[shark]

Hopefully most aware that I’ve been running a petition on Change.org to have the BMC include a couple of resolutions at the AGM.

I’ve fallen foul of trying to validate a lot of the signatories being BMC members so trying to reach unverified signatories and ask them to email me signatories.

I had a post swiftly pulled on UKC that read:

 
Does anyone know these climbers?

If so can you please contact them and email me their BMC member numbers to simon@simonleeconsulting.co.uk so I can have their petition signature validated by the BMC Office. The deadline is Saturday 27th.

I then listed the names of 200 or so unverified signatories.

The petition and support of resolutions isn’t a private matter so did I do anything perceptually or actually wrong?

[mrjonathanr]

No expert, but I suspect you are functioning as a data processor under GDPR and the individuals have not given specific consent for their identities as signatories to be published.
https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/controllerprocessor/what-data-controller-or-data-processor_en

[shark]

Thanks Jon. Presumably there should be an expectation that signatory names will be passed to whoever is being petitioned but cant find any guidance on the Change website even on this.

[Fultonius]

 Well, I signed and then realised I wasn't a BMC member so didn't follow up. You can remove me from the list if that helps. I'm sure you figure out who I am...

[remus]

I do GDPR stuff for lattice. Mr J is basically correct. One of the guiding principles of GDPR is that you clearly communicate the purpose for which data is being collected and to get explicit consent for this usage, so in this case I would say that it was not clearly communicated that the names would be shared publicly.

[SA Chris]

From my experience with GDPR, remus (and mjjr) are correct. Explicit consent is needed.

[shark]

Thanks guys