Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
When it comes into force, how will the General Data Protection Regulation affect small hobbyist organisations? Will it apply to, for example, student societies that are holding lists of email addresses for their members? What about sports clubs or similar, with a small number of members whose data is being maintained?
For reference, these organisations are based in the UK.
(I have tried to find this information on Google, but the only results are business specific.)
Further to Dale's answer - Yes GDPR will apply (even if the UK leave the EU as the new Data Privacy national legislation will mirror EU regulations "https://www.gov.uk/government/collections/data-protection-bill-2017"). This does not mean the you cannot maintain membership lists. Just make sure you have a record of where all the addresses came from. I imagine it's a simple data base and not linked up to a CRM.
I would recommend emailing your subscribers and asking permission to keep them in a mailing list. You have a legitimate reason to have their email address - but only for the purposes as defined. Once everyone is opted in then happy days - you've ticked the box!
From the link you included:
The regulation applies if the data controller (organisation that collects data from EU residents) or processor (organisation that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the Regulation also applies to organisations based outside the European Union if they collect or process personal data of EU residents.
As of now, the U.K. Is part of the EU, so, yes.
You cannot just email members without their consent and you cannot seek that consent via email as you are in danger of breaking currently regulations known as PECR private Electronic Communications Regulation.
