Sign up to receive PTA+ newsletters and we’ll
with. Other acceptable forms of consent include: A tick box or yes/no option on a donation form. An individual supplying their contact details on a form or online, where it has been made clear they are doing so in order to receive direct marketing from the PTA. Orally or by a clear action, e.g. an individual handing over a business card and making it plain they want to hear more from you. Whatever the case, the opt-in
needs to be separate from any other action, and individuals need to have consciously given consent based on explicit information. Silence or pre-ticked boxes are not valid, nor is the assumption that people are happy to be contacted unless they have opted out.
Withdrawing consent People’s preferences change over time, so it needs to be easy for your supporters to withdraw their consent or change communication choices whenever they wish. Let your supporters know how they can do this – for example, they may need to email a certain phrase to your PTA’s email address. Be realistic about the amount of paperwork you can cope with versus compliance with GDPR. As schools usually send out data information sheets once per year, it is perfectly viable that your PTA does the same. Bear in mind that you will also need to manage and
maintain a ‘suppressed contacts’ list of people who have opted out of receiving PTA communications.
let you know as further GDPR guidance becomes available. Go to
pta.co.uk/sign-up.
Third parties necessary to input personal data into a third-party website, e.g. loading email addresses into Eventbrite. You cannot disclose data to a third party without consent, so you can only do this if the individuals were aware – at the point of collection – that their data would be used in this way.
Contacting supporters – legitimate interest Aside from obtaining consent, another way you can legally send out direct marketing is via ‘legitimate interest’. This only applies to an addressed letter (for example, to ‘Mrs Brown’ or ‘The parents of Jane Smith’) or a phone call. This method relies on you being able to justify that the PTA has an evident legitimate interest in sending the communication, and that the individual you are contacting has a legitimate interest in hearing from the PTA. This requires you to balance your
own interests against the rights and interests of the individual – something that is particularly vulnerable group by GDPR. In cases
where you plan to contact children directly using their personal data, it is likely to be much more
interest, as they are less likely to be in a position to object to the communication than an adult. Legitimate interest should be
considered on a case-by-case basis, taking into account the reasonable expectations of the recipient. In many cases, the fact that someone is a parent at the school may be individual would not reasonably expect you to use their personal details to contact them (for example, where they have previously objected to contact or where there is no prior relationship), this would not be legitimate interest and you must not contact them. The key question to ask is, ‘if I were in their shoes, would I be surprised to receive this?’ It’s vital that you document your
interest. This will act as protection should you be challenged by the individual or regulator. You would need to show clearly documented evidence that the individual’s rights and reasonable expectations were balanced against your legitimate interest before the decision to send the communication was made. When sending communications
via legitimate interest you must give individuals the chance to opt in to receive future direct marketing.
How can you work with the school Alternatively, merging
to ensure that you’re compliant? Schools have received guidance and training on GDPR, and as the holder of highly sensitive data have to be on top of compliance. Make use of this knowledge if you are unsure of what measures to put in place. They should also be able to give you specifi c advice – with opt-in wording on letters, for example.
communications with the school is a good way to ensure you are supported. Having the school provide an additional option to accept communications from the PTA when gathering their own opt-ins is a practical way to gather initial consent. Alternatively, if the
school were to include a PTA section within their regular newsletters, this would be covered by the consent given to the school as it is their communication. If you’re unsure about
storing data for yourselves, see if it’s possible for the school to store data for you through their system.
Should we rely on consent or legitimate interest? Although GDPR doesn’t require an opt-in for all communications, the ICO and Fundraising Regulator agree that ‘consent to contact’ is the most reliable basis for direct marketing. In the case of PTAs, however, it could be argued that as all parents at the school have work of the PTA, all parents could be contacted through legitimate interest (as long as they haven’t opted out). It may, therefore, be practical to use a ‘legitimate interest’ enquiry to seek consent from individuals for them to receive
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60
