I have a website with a little community. Users need to register, after which they're able to send messages to each other. Recently there was a scammer who was contacting users and trying to get their bank account details etc.

My thought was that I'd like to store the ip addresses of such dodgy people, but is that legal in NZ? I'd be storing the ip address in a way that would make it easy to associate it with the user, so you'd be able to know their name, email, etc. (not that [smart] dodgy people would use their real details).

Failing that, I could limit signups to NZers, which the site caters to anyway. But that probably means signing up for expensive geolocation databases, if i wanted decent reliability.

Or maybe there's a better solution I haven't thought of.