Is it necessary to protect user data if they know and agree to it being insecure?

Question

If I'm running a website that, say, takes a survey, must I protect user data from disclosure if the users are informed initially that it's insecure? I'm not storing financial data or social security numbers, just opinions, (user)names and e-mails.

Answer 1

You expect user's to read the agreement? Really? That simply doesn't happen, it's a rare user that reads the EULA instead of simply clicking next or checking that checkbox that says they read it.

These days there's an implicit assumption that you'd going to take some care over what you're doing, in the same way that you expect a surgeon to know what organ to remove, and even if you sign a piece of paper before going into surgery agreeing not to sue if they remove a leg instead of a kidney the implicit duty of care expectation and subsequent publicity nightmare when you're hopping mad on television because they lopped off a leg (pun intended!) would sink that doctor's career for good.

Answer 2

"Knowing" its insecure is a tricky thing... How do they know this? A nice big message on the site (that is easily ignored)? A long ToS that noone bothers to click on, much less read? An intrusive popup, that the typical user will not read and click right through to get to the site?

So, is it okay to not secure this data?
If this data was completely anonymous, I would say "perhaps". Maaaaybe even "probably", given some more information.
Given that the information includes email addresses, and correlates between names and opinions (on what? politics? religion? sexual preferences? employer? employer's religiously sexual preferences?) I would say it's a resounding "Not so much".

Again, it still depends on what precise information is there, and why you think the user knows (e.g. displaying blog comments is pretty obvious this is displayed).
Also, when you say "secure" and "protect", these terms are not completely unambiguous... My assumption is that you're referring to "protect from disclosure", obviously you still want to prevent SQL Injection, XSS, etc etc.

Answer 3

To add, though there are many “it depends” here, if you have money and an user can cry foul then you open yourself up to civil suits.