Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
We use a service (Meetup.com) to post our events publicly. We do not store/collect/process any information about any attendants except for the number of sandwiches to order. Everything is kept in Meetup. We do not get leads or conversion rates from these meetups.
Do we need anything related to GDPR (agreements, contracts like DPA)?
PS: we do take some pictures during the event
Since you are causing Meetup to process personal data about attendees about your event, you and Meetup are likely joint data controllers for some of the occurring processing. This is not a particularly enviable position since you have no control over how Meetup subsequently uses the data. Thus, I believe that the only GDPR-compliant way of using Meetup is if the use of Meetup is entirely voluntary for all involved people, in particular if all relevant communication is also possible via some other mechanism. For example, it might be sensible if a prospective participant can also ask for sandwiches via a (publicly available) email address.
Relevant precedent is the “Wirtschaftsakademie Schleswig-Holstein” case before the ECJ, in which an institution running a Facebook page was held jointly liable for Facebook's noncompliant use of cookies (at the time). Running a meetup on Meetup.com is a very similar constellation.
The GDPR applies regardless of whether you have any economic interest in this activity. It applies to any processing/storage/collection of personal data, with some exceptions such as police work or purely personal/household purposes. So even meetups and social clubs that aren't just a group of friends do have to comply. In practice this isn't enforced very heavily, but there is some liability involved when acting as an organizer. If you are running this meetup as part of a business (regardless of a profit motive) there might be some more attention to proper compliance.
Whether taking pictures is OK depends a lot on the local laws in your jurisdiction. From the GDPR perspective, you'd need a legal basis for taking pictures. This could be a legitimate interest that you have, but you'd have to balance your interest against theirs, notify people and enable them to opt out. Other aspects such as personality rights are vastly more important, especially if you would like to publish the pictures, e.g. to social media. In practice, you usually cannot use pictures without consent of the people in the foreground.
