I have a GDPR question concerning a small non-profit organization. The organization is quite informal. Although it has many regular meetings, all these meetings are open to the public. As such, most of those who attend, even many regular attendees, are not officially registered members of the organization.
The organization would like to keep track of those who attend for follow-up purposes. I have three related questions about what the GDPR permits. In the first two cases, the organization does not make any formal announcement that it is tracking the attendance of whom attends. (However, attendance numbers are occasionally mentioned informally, so it is not a secret, either.)
First, is it legal under the GDPR for the organization to take a count of how many people attend without recording any names? In this case, the organization groups the counts by the general age (child, teenager, or adult) and gender (male or female) of the attendees, but no names are recorded. These attendance numbers are shared among the organization members and are occasionally announced to all meeting attendees. (I would think that this is authorized.)
Second, is it legal under the GDPR for the organization to record the attendees by name, including their general age and gender as mentioned above? The names are obtained through informal contact with the attendees during meetings; attendees are never explicitly asked if they want their attendance recorded. These attendance lists with names are shared only among organization members on follow-up committees. (This is the main case that I have questions about under the GDPR.)
Third, in case either or both of the above cases are not authorized under the GDPR, is there any legal way that attendance by name can be recorded and shared among designated organization members? The primary hesitation to formally requesting authorization is that the organization wants attendance records to be as accurate as possible and if some attendees do not grant authorization, then the records will never be accurate. I have heard that one way to accomplish this would be to verbally announce at the beginning of each meeting that attendance is recorded, or to conspicuously post a written notice to this effect at the entrance. Would either of these fulfill GDPR obligations? Or is there an alternative solution?
In any answer, I would appreciate it if you could cite specific relevant sections of the GDPR so that I can learn the law better.