P 06 Data Protection Policy

DATA PROTECTION

Bowls Oxfordshire has a legal and moral duty to protect the data of their members. Many points of the GDPR already apply under current data protection laws. The GDPR became enforceable from 25th May 2018.  It replaces the Data Protection Act 1998 and covers the storage and use of ‘Personal Data’.

Personal data is defined as any piece of personal information that can be used to identify an individual, either directly or indirectly. GDPR covers a range of information which includes for example: an individual’s:

• Name
• Telephone number
•  E‐mail address
• Date of birth (DoB)
• Health information
• Location data
• bank details
• Online identifier e.g., IP addresses or cookies. 

However, only those things considered necessary for managing bowling in the county are relevant (Name, address, telephone number and Email address.) This ensures bowlers can contact each other in the course of their bowling activities. It does not allow the use of this information for any non – bowling reasons.

There is no valid reason for keeping details about an individual’s DoB or age, bank details, Online identifiers and IP addresses etc. In normal circumstances, details of medical conditions would not be held, unless the individual has a specific disability and has asked for “reasonable adjustments” and understanding to support them to bowl on an equal basis with their peers.

The GDPR states that Personal Data can be held, without the need for consent, if it is adequate / relevant/non‐excessive. This means that as long as a Club, or County Association, reasonably considers the storage of Personal Data to be relevant and non‐excessive, they can continue to hold it. Under the GDPR, an organisation can lawfully process data only if at least one of the following conditions are met:

• The data subject has given their consent.
• If the processing is necessary for the performance of a contract.
• For compliance with a legal obligation. If the processing is necessary to protect the vital interests of the data subject.
• Public interest purposes.
• If there is a legitimate interest pursued by the data holder or a third party.

Bowls Oxfordshire therefore suggests that, for example, should an affiliated Club wish to ‘publish’ the telephone number of a member they should obtain ‘consent’ for this purpose – this must be ‘opt in’ rather than ‘opt out’. It is recommended this is re-confirmed every 3 years.

The next page contains an appendix, which could be used for a template for clubs to adopt as club policy.

Appendix A

(Name of Club) ….BOWLS CLUB – POLICY REGARDING PERSONAL DATA

Consent Required from all members.

A new legal duty came into force from 25th May 2018 regarding the collection, storage and use of personal and sensitive data. The General Data Protection Regulation (‘GDPR’) will replace the Data Protection Act 1998. Personal data is defined as any piece of personal information that can be used to identify an individual, either directly or indirectly. This includesinformation such as an individual’s:

• Name

• Telephone Number

• E‐mail address

• Date of birth

• Health information

• Location data

• Online identifier e.g. IP addresses or cookies GDPR will apply across most of Europe and will be unaffected by Brexit.

Name of Club ….Club (‘The Club’) collects contact information from all members through a form at the point of application and seeks to collect any changes to that data annually prior to the start of the season. Data is held on application forms (by the Secretary and Treasurer) and contact lists that include full names, gender, telephone numbers and email addresses are held by all members of the management committee. This is held electronically and in paper form.

This information is held to facilitate communication with members regarding all matters directly relating to ‘The Club’. ‘The Club’ produces a fixture book each year. In that fixture book it includes the names and telephone contacts of Officers of the Club to enable contact between members regarding matches, competitions, and social events. The advice we have from Bowls England following discussions with the Information Commissioners Office is that ‘The Club’ can hold personal data without the need for consent provided it is adequate, relevant, and not excessive. The management committee are clear that the personal data we hold meets these tests.

However, Bowls England suggests that, for example, should a Club or County Association wish to ‘publish’ the telephone number of a member they should obtain ‘consent’ for this purpose and this must be ‘opt in’ rather than ‘opt out’. In other words, each individual member, regardless of marriage must give their individual consent to the above information being held about them. Not replying to the consent letter is not sufficient, each member MUST fill in the form and give their consent.

‘The Club’ publishes telephone numbers in its fixture book and also shares that information with Bowls Oxfordshire, the OBA and BOL from time to time. In addition, email addresses are shared between members through ‘all member’ email communications. Finally, the website can hold names and photographs of members, for example from club finals day.

‘The Club’ will not share or sell members contact information with other third parties for any other purpose such as marketing without the express and separate permission of members.

In order that we can continue to publish names and telephone contact numbers, communicate with members through email and keep our website up to date with relevant information, we require each member to agree to ‘The Club’s’ Data Policy as set out above by signing and returning a copy of this form. It is recommended this is confirmed every 3 years.

...........................................................................................................................

I agree to the collection, processing and usage of my personal data as set out above.

NAME (print)…………………………………………………………………………

SIGNATURE…………………………………………………………………………

DATE………………………………………………………………………………….