This afternoon the Football Club sent an email to a database of season ticket holders indicating that, unless they specifically and personally replied by Wednesday 7th December to “opt-out” they would be passing on their personal details to the PTFC Trust.
We have a number of urgent observations to make about this.
Concerns about GDPR compliance
Firstly, we have concerns about whether this approach is GDPR compliant. When season ticket holders signed-up and provided the Club with their personal details, they did not consent to those details being passed on to the Trust, or to other third parties.
It is our view, and we had assumed it was also the view of the Trust, that fresh consent needed to be sought from each and every season-ticket holder, and that the consent had to be proactively given.
We had assumed this was part of the reason for the delay in seeking beneficiaries data.
An opt-out system is one in which those who do not see an email, or whose email address was incorrectly transcribed (for example) will nevertheless have their (other) personal data passed onto the Trust by omission. We think this is both legally and ethically questionable.
Practical problems opting out
Secondly, we notice that the email “sender” and “reply to” address is not one controlled by the Club. If individuals simply “reply” to the email that was sent to them, the reply will not in fact go to the Club. We are aware that this has been a problem with this email address for some considerable time and have previously drawn it to the Club’s attention. This issue has not been addressed.
These two factors compound to create an invidious position whereby many people who actively seek to opt-out may in fact find that their details get passed to the Trust against their wishes.
Lack of trust in this process
Thirdly, we would observe that we (TJF) had intended to encourage our members to provide their information to the PTFC Trust, but to do so “under protest” and purely for the purposes of preserving any rights they might have as beneficiaries in trustee elections. Given the botched way in which this exercise is now being conducted, however, we cannot now recommend that at this stage.
We would therefore encourage all of our members, and indeed all other fans, who have received this email, to contact gerry.britton@ptfc.co.uk to make clear, in explicit terms, that they do not consent to the sharing of their personal information in the manner proposed.