Disclosure to individuals within the association
In associations, membership lists are often disclosed to all members. In a sports club, for example, this would be done in order to enable members to contact each other for sports activities. This will only be permitted where customary within the club in question and agreed upon during a meeting of the club’s members.
Naturally, there will be a number of people within the association that will have to receive data from members in order to ensure the association’s smooth running. For example, a treasurer will need certain data if he is to be able to collect membership contributions.
Disclosure to individuals or companies outside the association
The disclosure of data to individuals or companies outside the association (a sponsor, for example) will be permitted where the association has requested its members’ consent in this respect. An association may also be legally obliged to do this. For example, under Section 47 of the Algemene wet inzake rijksbelastingen [State Taxes Act], the tax inspector may request that an association provide him with all data relevant for taxation purposes.
Where activities are concerned that are customary for the association in question or which have been approved during a meeting of the association’s members, the association will not be required to obtain the explicit consent of its members.
Disclosure to third parties for direct marketing purposes
Associations may also disclose data to companies for direct marketing purposes. They will only be permitted to do this where their members have been given a reasonable period of time in which to lodge their objection to a disclosure of this nature.
Once a member lodges an objection, an association must always immediately cease the use of his data for direct marketing purposes. The member will not be required to explain the reason for his objection and the association will not be permitted to request payment from the member for responding to his request. An association may inform its members of the disclosure proposed and the opportunity for members to lodge their objections to this via the club magazine or the association’s Internet site.
An example of permissible disclosure for direct marketing purposes is the Royal Netherlands Football Association (KNVB), which is permitted to sell data from its membership database for commercial purposes. It is able to do this since it has included this type of disclosure in the object underlying the membership records. This object was laid down in a general members’ meeting for amateur football. During the members’ meeting, it was decided to make personal data available for commercial purposes. The KNVB offers its members the opportunity to lodge objections to disclosure. Members are reminded of this opportunity on an annual basis, via the members magazine.
Notification and exemptions
Except where an exemption applies, the Dutch Data Protection
Authority (Dutch DPA) [College bescherming persoonsgegevens
(CBP)] must be notified of the processing of personal
data. The exemptions applicable are laid down in the
Vrijstellingsbesluit [Dutch Data Protection (Exemptions) Decree]. In general, membership records fall under Article 3 of this decree. You can assess this yourself against the requirements stated in this Article. In any event, associations must notify the Dutch DPA of its membership records where their members have not been given the opportunity to lodge their objection to the proposed disclosure of their data for direct marketing purposes or where an association wishes to retain member data for a period in excess of two years.
The Vrijstellingsbesluit gives an indication of the
parties to which an association is able to disclose
data, and in which situations. However, associations
will always be required to comply with the general
stipulations of the Wbp. Amongst other things, an association
must have grounds for the disclosure of data, it will
be required to protect the personal data obtained by
it and it must inform its members of the disclosure
proposed. An association will not be required to inform
its members as referred to above where it is subject
to a statutory obligation to disclose data. For information
on the notification of the Dutch DPA and exemptions,
please see the fact sheet entitled Melden en vrijstellingen [Notification and Exemptions].
Other rights for members
Besides the right of objection arising for employees
in respect of direct marketing, members will also
be entitled under the Wbp to information on their
personal data and also to access, supplement, correct,
erase and block said data . Also see the fact sheet
entitled Data Subjects
and Their Rights [Rechten van de betrokkene]. In
addition, members can lodge complaints with the association
in question where they feel that it has disclosed their
data to a third party without good reason. Also see
the fact sheet entitled Your
Complaint and the Dutch DPA [Uw klacht en het CBP].