General Data Protection Regulation and Your Chapter

June 2018 - Many of you may have heard about the General Data Protection Regulation (GDPR) and wondered how it might affect you. GDPR is a new set of privacy regulations put in place in European Union countries. These new laws only protect residents of the European Union (EU). If your chapter receives any information from or sends any information to EU citizens, then these rules will apply to your chapter.

First and foremost, you need to disclose what personal data you record, why you record it, and how long you keep it. EAA headquarters has published a data policy, which you can read on EAA’s website for more information and to use as a guideline.

If you have an EU member who leaves the chapter, you cannot hold on to that member’s data forever – you must delete it after a reasonable period of time. Similarly, for event registrations you must disclose to that EU member what information you’re recording (usually name, address, etc.), why you’re recording it, and when you’re going to delete it. With events, you usually need to remove the data after the event is completed.

You can send e-mails to EU members regarding their chapter membership or event registration, but if you wish to send anything else (invitations to future events, for example), you need their permission first. All marketing communications are now “opt in.” The EU resident needs to affirm that they want these messages; it’s not enough to ask them to “opt out.”

You also need to protect the personal information of EU citizens. At EAA headquarters, we’re eliminating all of the auto-populating forms and member-lookup tools for our EU members. Access to member information is restricted to certain staff members, and we take additional steps to keep our data secure.

For most of you, these new rules will not apply. However, if you have any EU residents in your chapter or whom you market to, then you will need to take action. Please contact EAA headquarters with any questions.