http://www.rya.org.uk/newsevents/e-newsletters/club-room/feb18/Pages/general-data-protection-update.aspx" rel="nofollow - http://www.rya.org.uk/newsevents/e-newsletters/club-room/feb18/Pages/general-data-protection-update.aspx

I'm involved in membership of a (non sailing) organisation. We've taken the view, which the RYA apparently supports, that provided your data is being used for legitimate membership purposes only (contact etc) then  keeping basic details (excluding certain special categories) does not require explicit consent. We are producing a privacy statement (as required) which will be available to all members and which explains what we are doing and why.

One point the RYA presentation makes make is that if you rely on consent then you create a lot of potential administrative difficulty. You have to keep getting it renewed, and if it isn't (people don't respond, sign the form etc) then you have an  issue. Provided your uses are limited to those that can be seen as inevitable and legitimate uses of membership data it's better to avoid that route.

I would say that is down to you to request removal given the experience of GDPR that I have so far.

GDPR is more about use of your data going forward and contacting you in the future than what is already out there.

that would be my take on it too- flat html files with data tables aren't really under the scope here.

But I would say there needs to be some proper professional advice for any club or event which plans to submit data to a third party who intend to 'process' that data in any way going forward.  

EDIT: I guess the work around is to define the race itself as the data subject, rather than the individual competitors.... but that sounds a bit shaky and I wouldn't want to test it in a legal setting with prospective penalties for compliance failure.

Race results are personal data.

To use it you need to do a LIA (Legitimate Use Assessment)

I'd say it is in the legitimate interests of the class or club to communicate the results of an event and to preserve the records for the historical interest .... of course there should be an accompanying Privacy Policy giving people the process to request their data is removed ... then the processor needs to take a view. on that ... probably best to just remove.

Entry forms are going to look like war and peace with all this legislation ... and the likes of big corp will so do as they like as they have the biggest law budgets. 

"The Information Commissioner’s Office provides a simple registration self-assessment tool online (https://ico.org.uk/for-organisations/register/self-assessment/), allowing organisations to determine whether they are affected by the GDPR.

This says that those processing data to be used only in a recreational context are exempt from having to register."

However, having tried the self-assessment questionnaire, the first Q is 'do you use CCTV for crime prevention?' If the answer is yes then the site immediately says you must register. If the answer is no, then several questions later the recreational question is asked and the 'No Need to Register' response comes back in response to an affirmative.

I strongly suspect that many, if not most, clubs (being often in less populated locations) will have CCTV installed.

Having been to a seminar on this topic I was surprised to learn that a CCTV image of someone's face is considered 'personal data' even without a name attached. Likewise, a vehicle registration number - on its own - is considered personal data. The fact that the reg no doesn't say who owns said vehicle, or who may have been driving it at a particular time seems to have passed by the officials. Further, a credible reason is needed to get any details out of the DVLA. Bonkers.