<div dir="ltr">I am advising several professional membership associations on this issue and have conferred with Ireland's Data Commissioner on this. It is generally accepted that any organisation must hold and process some personal data on members in order to conduct normal business and that it is acceptable to tell people that if they don't want their details recorded, they cannot be a member. In fact, we shouldn't even have to think about this - it's common sense.<div><br></div><div>Brandt Dainow</div><div>Ireland</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 9 May 2018 at 13:46, Todd M. Tolbert <span dir="ltr"><<a href="mailto:tolbert@isoc.org" target="_blank">tolbert@isoc.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Good Day Peter, thank you for your note.<br>
<br>
I appreciate your comments and thoughts on what you have seen in our Privacy Statement and the opt-in process all together. As you state, this is not an easy task for any organization and especially one that is as diverse as ISOC is. You've hit the nail on the head with listing that we have members, website visitors, those who apply for fellowships, grants, etc and one you didn't list; Org Member representatives. We have spent quite a lot of time trying to put together a privacy policy that speaks to all of these types of users / people while still providing the pieces we need to protect the organization and meet the requirements of GDPR. Again, not an easy task. But it is quite inline with what we advocate for in data handling around the world.<br>
<br>
But our commitment is the same across all. We only ask for data that we need to process the request or meet our side of the "bargain". The listing of the purposes of data are meant to give a broad feeling of why we ask for the data in the first place. We believe that for the types of interaction we have with everyone listed above, sans the website visitors, that maintaining some information helps us better interact with and provide services to those segments of our community. And in many cases, we only ask for the data we absolutely need to be able to contact, process or interact with that person. <br>
<br>
We fully respect anyone's decision to not grant the Internet Society the permission to store any Personal Data and will continue to advocate for and support that decision. To that end, we have no way to count someone as a member, provide them access to any of our programs, grants, online tools, etc, if they don't opt-in to storing personal data. I'm not sure about the "enforced consent" statement, as we believe we have done a lot of work to walk the walk that we have advocate for in this whole process. <br>
<br>
I hope this helps, and I'm happy to follow up if needed.<br>
<br>
Thank you,<br>
Todd<br>
<br>
<br>
<br>
On 5/8/18, 12:51 PM, "Peter Koch" <<a href="mailto:peter@denic.de">peter@denic.de</a> on behalf of <a href="mailto:pk@ISOC.DE">pk@ISOC.DE</a>> wrote:<br>
<br>
Todd,<br>
<br>
thank you for this update.<br>
<br>
On Tue, May 08, 2018 at 02:02:33PM +0000, Todd M. Tolbert wrote:<br>
<br>
> With just two weeks left until May 25th, as of Monday morning we are up to 36,300 Members who have opted-in. We will continue the emails reminding folks through May 25 and then stop and do a deeper dive into the data of those who have not opted-in and look to see how we can do another notification / plea for action. You???re help in communicating to your chapters, as always, is helpful in this endeavor.<br>
<br>
First, I had not noticed the updated version (20 APR 2018), yet. It'd be great if<br>
the changes could be highlighted separately.<br>
<br>
I have not "opted in" in, yet, and also do have reservations, as a member of the<br>
chapter leadership, to encourage others to do so, because I am rather confused<br>
by ISOC's approach of "enforced consent", expecially as the GDPR is mentioned<br>
several times in the "privacy statement". As a membership organization, it is<br>
clear ISOC collects my name and email address - but that is, as you explain,<br>
necessary for the "execution of the contract", i.e., to administer and maintain<br>
the membership (and therefore would suggest another justification as per Article 6(1)).<br>
<br>
The privacy statement then continues and is rather vague about all other kind of data<br>
that might be collected for various purposes. It is unclear to me, how much of this relates<br>
to the vanilla membership, to visits to ISOC's website or to specific actions<br>
like asking for grants or project funding. It is also unclear why I'd want to<br>
"consent" to all of this upfront, rather than when the need arises.<br>
<br>
Among the "uses of data" (which is different from "purposes") are<br>
<br>
o Improve your engagement and interaction with other Members of our community.<br>
o Improve our engagement and interaction with you.<br>
<br>
which appear rather vague to me. Finally, the privacy statement says<br>
<br>
We or our authorized vendors may collect Technical Information that we do not associate with any individual Site user. This information includes -<br>
[...]<br>
the Internet Protocol (IP) address through which you access the Internet;<br>
<br>
and also refers to the "certain anonymous information". Now, we'll not solve the<br>
question of IP addresses as personal data here, but in total I have my doubts<br>
what I am "asked" to subscribe to.<br>
<br>
I appreciate it is hard to achieve GDPR compliance while still being comprehensible<br>
and also I'm nowhere near jealous of your task while I'd also generally trust ISOC's<br>
responsible handling of data. That said, an "opt in" really does not feel right.<br>
<br>
Yours confused,<br>
Peter (<a href="http://ISOC.DE" rel="noreferrer" target="_blank">ISOC.DE</a>)<br>
<br>
<br>______________________________<wbr>_________________<br>
As an Internet Society Chapter Officer you are automatically subscribed<br>
to this list, which is regularly synchronized with the Internet Society<br>
Chapter Portal (AMS): <a href="https://portal.isoc.org" rel="noreferrer" target="_blank">https://portal.isoc.org</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><a href="mailto:brandt.dainow@gmail.com" target="_blank">brandt.dainow@gmail.com</a></div>
</div>