Requesting help from CTC members

[Philip Benstead]

I find it interesting that there is the option to receive/unsubscribe from Councillor e-mail yet CTC employees apparently censor such e-mails and not make the lists available to Councillors. Yet the subscription options suggest they do/should (do/should send Councillor e-mails or pass e-mail lists to Councillors).

That form is irrelevant for specifying what forms of contact are allowable under DPA. It's buried too deep and you are not automatically taken there as part of your sign up acceptances. It also only applies to members who have a CTC website login, not all members.

I work for a large organisation and we are very clear on what mailings we can and can't legally do within the DPA. Personal information such as email addresses can only be used for the purposes for which it was given. If it is collected on subscription and there is no explanation of what it will be used for then it can only be used for corporate communications, not for individuals or third parties to send personal emails to you. That's why we always have all those boxes to tick on websites about communications from selected third parties - because the DPA requires that we give our consent before our email can be used in that way. So I don't see a case for it being called censorship; unless you call complying with the law censorship.

I had always regarded the CTC Councillors as part of the CTC.

Ian

That is untrue

If you read the below you will find that the sharing of contact details of persons is permitted if certain conditions are meet.
Unfortunately, CTC data protection policy even if it is legal it is in imho has been written to reduce its usefulness I wonder why.
https://ico.org.uk/.../guide.../data-pr ... rinciples/

MY QUESTION TO THE DATE PROTECTION COMMISSION

Information Commissioner's Office
I am a trustee of Cyclists' Touring Club (CTC) http://www.ctc.org.uk/: A company limited by guarantee, registered in England no.25185. Registered as a charity in England and Wales No 1147607 and in Scotland No SC042541.
Following a conversation with one of your colleagues on the telephone as to the legality of the altering, its existing Data Protection Policy to make greater use of our members data (see attached existing policy). I am seeking guidance and clarification if the CTC is permitted to use following data of its members who act has elected /appointed officers within the organisation at local level.

OUR CURRENT PRACTISE
The CTC distributes the contact data of its all member to the registered officer in the relevant geographical area.
The CTC publish contact details of its local group officers on its website, in the form of group name, name of officer and telephone and link the group’s website.
We also have right to ride representatives who role is to campaign on behave of the CTC at local authority level, these individual names are publish connect with a geographical area but often just publish our national office telephone number and email. Some of these rights to ride representative have contacted the national office and insist for their personal telephone and email address are published on the website.
CAN WE DO THE FOLLOWING - WHAT WE SEEK TO DO WITH THE DATE
Groups Name /Area
Group Website
Officer Name
Officers Telephone/mobile numbers
Officer Email address
Officer Postal address
Following formal individual consent from each individual, publish on our website the above contact details of its
• Local Member Groups
• Informal Cycling Groups
• Affiliate Groups
• Right to Ride Representatives
Following formal individual consent from each individual, distribute via email to registered officer’s and to right to ride representatives contact details of its
• Local Member Groups
• Informal Cycling Groups
• Affiliate Groups
• Right to Ride Representatives

I hope the above is clear but if you require addition information or clarification please do not hesitate to contact me, see below.
THE REPLY

27 November 2014

Case Reference Number ENQ0562965

Dear Mr Benstead

Further to your email received on 25 November 2014, and our telephone conversation today.

You ask for confirmation that personal data – contact details etc, of club representatives can be shared with other groups and made available on your website.

Any organisation that is processing personal data will need to comply with the Data Protection Act 1998 (DPA), and in order to process personal data will need a condition for processing from schedule 2 of the DPA. These conditions are listed below

•The individual who the personal data is about has consented to the processing.

•The processing is necessary:
- in relation to a contract which the individual has entered into; or
- because the individual has asked for something to be done so they can enter into a contract.

•The processing is necessary because of a legal obligation that applies to you (except an obligation imposed by a contract).

•The processing is necessary to protect the individual’s “vital interests”. This condition only applies in cases of life or death, such as where an individual’s medical history is disclosed to a hospital’s A&E department treating them after a serious road accident.

•The processing is necessary for administering justice, or for exercising statutory, governmental, or other public functions.

•The processing is in accordance with the “legitimate interests” condition.

Further information can also be found on our website using the following link

https://ico.org.uk/.../the_guide/condit ... processing

As you can see the first condition, is that the individual has given consent, if this is the case then to disclose that individuals personal data would comply with the DPA.

I hope that this information is helpful to you. If you would like to discuss this matter further please contact me on my direct number 01625 545504, or alternatively you can contact our Helpline on 0303 123 1113. In addition, more information about the Information Commissioner’s Office and the legislation we oversee is available on our website at www.ico.org.uk

Yours sincerely

Anne Hargreaves
Case Officer
Information Commissioner’s Office
0303 123 1113 ext.5504
December 9 at 8:27pm

[gaz]

... Unfortunately, CTC data protection policy even if it is legal it is in imho has been written to reduce its usefulness I wonder why. ...

CTC Data Protection Policy can be found here.

It's one of those rare documents that still mentions DAs, since the policies relating to Member Groups haven't changed since they were last issued in April 2003. If someone wrote it "to reduce its usefulness" then there have been 12 1/2 years for Council to notice and to sort it out.

Use of Data
...
Member Groups and other legitimate users only may use the membership information provided to them to carry out the functions of the Member Groups. This includes contacting members to convey to them information about CTC or Member Group activities. Information must not be used for any other purpose whatsoever.

Personally I expect someone wrote it to prevent member's data being misused. It could certainly do with an overhaul to reflect 21C technology.

[Psamathe]

...
That form is irrelevant for specifying what forms of contact are allowable under DPA. It's buried too deep and you are not automatically taken there as part of your sign up acceptances. It also only applies to members who have a CTC website login, not all members.

I work for a large organisation and we are very clear on what mailings we can and can't legally do within the DPA. Personal information such as email addresses can only be used for the purposes for which it was given. If it is collected on subscription and there is no explanation of what it will be used for then it can only be used for corporate communications, not for individuals or third parties to send personal emails to you. That's why we always have all those boxes to tick on websites about communications from selected third parties - because the DPA requires that we give our consent before our email can be used in that way. So I don't see a case for it being called censorship; unless you call complying with the law censorship.

I had always regarded the CTC Councillors as part of the CTC.

Ian

That is untrue

...

I think that the Data Protection Act is not central to the problem originally raised. The CTC employees might feel or have procedures that do not allow them to pass contact details on to Councillors. However, they could still distribute e-mails to members on behalf of those Councillors. If they are not prepared to distribute messages that question the policy being pursued by the CTC employees then they are pretty unlikely to change their Data Protection procedures to allow them to pass contact details to those same Councillors they are denying mail forwarding to.

So, given that CTC employees are preventing Councillors from distributing info to CTC membership, limited options exist. The failure to distribute messages could be contested at e.g. the AGM or with whoever hires and fires e.g. the CEO. Informal e-mail lists could be collected through e.g. member groups (as discussed above), plus probably other options I can't think of.

Ian

[Philip Benstead]

Ian wrote

I think that the Data Protection Act is not central to the problem originally raised. The CTC employees might feel or have procedures that do not allow them to pass contact details on to Councillors. However, they could still distribute e-mails to members on behalf of those Councillors. If they are not prepared to distribute messages that question the policy being pursued by the CTC employees then they are pretty unlikely to change their Data Protection procedures to allow them to pass contact details to those same Councillors they are denying mail forwarding to.

So, given that CTC employees are preventing Councillors from distributing info to CTC membership, limited options exist.

The failure to distribute messages could be contested at e.g. the AGM or with whoever hires and fires e.g. the CEO "YOU ARE HAVING A JOKE"?


Informal e-mail lists could be collected through e.g. member groups (as discussed above), YES I WILL BE SETTING UP A SYSTEM IN DUE COURSE


BTW There is a updated DP policy 2007 that was update and according to the word of the CTC DP Office there only minor changes.

The power that be at the CTC he now considers CTC councillors not as representative of CTC members in their area but merely advisor who can rubber stamp policy made by the staff in the leadership team.

There is going to be a new role called ambassadors who will go round to member groups to protect CTC policy, but they will have no role in the formation of the policy.

[gaz]

The above linked policy does have later updates, including 2007, but these are shown as being relevant to the website rather than MGs.

[TonyR]

Informal e-mail lists could be collected through e.g. member groups (as discussed above), YES I WILL BE SETTING UP A SYSTEM IN DUE COURSE

I would be very careful doing that. Remember that members have to have given explicit consent to you collecting and using their personal information for the purpose for which you intend. It is no more legal for you to collect and use them without consent than it is for a spammer to do so. Also you should not be encouraging the member groups to misuse the personal data they have collected or been given by HQ.

You might think it informal and minor but some people are very sensitive about the use of their personal data and the law does have teeth if they complain about a mailing.

[TonyR]

I think that the Data Protection Act is not central to the problem originally raised. The CTC employees might feel or have procedures that do not allow them to pass contact details on to Councillors. However, they could still distribute e-mails to members on behalf of those Councillors.

It is very central. They cannot send out emails on behalf of anyone that are not consistent with the purposes for which the email addresses were specifically given. The proposed message is not about membership or member benefits. It's the communication of a personal opinion on the organisation's policies and it makes no difference whether Philip sends it or CTC sends it for him - it would be against the DPA.

I have the feeling that Philip knows this which is why he asked the ICO three weeks ago.

[Philip Benstead]

... Unfortunately, CTC data protection policy even if it is legal it is in imho has been written to reduce its usefulness I wonder why. ...

CTC Data Protection Policy can be found here.

It's one of those rare documents that still mentions DAs, since the policies relating to Member Groups haven't changed since they were last issued in April 2003. If someone wrote it "to reduce its usefulness" then there have been 12 1/2 years for Council to notice and to sort it out.

I tried to get CTC Data Protection policy update to make it useful so that the CTC Right to Ride campaigners could receive the contact details of other R2R members in their area (as stated in the CTC R2R agreement updated on 2014) also for the sending of list of CTC officer contact details to be sent to interest parties,

But I was hindered at all step along this journey by the CTC data protection officer.

[TonyR]

But I was hindered at all step along this journey by the CTC data protection officer.

ITYM you were hindered by the law. The CTC DPO is just doing their job in telling you what the CTC can and can't do within the law.

Given that "The formal status of Councillors is that they are directors of a limited company and charity trustees and therefore have these duties and responsibilities." I would suggest you get yourself some training or professional legal advice on the rights and responsibilities of a Director and Corporate Governance. As a Director you can be help personally criniminally liable for breaching the DPA or causing your organisation to breach it.

The DPA may be frustrating to you but it's there for a good reason.

[gaz]

I have the feeling that Phillip knows this which is why he asked the ICO three weeks ago.

MY QUESTION TO THE DATE PROTECTION COMMISSION
...
THE REPLY

27 November 2014
...

A bit more than three weeks ago.

[TonyR]

I have the feeling that Phillip knows this which is why he asked the ICO three weeks ago.

MY QUESTION TO THE DATE PROTECTION COMMISSION
...
THE REPLY

27 November 2014
...

A bit more than three weeks ago.

You're right - I assumed 2015.

[Philip Benstead]

But I was hindered at all step along this journey by the CTC data protection officer.

ITYM you were hindered by the law. The CTC DPO is just doing their job in telling you what the CTC can and can't do within the law.

Given that "The formal status of Councillors is that they are directors of a limited company and charity trustees and therefore have these duties and responsibilities." I would suggest you get yourself some training or professional legal advice on the rights and responsibilities of a Director and Corporate Governance. As a Director you can be help personally criniminally liable for breaching the DPA or causing your organisation to breach it.

The DPA may be frustrating to you but it's there for a good reason.

Please read the letter from Information Commissioners Office, it confirms that you can contact CTC members.
Many members receive Cycleclips what counts have you asked their permission.
Under existing CTC policy, CTC right to ride representatives should be supplied with contact detail of other local CTC right to ride representatives but are refused.
Also contact details of CTC Right on Ride representatives on website are that of CTC headquarters. It is all about controlling of levers of communication.
CTC staff appear not to trust the volunteer network.

[gaz]

Please read the letter from Information Commissioners Office, it confirms that you can contact CTC members.

No one is suggesting that you cannot contact CTC members. Simply that you can only contact CTC members with approved communications. As mentioned above communications critical of CTC policy are unlikely to be approved, that's why they can't be sent.

Many members receive Cycleclips what counts have you asked their permission.

I'm sure that CTC has obtained permission, I presume there is a DP statement within the membership application process. I've certainly managed to opt out (a somewhat trying experience but I'm assured that the underlying issues that made it difficult for me have now been fixed).

Under existing CTC policy, CTC right to ride representatives should be supplied with contact detail of other local CTC right to ride representatives but are refused.
Also contact details of CTC Right on Ride representatives on website are that of CTC headquarters. It is all about controlling of levers of communication.

Having checked one of my local RtR reps record on the CTC website (Paul Harper) his own e-mail is given. At a guess it is a matter of personal choice of the RtR rep concerned, not everyone would want to give out their details for publication.

Incidentally Paul launched a local cycle forum last year. Part of the launch was an e-mail from CTC (to consenting local members) advising Paul's contact information and details of the date, time and location of the meeting.

CTC staff appear not to trust the volunteer network.

Having received a very small number of e-mails from members of the "volunteer network" who have neglected to use bcc, I'd say that they are right to be wary of how data is being handled outside of National Office. As expressed above IMO the policy needs an overhaul. I doubt that many member e-mail lists are held solely on a MG secretary's PC in their own home, more likely is that they are on a contact list held on a server belonging to their email service provider, some may even be accessed on mobile devices during a club ride .

[Philip Benstead]

Please read the letter from Information Commissioners Office, it confirms that you can contact CTC members.

No one is suggesting that you cannot contact CTC members. Simply that you can only contact CTC members with approved communications. As mentioned above communications critical of CTC policy are unlikely to be approved, that's why they can't be sent.

Many members receive Cycleclips what counts have you asked their permission.

I'm sure that CTC has obtained permission, I presume there is a DP statement within the membership application process. I've certainly managed to opt out (a somewhat trying experience but I'm assured that the underlying issues that made it difficult for me have now been fixed).

Under existing CTC policy, CTC right to ride representatives should be supplied with contact detail of other local CTC right to ride representatives but are refused.
Also contact details of CTC Right on Ride representatives on website are that of CTC headquarters. It is all about controlling of levers of communication.

Having checked one of my local RtR reps record on the CTC website (Paul Harper) his own e-mail is given. At a guess it is a matter of personal choice of the RtR rep concerned, not everyone would want to give out their details for publication.

Yes but I had to ask for my contact details to be put on , it just CTC HQ do not ask it about control.

Incidentally Paul launched a local cycle forum last year. Part of the launch was an e-mail from CTC (to consenting local members) advising Paul's contact information and details of the date, time and location of the meeting.

CTC staff appear not to trust the volunteer network.

Having received a very small number of e-mails from members of the "volunteer network" who have neglected to use bcc, I'd say that they are right to be wary of how data is being handled outside of National Office. As expressed above IMO the policy needs an overhaul.

Yes I agree, but it need to fit for purpose.

CTC Councillor are your representatives (not delegates) they need to communicate with you, they can’t.
There are proposals for the council to go down to 12 and that you will have to be approved by a nomination committee where Councillor may be in a minority.
The CTC is moving from a Membership lead charity to executive lead charity.

BTW
There appear to be misunderstanding in regard CTC income.
CTC total income is around £4,000,000 of which £1,200,000 is from subscription.
The majority of income is restrictive which mean money in money with only small amount obtain from recovery cost.

I doubt that many member e-mail lists are held solely on a MG secretary's PC in their own home, more likely is that they are on a contact list held on a server belonging to their email service provider, some may even be accessed on mobile devices during a club ride .

That would be large numbers of names and given the list is always changing what would be the point.
You must differentiate a list of your club mate who are ctc members who may have given you their contact details and ctc member you do not know.
Also they have sign a agreement not to do that.

[gaz]

It would seem that Philip has managed to get a message out via NO, albeit more of a farewell than an outright critique:

Dear .,


This email is reproduced as supplied by Philip Benstead the outgoing Councillor for the South East region:



Philip Benstead - au revoir pour le moment

My fellow Cyclists’ Touring Club members and friends. Over the last three years of this term as Councillor for the southeast England region I have tried to contribute to the wellbeing of the Club. My aim was to promote use of the cycle for pleasure /touring and utility /transport. It is my firm believe that the CTC should in its current guise can still be an Independent, democratic membership lead Membership Charity, but some see our future differently. Moving toward “quangoization”. Our prime aim should be make our existing activities more attractive and to promote them via social media. That is not to say we should not be innovative. I have tried to encourage the CTC to continual to support and develop communications to promote the activities of our local group and campaign network by making intra communication easer, with little success. We need to put in place policies that encourages membership involvement in policy making at national level.

I hope the new Councillors some who have joined in 2015 unfamiliarity with the CTC is not too much of hindered, but I do hope members will contact them directly if you have any concern.

Many thanks for all have vote for me in this and other elections.

I will be back

Philip Benstead

Telephone and email were included, not mine to share.