GDPR - choice for kids club means they've deleted me

[MarinaF54]

A newbie, so be gentle....
Due to GDPR (new data protection rules) a club my kids go to emailed to ask my preferences about my data and how they can share it: option 1 allow them to share with all involved, parents, helpers etc., or option 2 only share with leaders. I went with 2. They then asked me to set up a new email address so that I can then accept option 1. I am not keen and asked that they just BCC me in on any emails (so my email address doesn't show). I think its a no from them, because I have now received an email saying that due to my choice they will now electronically delete me from all records and databases and they will no longer allow anyone to contact me electronically. Pointing out that since all communication is via email I will no longer get any information about the club.

Seems bit extreme to me, AIBU to have expected them to allow me my choice, which was that they offered? Not sure now what to do.

Well they didn't exactly give you a choice did they you either accept option 1 or we don't contact you at all. I would contact them asking how they expect you to use the service if they will no longer provide information about the club. They are being very unreasonable that's not the purpose of the GDPR rules.

This goes beyond unreasonable into unlawful. They’re not allowed to effectively refuse to deal with you just because you object to your details being shared with all and sundry. See section 3.1 of the guidance here: iapp.org/media/pdf/resource_center/wp29_consent-12-12-17.pdf

Suggest you point out to them that they’re in violation of GDPR, and perhaps draw their attention to section 3.1 of that guidance.

Oh, and asking you to set up a new email address is bullshit - any new email address would still be Personally Identifiable Information so wouldn’t get them off the hook.

YANBU

It sounds like they don’t understand GDPR.

You’ve given permission for leaders to use your email address.

They should be BCCing emails as a matter of course anyway, that’s not a new thing since GDPR

My understanding is that they don’t need your permission to contact you for things that are necessary, so to invoice you or send you vital information like “we’re closed on x date” and you’ve given permission for this anyway!

Like many smaller businesses, voluntary schemes etc they have totally misunderstood the GDPR. They are asking for something they had no need to ask for and are then demanding soemthing that directly contravenes it!

That and they should already be BCC ing everyone! As a kids club they shouldn't be sharing contact data, that comes under safeguarding!

They need some real advice , quickly, before someone makes them a GDPR casualty - though they seem to be well on the way to doing that themselves.

Thanks for your responses, I will look at the rules. I did some google searches but it wasn't clear as the club (which is national) has charity status and although I pay, it is run by volunteers. In theory you would think that there would be central information on procedures, but possibly that hasn't been the case.