Data protection

2 watchers
22 Oct
7:49am, 22 Oct 2024
3,525 posts
  •  
  • 0
Muttley
I did a half marathon this weekend. The results are online but they went and included every entrant's email addresses as well. I've emailed to ask them to remove the addresses but had no response. Before I chase them I just want to check that I'm correct to believe that people's emails should not be made public without their explicit consent -- yes?
22 Oct
7:52am, 22 Oct 2024
14,519 posts
  •  
  • 0
Homer
Correct
22 Oct
7:53am, 22 Oct 2024
68,486 posts
  •  
  • 0
Derby Tup
I suspect what they’ve done might be illegal under GDPR rules
22 Oct
7:56am, 22 Oct 2024
3,526 posts
  •  
  • 0
Muttley
That's what I thought. It's a cockup, surely not a deliberate act, but the lack of a prompt response is disappointing.
22 Oct
8:07am, 22 Oct 2024
68,487 posts
  •  
  • 0
Derby Tup
I guess they have a lot of email apologies to send ;-)
22 Oct
8:09am, 22 Oct 2024
4,532 posts
  •  
  • 0
Shades
I've had that from a race before, it was done as the sender didn't know how to send out a group email without disclosing the individual email addresses. We didn't get an apology but in later years they never did it again.

I was slightly annoyed as one of the entrants saw my email address, guessed it was me and emailed me asking for a lift to the race. I refused his request. 🤣
22 Oct
8:15am, 22 Oct 2024
12,186 posts
  •  
  • 0
Raemondo
If you want to be extra sure you can call the ICO, they have a luke warm line (like a hotline, but more tepid) for FOI and GDPR questions, and can probably tell you chapter and verse what the rule on that is.

They can probably also give the organisers a stern talking to, though as I don't think email addresses usually count as protected category personal information (this used to be called 'sensitive' data, and broadly speaking coincides with grounds on which it would be illegal to discriminate against someone, but doesn't include financial information, which a lot of people find surprising) the level of fine they could actually apply, if they were really bothered, would still be fairly low.

I'm not sure if GDPR puts more of an obligation on the office/commissioner to do things about beaches of data protection principles than the old DPA1998 did - I've not really kept up with it since leaving - but hopefully the organisers will react well one three realise they've messed up.
22 Oct
9:39am, 22 Oct 2024
18,167 posts
  •  
  • 0
Garfield
I'm pretty sure they're not supposed to share peoples' email addresses like that! I can double check with hubby when he gets off the phone. He knows about things like this.
22 Oct
9:46am, 22 Oct 2024
470 posts
  •  
  • 0
DaveG
If they've posted the results online with the runner's names and email addresses it's a clear breach and they have 72 hours to rectify it.

If the issue is that BCC hasn't been used when notifying people of results so you can see everyone's email address it's murkier. It's a breach if there is any sensitive information released (such as letting everyone know that you've got a medical issue). In a case like this, where people can see a list of runners from the results (and the runners expect that to be public) it's not releasing sensitive information.

It's more than just the law which needs to be considered here though. Only personal email addresses are personal data, your work email address isn't. So releasing someone's work email in this way isn't against the law. But, if a runner has a stalker who can see if they ran the race from the results it means they can find their name in the email list and suddenly they have a way of contacting them. There will be many issues where revealing email addresses isn't illegal but can still can be damaging.

I'd be pointing out to the race organisers that if they can't be trusted by runners to keep their email addresses safe, there are going to be runners who won't feel that they can take part. People who have left domestic violence, for instance, could be very troubled by this fail.
22 Oct
11:24am, 22 Oct 2024
3,404 posts
  •  
  • 0
Mushroom
I once accidentally posted a naked picture of myself to everyone in my address book.

It cost me a fortune in stamps..

[erm, sorry - as you were... ]

About This Thread

Maintained by Muttley
I did a half marathon this weekend. The results are online but they went and included every entrant's email addresses as well. I've emailed to ask them to remove the addresses but had no response. Before I chase them I just want to check that I'm correct to believe that people's emails should not be made public without their explicit consent -- yes?

Related Threads

  • advice
  • legal









Back To Top

Tag A User

To tag a user, start typing their name here:
X

Free training & racing tools for runners, cyclists, swimmers & walkers.

Fetcheveryone lets you analyse your training, find races, plot routes, chat in our forum, get advice, play games - and more! Nothing is behind a paywall, and it'll stay that way thanks to our awesome community!
Get Started
Click here to join 113,803 Fetchies!
Already a Fetchie? Sign in here