GDPR

[jpringle819]

Hi,

Hopefully this is the right place to post this, I am part of a Facebook group that supports a US musician. In the US they have regional clubs that meet and raise funds for charity. They have an option to join this group and a number of UK supporters have expressed an interest in doing this. I have looked into the requirements and have found this

A petition is signed by a minimum of 30 perspective members of this new club. The signers must indicate their full name and home address and a minimum of two (2) officers must be named at the time of application.

I have 30 willing people and I don't mind being the administrative contact to sort this out. However, if I am storing this data I presumably have to take into account GDPR. I have looked at this https://shadow.cat/blog/mark-keating/2017/013-GDPR... and I am fairly sure I can meet the requirements. What happens when I share this with the US based club administration?

[Tebbers]

Can you store it with an online petition company like change.org or similar? That to me would seem a useful way of piling the compliance onto someone else?

[Frimley111R]

Or just ignore it?

It's a small FB group and although technically the same rules apply I'd really be disinclined to waste time with GDPR for such a small concern. As long as you don't do anything silly with the data you'll be fine, like 99.9% of businesses who ignore GDPR anyway.

[Freakuk]

Tebbers said:

Can you store it with an online petition company like change.org or similar? That to me would seem a useful way of piling the compliance onto someone else?

I'm not sure that would help, GDPR specifically calls out data owner and data processor which the old DPA didn't, you would need to ensure that any data shared to a 3rd party would need to be checked to ensure they are compliant, and maintain their compliance while they have the data.

Policies and processes would need to be defined for access, sharing, deletion also.

[Simpo Two]

My old school association holds an annual dinner, and attendance was halved this year because, thanks to GDPR, the school couldn't contact the old boys without their permission. It had been asked last time, but of course not everyone responded. And hence they could not receive invitations.

On the night, sitting at a much reduced event, it was thought that if the school had given the mailing list to one of us, instead of managing it itself, GDPR would not have applied and the event could have proceeded unhindered. Is that correct? If so it might help the OP.

[Marcellus]

Is the OP planning on running this as a business or is it just a collection of individuals/club?

As I understand it GDPR is all about B2C where is if it's a non commercial club it doesn't fall into the legislation.

Or have I got that wrong?

[williamp]

Simpo Two said:

My old school association holds an annual dinner, and attendance was halved this year because, thanks to GDPR, the school couldn't contact the old boys without their permission. It had been asked last time, but of course not everyone responded. And hence they could not receive invitations.

On the night, sitting at a much reduced event, it was thought that if the school had given the mailing list to one of us, instead of managing it itself, GDPR would not have applied and the event could have proceeded unhindered. Is that correct? If so it might help the OP.

Worse. Why not give their data to a sales team as well? Etc etc. Their mistake was using consent as a legal basis. School leavers are a useful resource for schools, so they could have tried to use "legitimate interest" instead.

[jpringle819]

Thanks for the help, this would just be completely non-profit. We have decided not to join the US based club and just stick with the informal Facebook group for now. Looking at ways to get individual members to submit their details directly to the US club rather than one individual collecting the information over here.