New Posts New Posts RSS Feed: GDPR and clubs and classes.
  FAQ FAQ  Forum Search   Register Register  Login Login

GDPR and clubs and classes.

 Post Reply Post Reply Page  12>
Author
L123456 View Drop Down
Really should get out more
Really should get out more


Joined: 30 Apr 12
Online Status: Offline
Posts: 500
Post Options Post Options   Quote L123456 Quote  Post ReplyReply Direct Link To This Post Topic: GDPR and clubs and classes.
    Posted: 18 May 18 at 1:08pm
Not having to register is a different matter to having to follow the regs.
Back to Top
turnturtle View Drop Down
Really should get out more
Really should get out more


Joined: 05 Dec 14
Online Status: Offline
Posts: 2538
Post Options Post Options   Quote turnturtle Quote  Post ReplyReply Direct Link To This Post Posted: 18 May 18 at 11:36am
Yes but the RYA are using the data to construct a commercial product, as is sail racer.
Back to Top
Noah View Drop Down
Really should get out more
Really should get out more


Joined: 29 Dec 04
Location: United Kingdom
Online Status: Offline
Posts: 611
Post Options Post Options   Quote Noah Quote  Post ReplyReply Direct Link To This Post Posted: 18 May 18 at 11:35am
In a letter to a respected newspaper today:

"The Information Commissioner’s Office provides a simple registration self-assessment tool online (https://ico.org.uk/for-organisations/register/self-assessment/), allowing organisations to determine whether they are affected by the GDPR.

This says that those processing data to be used only in a recreational context are exempt from having to register."

EDIT:
However, having tried the self-assessment questionnaire, the first Q is 'do you use CCTV for crime prevention?' If the answer is yes then the site immediately says you must register. If the answer is no, then several questions later the recreational question is asked and the 'No Need to Register' response comes back in response to an affirmative.

I strongly suspect that many, if not most, clubs (being often in less populated locations) will have CCTV installed.

Having been to a seminar on this topic I was surprised to learn that a CCTV image of someone's face is considered 'personal data' even without a name attached. Likewise, a vehicle registration number - on its own - is considered personal data. The fact that the reg no doesn't say who owns said vehicle, or who may have been driving it at a particular time seems to have passed by the officials. Further, a credible reason is needed to get any details out of the DVLA. Bonkers.


Edited by Noah - 18 May 18 at 11:46am
Nick
D-Zero 316

Back to Top
L123456 View Drop Down
Really should get out more
Really should get out more


Joined: 30 Apr 12
Online Status: Offline
Posts: 500
Post Options Post Options   Quote L123456 Quote  Post ReplyReply Direct Link To This Post Posted: 18 May 18 at 10:00am
You have PM  Wink
Back to Top
patj View Drop Down
Really should get out more
Really should get out more


Joined: 16 Jul 04
Location: Wiltshire
Online Status: Offline
Posts: 643
Post Options Post Options   Quote patj Quote  Post ReplyReply Direct Link To This Post Posted: 18 May 18 at 5:46am
I was involved in this at the start of the year and we consulted the RYA guidance and added a page to our membership forms to cover the data protection requirements.
We state how your data is to be used, including passing to RYA and request also that members tick a box to opt in to having their details on the members only contact directory and another tick box opt in to using photos of them and their boats on the club web site, social media pages or for use in press releases.
For those who need it the form can be blagged as a pdf from SSC-New-Members-Pack-2018or I could be talked into emailing a word document

Edited by patj - 18 May 18 at 5:48am
Back to Top
2547 View Drop Down
Really should get out more
Really should get out more


Joined: 11 Aug 11
Online Status: Offline
Posts: 1151
Post Options Post Options   Quote 2547 Quote  Post ReplyReply Direct Link To This Post Posted: 16 May 18 at 3:23pm
Originally posted by turnturtle

Originally posted by jeffers

Originally posted by L123456

SO what about all the results with names and sail numbers that feature on this and club and class websites?


I would say that is down to you to request removal given the experience of GDPR that I have so far.

GDPR is more about use of your data going forward and contacting you in the future than what is already out there.

that would be my take on it too- flat html files with data tables aren't really under the scope here.

But I would say there needs to be some proper professional advice for any club or event which plans to submit data to a third party who intend to 'process' that data in any way going forward.  

EDIT: I guess the work around is to define the race itself as the data subject, rather than the individual competitors.... but that sounds a bit shaky and I wouldn't want to test it in a legal setting with prospective penalties for compliance failure.

Race results are personal data.

To use it you need to do a LIA (Legitimate Use Assessment)

I'd say it is in the legitimate interests of the class or club to communicate the results of an event and to preserve the records for the historical interest .... of course there should be an accompanying Privacy Policy giving people the process to request their data is removed ... then the processor needs to take a view. on that ... probably best to just remove.

Entry forms are going to look like war and peace with all this legislation ... and the likes of big corp will so do as they like as they have the biggest law budgets. 
Back to Top
turnturtle View Drop Down
Really should get out more
Really should get out more


Joined: 05 Dec 14
Online Status: Offline
Posts: 2538
Post Options Post Options   Quote turnturtle Quote  Post ReplyReply Direct Link To This Post Posted: 16 May 18 at 11:46am
Originally posted by jeffers

Originally posted by L123456

SO what about all the results with names and sail numbers that feature on this and club and class websites?


I would say that is down to you to request removal given the experience of GDPR that I have so far.

GDPR is more about use of your data going forward and contacting you in the future than what is already out there.

that would be my take on it too- flat html files with data tables aren't really under the scope here.

But I would say there needs to be some proper professional advice for any club or event which plans to submit data to a third party who intend to 'process' that data in any way going forward.  

EDIT: I guess the work around is to define the race itself as the data subject, rather than the individual competitors.... but that sounds a bit shaky and I wouldn't want to test it in a legal setting with prospective penalties for compliance failure.


Edited by turnturtle - 16 May 18 at 11:54am
Back to Top
jeffers View Drop Down
Really should get out more
Really should get out more
Avatar

Joined: 29 Mar 04
Location: United Kingdom
Online Status: Offline
Posts: 3048
Post Options Post Options   Quote jeffers Quote  Post ReplyReply Direct Link To This Post Posted: 16 May 18 at 11:28am
Originally posted by L123456

SO what about all the results with names and sail numbers that feature on this and club and class websites?


I would say that is down to you to request removal given the experience of GDPR that I have so far.

GDPR is more about use of your data going forward and contacting you in the future than what is already out there.
Paul
----------------------
D-Zero GBR 74
Back to Top
L123456 View Drop Down
Really should get out more
Really should get out more


Joined: 30 Apr 12
Online Status: Offline
Posts: 500
Post Options Post Options   Quote L123456 Quote  Post ReplyReply Direct Link To This Post Posted: 16 May 18 at 11:22am
SO what about all the results with names and sail numbers that feature on this and club and class websites?

Back to Top
turnturtle View Drop Down
Really should get out more
Really should get out more


Joined: 05 Dec 14
Online Status: Offline
Posts: 2538
Post Options Post Options   Quote turnturtle Quote  Post ReplyReply Direct Link To This Post Posted: 15 May 18 at 6:12pm
AIUI GDPR is as much about the processing of information as it is the storage and collection of data for everyday business practices. As such, I wouldn’t be worried about conventional membership activity and interns member communications - keep it secure as said already. but surely the external submission of data to the RYA through personally identifiable race results for whatever unknown processing they do, is in contravention without express consent from all participants?

Even annoymised data can be traced - a sail number with class can serve as a UI field, I’ve certainly traced boat ownership lineage pretty easily through sail numbers and publicly available results in the past. It’s not that hard.
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down

Bulletin Board Software by Web Wiz Forums® version 9.665y
Copyright ©2001-2010 Web Wiz
Change your personal settings, or read our privacy policy