Advice for Affiliated Organisations (AOs)

UK GDPR for Liberal Democrats Affiliated Organisations (AOs)

This page contains basic information for Liberal Democrats Affiliated Organisations (AOs) to keep UK GDPR compliant.

UK GDPR
UK GDPR extends the rights of individuals to have more control over the personal data that organisations and businesses process about them and use to communicate with them. Overall, it's a good thing – it's a good liberal principle to give individuals more control over their personal data.

Communication with our Members

The most important piece of information for AOs is that we do NOT require consent to keep information about our members, and to communicate with our members. This is because a ‘contractual relationship’ is one of the legal basis for holding and using data and membership is a contractual relationship. This also applies to a fee paying Associate Member, and to former members for a reasonable period of time (see retention periods below).

You DO, however, need to get consent to communicate with a non-member in your AO.

For existing data there is a set of criteria that the Party has produced around whether or not we can keep existing email addresses (of non-members). The crucial one is that they have been sent an email in the last year which they have opened or clicked on.

If they have, keep the emails. If they haven’t you have to ask if they are willing to be continue to receive communications from you.

Getting the Rules Right

The following needs to be in place for any organisation to be ‘UK GDPR Compliant’. All AOs need to do this:

• Update Your Privacy Policy – If you are using a Fleet website, this will already be embedded in the template and linked, so no further action is needed from you. 
• Ensure you include the correct ‘Fair Processing Notices’ when gathering any personal data. You can find templates here.
• Delete old data in line with retention periods.
• Please do not use Cloud Storage services such as Dropbox, for personal data. Using it for artwork and other documents is fine, just not spreadsheets or PDFs which contain personal data.
• Have Lib Dem Members in your AO work to the Membership rules here and follow the guidance here
• Always request explicit consent if collecting any special category data, other than political opinions (and please note this racial or ethnic origin, religious or philosophical beliefs, and trade union membership).
• Report any data breaches to data.protection@libdems.org.uk
• Report any data subject requests (subject access requests, deletion / forgotten requests, etc.) to data.protection@libdems.org.uk

If you have queries on this please do get in touch via our email (aorg@libdems.org.uk). We might not know the answers but we should know someone who does!