a.m.
to 8:30 p.m., Monday through Friday, Eastern Standard Time.

Read more about cyberstalking via the Stalking Resource Center.

For more information, please contact:

The Privacy Rights Clearinghouse

3100 5th Avenue., Suite B
San Diego, CA 92103

http://www.ncvc.org/ncvc/main.aspx?dbName=DocumentViewer&DocumentID=32458 (2 of 3) [8/3/2010 8:46:42 μμ]

The National Center for Victims of Crime - Library/Document Viewer

(619) 298-3396

Resources on the World Wide Web:

● National Center for Victims of Crime Stalking Resource Center
● National Network to End Domestic Violence (NNEDV)
● Working to Halt Online Abuse (WHOA) - whoa@haltabuse.org
● CyberAngels
● Safety Ed International
● Electronic Privacy Information Center (EPIC)
● Online Privacy Alliance
● Network Solutions WHOIS - Helps determine contents of domain name registration

Your local prosecutor's office, law enforcement, or state Attorney General's office. Check in the Blue Pages of
your local phone book under the appropriate section heading of either "Local Government," "County
Government," or "State Government."

References
● U.S. Department of Justice. (August 1999). Cyberstalking: A New Challenge for Law Enforcement
and Industry -- A Report from the Attorney General to the Vice President. Washington, DC: U.S.
Department of Justice, pp. 2, 6.
● Gregorie, Trudy. Cyberstalking: Dangers on the Information Superhighway. The Stalking Resource
Center, The National Center for Victims of Crime. Online.
● Riveira, Diane. (September/October 2000). "Internet Crimes Against Women," Sexual Assault
Report, 4 (1).
● Wired Patrol. "US Federal Laws- Cyberstalking." Accessed 15 April 2003. http://www.wiredpatrol.
org/stalking/federal.html

All rights reserved.

Copyright © 2003 by the National Center for Victims of Crime. This information may be freely distributed,
provided that it is distributed free of charge, in its entirety and includes this copyright notice.

Submit Query

2010 © National Center for Victims of Crime. All Rights Reserved. Privacy statement. Legal disclaimer. Terms of Service. Accessibility issues.
Contacts: 2000 M Street NW, Suite 480, Washington, D.C. 20036 phone: 202-467-8700 fax: 202-467-8701, email: webmaster@ncvc.org.
Site operated by Alfa XP Web Software Company, LLC .
Home | About the Center | Victim Assistance | Provider Support | Civil Litigation | Resource Library
Members Only | Support our Work | Press Center | Store | Jobs | Volunteer/Intern | Contact Us

Technical Problem? Please e-mail our webmaster.

This site best viewed in Microsoft Internet Explorer 6.0 or higher.

Login >>

http://www.ncvc.org/ncvc/main.aspx?dbName=DocumentViewer&DocumentID=32458 (3 of 3) [8/3/2010 8:46:42 μμ]

Appendix 3
 September 2009

Electronic Records Management:

Blogs, Wikis, Facebook, Twitter & Managing Public Records
The purpose of this advice is to provide guidance to state and local government agencies
regarding the retention of public records of posts to social networking websites such as
blogs, wikis, Facebook, Twitter, etc.

Agencies need to consider the following five (5) factors when managing the retention of their
public records created or received through social networking sites:

1. Are the posts public records?

If the posts are made or received in connection with the transaction of the agency’s public
business (such as providing advice or receiving comments about the agency, its programs, core
business, etc.), then they are public records for the purposes of records retention and need to be
retained for their minimum retention periods.

2. Are the posts primary or secondary copies?

If the posts are simply copies of records that the agency is already retaining for the minimum
retention period (such as links to publications), then the posts may be considered secondary
copies and retained accordingly. Otherwise, the posts are the agency’s primary record.

3. How long do the posts need to be retained?

Agencies should use the same records series for posts that they would use if the same advice
was distributed as a letter or an email to everyone within the agency’s jurisdiction. Agencies
need to retain their primary record of posts which are public records for at least the minimum
retention period listed for those records in the approved records retention schedules.

4. How will the posts be retained by the agency?

Agencies need to consider how they will retain a record in their custody and control of their posts
to social networking websites. When retention of the posts themselves is outside the agency’s
control, the agency needs to consider what other records they will retain, such as email
confirmations of each post or comment. Agencies need to consider these issues in any service
contracts with vendors of social networking websites and in their configuration settings for their
social networking website accounts.

5. For which types of records is this technology appropriate?

Agencies need to determine the business activities for which social networking technology is
appropriate if the agency is unable to manage the creation, receipt and retention of public
records documenting the public business they transact using social networking websites.

Additional advice regarding the management of public records is available from

Washington State Archives:

www.secstate.wa.gov/archives
recordsmanagement@secstate.wa.gov
Appendix 4
 A3757 Assembly Floor Statement MARCH 16, 2009

STATEMENT TO

ASSEMBLY, No. 3757

with Assembly Floor Amendments
(Proposed by Assemblyman ALBANO)

ADOPTED: MARCH 16, 2009

This bill enacts the “Social Networking Safety Act,” which provides civil penalties against
individuals who transmit sexually offensive communication through a social networking website.
The amendments change the definition of “sexually offensive communication” to include any
communication which a reasonable person would believe is intended to solicit or request a person
to engage in sexual activity, and any communication depicting or describing nudity, sexual
conduct or sexual excitement when it: (1) predominantly appeals to a prurient interest in sex; (2)
is patently offensive to prevailing standards in the adult community as a whole with respect to
what is suitable material or conduct for minors; and (3) taken as a whole, is without serious
literary, artistic, political or scientific value for minors. This definition eliminates the cross
reference to obscene material as defined in N.J.S.2C:34-3 when discussing the type of
communication.
These floor amendments clarify that this prohibition applies to a person transmitting a
sexually offensive communication through a social networking website to a person located in
New Jersey who the actor knows or should know is less than 13 years of age or is at least 13 but
less than 16 years old and at least four years younger than the actor.
The amendments also provide that the prohibition against transmitting sexually offensive
communication through a social networking website does not apply to any provider or user of an
interactive computer service with respect to information provided by another information content
provider. The amendments define “interactive computer service” as any information service,
system, or access software provider that provides or enables computer access by multiple users to
a computer server, including specifically a service or system that provides access to the Internet
and such systems operated or services offered by libraries or educational institutions. The
amendments define: (1) “information content provider” as any person or entity that is responsible,
in whole or in part, for the creation or development of information provided through the Internet
or any other interactive computer service; and (2) “Internet” as the international computer
network of both federal and non-federal interoperable packet switched data networks.
In addition to prohibiting sexually offensive communication, this bill as originally introduced
also prohibited the transmittal of any “abusive communication” through a social networking
website. The floor amendments eliminate the prohibition against “abusive communication” and

http://www.njleg.state.nj.us/2008/Bills/A4000/3757_S2.HTM (1 of 2) [8/3/2010 8:50:30 μμ]

 A3757 Assembly Floor Statement MARCH 16, 2009

replace it with a prohibition against transmitting “harassing communication” through a social

networking website. The amendments define “harassing communication” as any communication
which is directed at a specific person, serves no legitimate purpose and which a reasonable person
would believe is intended to threaten, intimate or harass another person. The amendments also
eliminate the provision that the transmittal of the harassing communication be to a person who
is, or who the actor reasonably believes is, less than 18 years of age.
The floor amendments also change the definition of “social networking website” to eliminate
the requirement that the website be accessible to third parties and on which users under the age of
18 may post personal information. The new definition provides that it includes any website
located on the Internet on which users located in New Jersey may create a searchable profile,
page or similar account that is accessible to other users or visitors to the website and share
personal information with other users or visitors and through which users or visitors may
communicate directly with such users.
In addition to providing civil penalties to for the transmittal of sexually offensive
communication through a social networking website and prohibiting the transmittal of harassing
communication, this bill makes it a violation of the Consumer Fraud Act, N.J.S.A.56:8-1 et seq.,
for a social networking website operator to fail to revoke the website access of any user or third
party upon receipt of information that the user or third party has transmitted offensive
communications. The floor amendments eliminate the term “third party” and replace it with
“visitor.” “Visitor” is defined as a person other than the user or the operator, or an employee of
the operator who accesses a social networking website. The amendments clarify that a “user” is a
person located in this State who establishes on a social networking website a profile, page or
similar account that is accessible to other users or visitors to the website and on which the user
may share personal information with other users and visitors.
The amendments would also provide that nothing in the act be construed to permit a civil
action against an interactive computer service that is inconsistent with the provisions of 47 U.S.C.
§230 (c). This section of the federal law provides immunity from liability to any provider or user
of an interactive computer service for any voluntary action taken in good faith to restrict access to
or availability of material which the provider or user considers obscene.

http://www.njleg.state.nj.us/2008/Bills/A4000/3757_S2.HTM (2 of 2) [8/3/2010 8:50:30 μμ]

Appendix 5
ARTICLE 29 DATA PROTECTION WORKING PARTY

01189/09/EN
WP 163

Opinion 5/2009 on online social networking

Adopted on 12 June 2009

This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data
protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC.

The secretariat is provided by Directorate D (Fundamental Rights and Citizenship) of the European Commission, Directorate
General Justice, Freedom and Security, B-1049 Brussels, Belgium, Office No LX-46 01/02.

Website: http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm
 Table of contents
Executive Summary ............................................................................................................... 3
1. Introduction ................................................................................................................ 4
2. Definition of a "social network service (SNS)" and business model ......................... 4
3. Application of the Data Protection Directive............................................................. 5
3.1 Who is the data controller?..................................................................................... 5
3.2 Security and default privacy settings ..................................................................... 7
3.3 Information to be provided by SNS ....................................................................... 7
3.4 Sensitive Data......................................................................................................... 8
3.5 Processing data of non-members............................................................................ 8
3.6 Third party access................................................................................................... 8
3.7 Legal grounds for direct marketing........................................................................ 9
3.8 Retention of data .................................................................................................. 10
3.9 Rights of the users ................................................................................................ 11
4. Children and minors ................................................................................................. 11
5. Summary of obligations/rights ................................................................................. 12

- 2-
Executive Summary

This Opinion focuses on how the operation of social networking sites can meet the
requirements of EU data protection legislation. It principally is intended to provide guidance
to SNS providers on the measures that need to be in place to ensure compliance with EU law.
The Opinion notes that SNS providers and, in many cases, third party application providers,
are data controllers with corresponding responsibilities towards SNS users. The Opinion
outlines how many users operate within a purely personal sphere, contacting people as part of
the management of their personal, family or household affairs. In such cases, the Opinion
deems that the ‘household exemption’ applies and the regulations governing data controllers
do not apply. The Opinion also specifies circumstances whereby the activities of a user of an
SNS are not covered by the ‘household exemption’. The dissemination and use of information
available on SNS for other secondary, unintended purposes is of key concern to the Article 29
Working Party. Robust security and privacy-friendly default settings are advocated
throughout the Opinion as the ideal starting point with regard to all services on offer. Access
to profile information emerges as a key area of concern. Topics such as the processing of
sensitive data and images, advertising and direct marketing on SNS and data retention issues
are also addressed.
Key recommendations focus on the obligations of SNS providers to conform with the Data
Protection Directive and to uphold and strengthen the rights of users. Of paramount
importance, SNS providers should inform users of their identity from the outset and outline
all the different purposes for which they process personal data. Particular care should be taken
by SNS providers with regard to the processing of the personal data of minors. The Opinion
recommends that users should only upload pictures or information about other individuals,
with the individual’s consent and considers that SNS also have a duty to advise users
regarding the privacy rights of others.

- 3-
THE WORKING PARTY ON THE PROTECTION OF INDIVIDUALS WITH
REGARD TO THE PROCESSING OF PERSONAL DATA
set up by Directive 95/46/EC of the European Parliament and of the Council of 24 October
19951,
having regard to Articles 29 and 30 paragraphs 1 (a) and 3 of that Directive, and Article 15
paragraph 3 of Directive 2002/58/EC of the European Parliament and of the Council of 12
July 2002
having regard to Article 255 of the EC Treaty and to Regulation (EC) no 1049/2001 of the
European Parliament and of the Council of 30 May 2001 regarding public access to European
Parliament, Council and Commission documents
having regard to its Rules of Procedure
HAS ADOPTED THE PRESENT DOCUMENT:

1. Introduction
The evolution of web communities and hosted services such as social network services
("SNS") is a relatively recent phenomenon, with the number of users of these sites continuing
to multiply at an exponential rate.
The personal information a user posts online, combined with data outlining the users actions
and interactions with other people, can create a rich profile of that person's interests and
activities. Personal data published on social network sites can be used by third parties for a
wide variety of purposes, including commercial purposes, and may pose major risks such as
identity theft, financial loss, loss of business or employment opportunities and physical harm.
The Berlin International Working Group on Data Protection in Telecommunications adopted
the Rome Memorandum2 in March 2008. The Memorandum analyses the risks for privacy and
security posed by social networks and provides guidelines for regulators, providers and users.
The recently adopted Resolution on Privacy Protection in Social Network Services3 also
addresses challenges brought about by the SNS. The Working Party also takes into account
the position paper published by the European Network and Information Security Agency
(ENISA) “Security Issues and Recommendations for Online Social Networks,”4 in October
2007 aimed at regulators and providers of social networks.

2. Definition of a "social network service (SNS)" and business model

SNS can broadly be defined as online communication platforms which enable individuals to
join or create networks of like-minded users. In the legal sense, social networks are
information society services, as defined in Article 1 paragraph 2 of Directive 98/34/EC as
amended by Directive 98/48/EC. SNS share certain characteristics:

1
Official Journal no. L281 of 23/11/1995, p. 31,
http://europa.eu.int/comm/internal_market/en/media/dataprot/index.htm
2
http://www.datenschutz-berlin.de/attachments/461/WP_social_network_services.pdf
3
Adopted at the 30th International Conference of Data Protection and Privacy Commissioners in Strasbourg, 17;10.2008,
http://www.privacyconference2008.org/adopted_resolutions/STRASBOURG2008/resolution_social_networks_en.pdf
4
http://www.enisa.europa.eu/doc/pdf/deliverables/enisa_pp_social_networks.pdf
- 4-
- users are invited to provide personal data for the purpose of generating a description of
themselves or ‘profile’.
- SNS also provide tools which allow users to post their own material (user-generated
content such as a photograph or a diary entry, music or video clip or links to other sites5);
- ‘social networking’ is enabled using tools which provide a list of contacts for each user,
and with which users can interact.
SNS generate much of their revenue through advertising which is served alongside the web
pages set up and accessed by users. Users who post large amounts of information about their
interests on their profiles offer a refined market to advertisers wishing to serve targeted
advertisements based on that information.
It is therefore important that SNS operate in a way which respects the rights and freedoms of
users who have a legitimate expectation that the personal data they disclose will be processed
according to European and national data protection and privacy legislation.

3. Application of the Data Protection Directive

The provisions of the Data Protection Directive apply to SNS providers in most cases, even if
their headquarters are located outside of the EEA. The Article 29 Working Party refers to its
earlier opinion on search engines for further guidance on the issues of establishment and use
of equipment as determinants for the applicability of the Data Protection Directive and the
rules subsequently triggered by the processing of IP addresses and the use of cookies.6

3.1 Who is the data controller?

SNS providers
SNS providers are data controllers under the Data Protection Directive. They provide the
means for the processing of user data and provide all the “basic” services related to user
management (e.g. registration and deletion of accounts). SNS providers also determine the
use that may be made of user data for advertising and marketing purposes - including
advertising provided by third parties.
Application providers
Application providers may also be data controllers, if they develop applications which run in
addition to the ones from the SNS and users decide to use such an application.
Users
In most cases, users are considered to be data subjects. The Directive does not impose the
duties of a data controller on an individual who processes personal data "in the course of a
purely personal or household activity" - the so-called "household exemption". In some
instances, the activities of a user of an SNS may not be covered by the household exemption
and the user might be considered to have taken on some of the responsibilities of a data
controller. Some of these instances are developed below:

5
In these cases where SNS provide electronic communications services, provisions of ePrivacy Directive
2002/58 will also apply.
6
WP148, “Opinion 1/2008 on data protection issues related to search engines”.
- 5-
3.1.1. Purpose and nature
A growing trend of SNS is the "shift from "Web 2.0 for fun" to Web 2.0 for productivity and
services"7 where the activities of some SNS users may extend beyond a purely personal or
household activity, for example when the SNS is used as a collaboration platform for an
association or a company. If an SNS user acts on behalf of a company or association, or uses
the SNS mainly as a platform to advance commercial, political or charitable goals, the
exception does not apply. Here, the user assumes the full responsibilities of a data controller
who is disclosing personal data to another data controller (SNS) and to third parties (other
SNS users or potentially even other data controllers with access to the data). In these
circumstances, the user needs the consent of the persons concerned or some other legitimate
basis provided in the Data Protection Directive.
Typically, access to data (profile data, postings, stories…) contributed by a user is limited to
self-selected contacts. In some cases however, users may acquire a high number of third party
contacts, some of whom he may not actually know. A high number of contacts could be an
indication that the household exception does not apply and therefore that the user would be
considered a data controller.
3.1.2. Access to profile information
SNS should ensure privacy-friendly and free of charge default settings are in place restricting
access to self-selected contacts.
When access to profile information extends beyond self-selected contacts, such as when
access to a profile is provided to all members within the SNS8 or the data is indexable by
search engines, access goes beyond the personal or household sphere. Equally, if a user takes
an informed decision to extend access beyond self-selected ‘friends’ data controller
responsibilities come into force. Effectively, the same legal regime will then apply as when
any person uses other technology platforms to publish personal data on the web9. In several
Member States, the lack of access restrictions (thus the public character) means the Data
Protection Directive applies in terms of the internet user acquiring data controller
responsibilities10.
It should be kept in mind that, even if the household exemption does not apply, the SNS user
may benefit from other exemptions such as the exemption for journalistic purposes, artistic or
literary expression. In those cases, a balance needs to be struck between freedom of
expression and the right to privacy.
3.1.3 Processing of third party data by users
The application of the household exemption is also constrained by the need to guarantee the
rights of third parties, particularly with regard to sensitive data. In addition, it must be noted
that even if the household exemption applies, a user might be liable according to general

7
"Internet of the future: Europe must be a key player" speech from Ms Reding, European Commissioner for Information
Society and Media during the meeting Future of the Internet initiative of the Lisbon Council, Brussels, 2 February 2009
8
or when it can be argued that no actual selection is being made in accepting contacts, i.e the users accepts “contacts”
regardless of the connection they have
9
Such as with publishing platforms that are not SNS, or with self-hosted software.
10
In its Satamedia judgment the ECJ rules inversely in paragraph 44: "It follows that the latter exception must be
interpreted as relating only to activities which are carried out in the course of private or family life of individuals (see
Lindqvist, paragraph 47). That clearly does not apply to the activities of Markkinapörssi and Satamedia, the purpose of
which is to make the data collected accessible to an unrestricted number of people."
- 6-
provisions of national civil or criminal laws in question (e.g. defamation, liability in tort for
violation of personality, penal liability).

3.2 Security and default privacy settings

Secure processing of information is a key element of trust in SNS. Controllers must take the
appropriate technical and organisational measures, ‘both at the time of the design of the
processing system and at the time of the processing itself’ to maintain security and prevent
unauthorised processing, taking into account the risks represented by the processing and the
nature of the data11.
An important element of the privacy settings is the access to personal data published in a
profile. If there are no restrictions to such access, third parties may link all kinds of intimate
details regarding the users, either as a member of the SNS or via search engines. However,
only a minority of users signing up to a service will make any changes to default settings.
Therefore, SNS should offer privacy-friendly default settings which allow users to freely and
specifically consent to any access to their profile's content that is beyond their self-selected
contacts in order to reduce the risk of unlawful processing by third parties. Restricted access
profiles should not be discoverable by internal search engines, including the facility to search
by parameters such as age or location. Decisions to extend access may not be implicit12, for
example with an "opt-out" provided by the controller of the SNS.

3.3 Information to be provided by SNS

SNS providers should inform users of their identity and the different purposes for which they
process personal data according to the provisions laid out in Article 10 of the Data Protection
Directive including, but not limited to:
- usage of the data for direct marketing purposes;
- possible sharing of the data with specified categories of third parties;
- an overview on profiles: their creation and chief data sources;
- the use of sensitive data.
The Working Party recommends that:
- SNS providers provide adequate warnings to users about the privacy risks to
themselves and to others when they upload information on the SNS;
- SNS users should also be reminded that uploading information about other individuals
may impinge upon their privacy and data protection rights;
- SNS users should be advised by SNS that if they wish to upload pictures or
information about other individuals, this should be done with the individual’s
consent13.

11
Article 17 and Recital 46 of the Data Protection Directive.
12
The Report and Guidance on Privacy in Social Network Services (”Rome Memorandum”) indicates risks such as “The
misleading notion of community”, p2, “Giving away more personal information than you think you do”, p3. A computer
security company warns an important SNS about default access to members within the same geographical location :
http://www.sophos.com/pressoffice/news/articles/2007/10/facebook-network.html
13
This could be made easier by introducing tagging management tools within social network websites, e.g. by
making available areas in a personal profile to indicate the presence of a user’s name in tagged images or
- 7-
3.4 Sensitive Data
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs,
trade-union membership or data concerning health or sex life is considered sensitive.
Sensitive personal data may only be published on the Internet with the explicit consent from
the data subject or if the data subject has made the data manifestly public himself.14
In some EU Member States, images of data subjects are considered a special category of
personal data since they may be used to distinguish between racial/ethnic origins or may be
used to deduce religious beliefs or health data. The Working Party in general does not
consider images on the Internet to be sensitive data15, unless the images are clearly used to
reveal sensitive data about individuals.
As data controllers, SNS may not process any sensitive data about SNS members or non-
members without their explicit consent16. If an SNS includes in the profile form of users any
questions relating to sensitive data, the SNS must make it very clear that answering such
questions is completely voluntary.

3.5 Processing data of non-members

Many SNS allow users to contribute data about other people, such as adding a name to a
picture, rating a person, listing the “people I have met/want to meet” at events. This tagging
may also identify non-members. However, the processing of such data about non-members by
the SNS may only be performed if one of the criteria laid down in Article 7 of the Data
Protection Directive is fulfilled.
In addition, the creation of pre-built profiles of non-members through the aggregation of data
that is independently contributed by SNS users, including relationship data inferred from
uploaded address books, lacks a legal basis.17
Even if the SNS had the means to contact the non-user and inform this non-user about the
existence of personal data relating to him/her, a possible e-mail invitation to join the SNS in
order to access these personal data would violate the prohibition laid down in Article 13.4 of
the ePrivacy Directive on the sending of unsolicited electronic messages for direct marketing
purposes.

3.6 Third party access

3.6.1 SNS-mediated access
In addition to the core SNS service, most SNS offer users additional applications provided by
third party developers which also process personal data.
SNS should have the means to ensure that third party applications comply with the Data
Protection and ePrivacy Directives. This implies, in particular, that they provide clear and

videos waiting for consent, or setting expiration times for tags that have not received consent by the tagged
individual.
14
Member States may lay down exemptions from this rule; see Article 8.2 (a) second sentence and Article 8 4 of the Data
Protection Directive.
15
The publication of images on the Internet does however raise increasing privacy concerns as facial recognition
technologies improve.
16
consent has to be free, informed and specific
17
Recital 38 of the Data Protection Directive specifies: “Whereas, if the processing of data is to be fair, the data subject
must be in a position to learn of the existence of a processing operation and, where data are collected from him, must be
given accurate and full information, bearing in mind the circumstances of the collection.” For some SNS, the
publication of profiles of non-members allegedly has become an important way of marketing their “services”.
- 8-
specific information to users about the processing of their personal data and that they only
have access to necessary personal data. Therefore, layered access should be offered to third
party developers by the SNS so they can opt for a mode of access that is intrinsically more
limited. SNS should ensure furthermore that users may easily report concerns about
applications.
3.6.2 User-mediated third party access
SNS sometimes allow users to access and update their data with other applications. For
example users might be able to:
- read and post messages to the network from their mobile phone;
- synchronize the contact data of their friends in the SNS with their address book on a
desktop computer;
- update their status or location in the SNS automatically by using another website.
SNS publish the way this software can be written in the form of an “Application
Programming Interface” (“API”). This enables any third party to write software to perform
these tasks, and allow users to freely choose between several third party providers18. When
offering an API that enables access to contacts' data, SNS should:
- provide for a level of granularity that lets the user choose an access level for the third
party that is only just sufficient to perform a certain task.
When accessing personal data via third party’s API on behalf of a user, third party services
should:
- process and store data no longer than necessary to perform a specific task;
- perform no operations on imported user contacts' data other than personal usage by the
contributing user.

3.7 Legal grounds for direct marketing

Direct marketing is an essential part of the SNS business model; different marketing models
can be used by SNS. Nevertheless, marketing using users’ personal data should comply with
relevant provisions of both Data Protection and ePrivacy Directive19.
Contextual marketing is tailored to the content that is viewed or accessed by the user20.

Segmented marketing consists in serving advertisements to targeted groups of users21; a user

is placed in a group according to the information he has directly communicated to the SNS22.

Finally, behavioural marketing selects the advertisements based on the observation and
analysis of the users’ activity over time. These techniques may be subject to different legal
requirements, depending on the applicable legal grounds and the characteristics of the

18
While “API” is a broad technical term, here API refers to access on behalf of a user, i.e. users need to give their login
credentials to the software, so that it can act on their behalf.
19
The Working Party intends to address the different aspects of online advertising in a separate document in the near
future.
20
e.g. if the page which is displayed mentions the word “Paris”, the advertisement could concern a restaurant in this city
21
each group being defined by a set of criteria
22
e.g. when he registered with the service
- 9-
techniques used. The Working Party recommends not using sensitive data in behavioural
advertising models, unless all legal requirements are met.
Whatever model or combination of models is used, advertisements can either be served
directly by the SNS (the SNS provider acts here as a broker) or by a third party advertiser. In
the first case, personal data of the users do not need to be disclosed to third parties. In the
second case however, the third party advertiser might process personal data about the users
e.g. if it processes the IP address of the user and a cookie that was placed on the user’s
computer.

3.8 Retention of data

SNS fall outside the scope of the definition of electronic communication services provided in
Article 2 letter c) of the Framework Directive (2002/21/EC). SNS providers may offer
additional services that fall under the scope of an electronic communications service such as a
publicly accessible email service. Such a service will be subject to the provisions of the e-
Privacy Directive and the Data Retention Directive.
Some SNS allow their users to send invitations to third parties. The prohibition on the use of
electronic mail for the purposes of direct marketing does not apply to personal
communications. In order to comply with the exception for personal communications, an SNS
must comply with the following criteria:
- no incentive is given to either sender or recipient;
- the provider does not select the recipients of the message;23
- the identity of the sending user must be clearly mentioned;
- the sending user must know the full content of the message that will be sent on his
behalf.
Some SNS also retain identification data of users who were banned from the service, to
ensure that they cannot register again. In that case, these users must be informed that such
processing is taking place. In addition, the only information that may be retained is
identification information, and not the reasons why these persons were banned. This
information should not be retained for more than one year.
Personal data communicated by a user when he registers to a SNS should be deleted as soon
as either the user or the SNS provider decides to delete the account24. Similarly, information
deleted by a user when updating his account should not be retained. SNS should notify users
before taking these steps with the means they have at their disposal to inform users about
these retention periods. For security and legal reasons, in specific cases, it could be justifiable
to store updated or deleted data and accounts for a defined period of time in order to help
prevent malicious operations resulting from identity theft and other offences or crimes.
When a user does not use the service for a defined period of time, the profile should be set to
inactive, i.e. no longer visible to other users or the outside world, and after another period of
time the data in the abandoned account should be deleted. SNS should notify users before
taking these steps with whatever means they have at their disposal.

23
i.e. the practice by some SNSs to send invitations indiscriminately to the entire address book of a user is not allowed
24
According to Article 6 para 1e) of the Data Protection Directive, data must be “kept in a form which permits
identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for
which they are further processed.”
-10-
3.9 Rights of the users
SNS should respect the rights of the individuals concerned by the processing according to the
provisions laid out in Articles 12 and 14 of the Data Protection Directive.
Access and rectification rights of users are not limited to the users of the service but to any
natural person whose data are processed25. Members and non-members of SNS must have a
means to exercise their right of access, correction and deletion. The homepage of SNS sites
should clearly refer to the existence of a “complaint handling office” set up by the SNS
provider to deal with data protection and privacy issues and complaints by both members and
non-members.
Article 6 para 1 letter c) of the Data Protection Directive requires the data to be “adequate,
relevant and not excessive in relation to the purposes for which they are collected and/or
further processed". In this context, it can be observed that SNS may need to register some
identifying data about members but does not need to publish the real name of members on the
Internet. Therefore, SNS should consider carefully if they can justify forcing their users to act
under their real identity rather than under a pseudonym. There are strong arguments in favor
of giving users choice in this respect and in at least one Member State, this is a legal
requirement. The arguments are particularly strong in the case of SNS with wide membership.
Article 17 of the Data Protection Directive requires that the controller implements appropriate
technical and organizational security measures to protect personal data. In particular, such
security measures include access control and authentication mechanisms which can still be
implemented if pseudonyms are used.

4. Children and minors

A large proportion of SNS services are utilised by children/minors. The Working Party's
Opinion WP14726 focused on the application of data protection principles in the school and
educational environment. The Opinion emphasised the need for taking into account the best
interest of the child as also set out in the UN Convention on the Rights of the Child. The
Working Party wishes to stress the importance of this principle also in the context of SNS.
Some interesting initiatives27 have been undertaken by Data Protection Authorities world
wide which focus mostly on awareness-raising regarding SNS and possible risks. The
Working Party encourages further research on how to address the difficulties surrounding
adequate age verification and proof of informed consent in order to better address these
challenges.
Based on the considerations made so far, the Working Party believes that a multi-pronged
strategy would be appropriate to address the protection of children’s data in the SNS context.
Such a strategy might be based on:
- awareness raising initiatives, which are fundamental to ensure the active involvement
of children (via schools, the inclusion of DP-basics in educational curricula, the
creation of ad-hoc educational tools, the collaboration of national competent bodies);

25
e.g. instance, it is the case if this person’s email address was used by the SNS service to send him an invitation
26
http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2008/wp147_en.pdf
27
For example, the Portuguese “Dadus” initiative http://dadus.cnpd.pt/, the Danish Chat Check Badge,
http://www.fdim.dk/

-11-
- fair and lawful processing with regard to minors such as not asking for sensitive data
in the subscription forms, no direct marketing aimed specifically at minors, the prior
consent of parents before subscribing, and suitable degrees of logical separation
between the communities of children and adults;
- implementation of Privacy Enhancing Technologies (PETs) - e.g. privacy-friendly
settings by default, pop-up warning boxes at appropriate steps, age verification
software);
- self-regulation by providers, to encourage the adoption of codes of practice that should
be equipped with effective enforcement measures, also disciplinary in nature;
- if necessary, ad-hoc legislative measures to discourage unfair and/or deceptive
practices in the SNS context.

5. Summary of obligations/rights
Applicability of EC Directives
1. The Data Protection Directive generally applies to the processing of personal
data by SNS, even when their headquarters are outside of the EEA.
2. SNS providers are considered data controllers under the Data Protection
Directive.
3. Application providers might be considered data controllers under the Data
Protection Directive.
4. Users are considered data subjects vis-à-vis the processing of their data by SNS.
5. Processing of personal data by users in most cases falls within the household
exemption. There are instances where the activities of a user are not covered by
this exemption.
6. SNS fall outside of the scope of the definition of electronic communication service
and therefore the Data Retention Directive does not apply to SNS.
Obligations of SNS
7. SNS should inform users of their identity, and provide comprehensive and clear
information about the purposes and different ways in which they intend to
process personal data.
8. SNS should offer privacy-friendly default settings.
9. SNS should provide information and adequate warning to users about privacy
risks when they upload data onto the SNS.
11. Users should be advised by SNS that pictures or information about other
individuals, should only be uploaded with the individual’s consent.
12. At a minimum, the homepage of SNS should contain a link to a complaint facility,
covering data protection issues, for both members and non-members.
13. Marketing activity must comply with the rules laid down in the Data Protection
and ePrivacy Directives.
-12-
14. SNS must set maximum periods to retain data on inactive users. Abandoned
accounts must be deleted.
15. With regard to minors, SNS should take appropriate action to limit the risks.
Rights of Users
16. Both members and non-members of SNS have the rights of data subjects if
applicable, according to the provisions of Article 10 – 14 of the Data Protection
Directive.
17. Both members and non-members should have access to an easy-to-use complaint
handling procedure set up by the SNS.
18. Users should, in general, be allowed to adopt a pseudonym.

Done at Brussels, on 12 June 2009

For the Working Party

The Chairman
Alex TÜRK

-13-
Appendix 6
Web 2.0 Suicide Machine - Meet your Real Neighbours again! - Sign out forever!

About

FAQ

Take a Tour

Review

Contact

Open,
Smart and
100%
satisfaction
guaranteed!
Select your 229,651 friends have been unfriended

Social Network:
and

391,125 tweets have been removed since

Please read the C&D letter from Facebook here!!!

launching.

3,109 people went before you!

Click here to watch the latest ones!

works for all platforms: (version 2.03.17)

Faster, Safer, Smarter, Better Windows, Linux, Mac

http://suicidemachine.org/ (1 of 3) [8/3/2010 8:56:13 μμ]

Web 2.0 Suicide Machine - Meet your Real Neighbours again! - Sign out forever!

Tired of your Social Network?

Please make sure you have Flash Player
Liberate your newbie friends with a Web2.0 suicide! This machine lets you delete
all your energy sucking social-networking profiles, kill your fake virtual friends,
and completely do away with your Web2.0 alterego. The machine is just a 10 installed.
metaphor for the website which moddr_ is hosting; the belly of the beast where the
web2.0 suicide scripts are maintained. Our service currently runs with Facebook,
Myspace, Twitter and LinkedIn! Commit NOW!

Feel free like a real bird again and untwitter yourself. Watch it here!

Take the Testimonials FAQ

2.0 Suicide
View Learn
Watch
them the Who's Who We believe everyone
how should be able
Tour! all
of social network it
to commit suicide in
kills
social
View suiciders networks!
Video

ABOUT OUR OUR PROMOTE

US TARGET SERVICES US
NETWORKS
● Credits ● Watch Promo ● ShareThis
● Press ● Facebook Video
● Review ● MySpace ● Untwitter
● Contact ● LinkedIn Video
● Twitter ● Memorial
Pages
● Privacy Policy
● FAQ

http://suicidemachine.org/ (2 of 3) [8/3/2010 8:56:13 μμ]

Web 2.0 Suicide Machine - Meet your Real Neighbours again! - Sign out forever!

http://suicidemachine.org/ (3 of 3) [8/3/2010 8:56:13 μμ]