BRS and GDPR

monkeybutter · 20-04-2023 11:59pm

Have you ever tried to withdraw your consent for use in a system

Or are you all talk

If you withdraw consent for your name to be used in the booking system you won't have access to the booking system

awec · 21-04-2023 12:59am

https://www.boards.ie/discussion/comment/120501938#Comment_120501938

Sharing of information is not intrinsic to making a booking.

Yes it is. Other people need to see when you've booked.

https://www.boards.ie/discussion/comment/120501947#Comment_120501947

And no, I don’t play golf,

We can tell.

The whole point of the booking system is to be able to pick a time and people to play with. Can you tell us how you would pick who you play with if all the names are anonymised? As I told you earlier, a booking system that didn't show names would be absolutely useless.

There is a valid, legitimate reason to display the names. No GDPR issue here, since the purpose of GDPR is not to stop legitimate uses of personal information (of which this is one).

AndrewJRenko · 21-04-2023 7:22am

https://www.boards.ie/discussion/comment/120501985#Comment_120501985

If you don’t understand the six lawful bases of processing under GDPR, you might want to stop making claims about it.

AndrewJRenko · 21-04-2023 7:23am

https://www.boards.ie/discussion/comment/120501988#Comment_120501988

Don’t make me point to the “no negative consequences” sign again.

AndrewJRenko · 21-04-2023 7:26am

https://www.boards.ie/discussion/comment/120502085#Comment_120502085

Is that really the whole point of the booking system? Do people not arrange their golf partners off the system, by sharing information with those that they choose to share with?

If I decide that I need to see who’s travelling on my bus or train or plane, is it okay for the transport operator to share the full passenger manifest with me?

That’s a want, not a need. Those who don’t want to share their personal must be able to book their sessions without exposing their personal information, with “no negative consequences” .

AndrewJRenko · 21-04-2023 7:33am

Just searched for golf club privacy and found this example

https://www.corrstowngolfclub.com/privacy

“information stored in the Members' Area/Club App will be available for other members ie. Member name and current handicap. You can withdraw your consent to this use of your information at any time by contacting us; “

So handicap is shared, but no mention of sharing bookings. They’d want to be sure that they have explicit consent for this sharing, not just a default assumption buried in the terms and conditions.

Seve OB · 21-04-2023 9:12am

https://www.boards.ie/discussion/comment/120502256#Comment_120502256

You’ll probably find they share phone numbers also. We all signed something to say it was ok.

stop stirring

awec · 21-04-2023 9:33am

https://www.boards.ie/discussion/comment/120502246#Comment_120502246

I think it's fairly clear you don't understand the system and what it's purpose is.

No, people don't always arrange their golf partners off the system. Often it has to be arranged on the system.

If I want to play tomorrow, I'd look at the times available. I'd avoid the time that currently has the 3 70 year old women in it, cause I don't want to be going round with them. I'd avoid the time that has the 3 lads who are all very low handicap and take their round very seriously, cause that's not the round I'm after. I might pick the slot that has the guy I vaguely know. I might not pick the 2:10 slot, cause I see Jim SlowPlay and his mates have booked the 2:00 slot.

A booking system without names would be absurd and useless.

AndrewJRenko · 21-04-2023 9:41am

https://www.boards.ie/discussion/comment/120502475#Comment_120502475

And what happens when a member withdraws that consent?

AndrewJRenko · 21-04-2023 9:48am

https://www.boards.ie/discussion/comment/120502543#Comment_120502543

So you’re saying that the value of sharing names on the booking systems relies on the member having intimate knowledge of ALL members, knowing their ages, genders and their playing styles? This would seem like a fairly unlikely scenario, unless there’s only 40 or 50 members in the club.

But let’s say that is the case, for sake of discussion. What’s the club’s approach to ensure that a member can withdraw their consent with no negative consequences? So that member needs to still be able to book their own slots on the course, with the same access to bookings as all other members. How’s that going to happen?

thejaguar · 21-04-2023 10:04am

https://www.boards.ie/discussion/comment/120502236#Comment_120502236

As you rightly point out, consent is not the only lawful basis for processing personal data. Unless I've missed something, there's nothing to suggest that consent is being relied on in this case. Nor is there enough information to make a decision on what basis is appropriate - consent or otherwise.

To the original poster I would say - if you're interested - take a look at the terms of your membership, the privacy policy of your club, or reach out to the club and ask the question. I don't think it's unreasonable to ask, they should have considered it, but may not have.

awec · 21-04-2023 10:24am

https://www.boards.ie/discussion/comment/120502589#Comment_120502589

Once you join a club you'll quickly build up a knowledge of who people are and how good they are. That's not to say you know them all as friends, or indeed that you'll have ever spoken to them, but you do know who they are, roughly what age they are and you'll know how they play.

The social connections are a part of joining a golf club after all.

RoadRunner · 21-04-2023 10:59am

It's a rule of golf to have your name on the scorecard and sign your partners card. Having the name of golfers recorded alongside their allotted timeslot is a minimum requirement of a golf booking system.

The booking system could easily have the ability for a false or place holder name to be entered for a person to de-identify them. That incognito person wouldn't be able to enter or play competitions under those conditions I imagine. I also don't think they could be handicapped and as such would be a kind of separate member to regular.

Speaking personally I wouldn't be happy arriving on the first tee to meet a playing partner wearing a balaclava to conceal their identity. I wouldn't be happy with the club to allow this either. I think there would need to be special provisions made so that an incognito member can play at certain times separate to regular competitions and other members, but there's plenty of reasons why this is impractical.

coillcam · 21-04-2023 11:05am

https://www.boards.ie/discussion/comment/120502589#Comment_120502589

There's no negative consequence, you can call the golf club during business hours and very reasonably get a slot on the system as "Mr/Ms ABC". I asked you earlier to give an example of a negative or detrimental effect. You've still to provide one. Also think about how would you then ensure the consent of your fellow "hidden" golf buddies when you want to book alongside them? To be fair, if you knew more about how the BRS or golf clubs work you'd likely not be debating of negative effects.

I asked someone who's been in the golf world a long time about all of this and they said it'd be a disaster if names were hidden. A simple reason he gave is that most women won't play alongside men and vice versa unless related/married. The rest of the membership would complain endlessly if member names were hidden. Also if you needed to contact someone for an emergency, having to chase the club's BRS administrator for a name would be less than ideal and could the admin then rightfully even try to contact your playing partner to locate you? You can see where this is going. Various other operational reasons were given but displaying the name is about as basic as a legit use case can be.

I'm going to let this discussion go now. I still don't think you fully grasp the legitimate use case and application of consent relative to GDPR against TnCs. You also fail in providing a single negative/detrimental effect for a person who refuses to use the system citing their privacy concerns. Regardless I still enjoyed your contributions and debate. It's healthy to see a different POV. In this instance, particularly from someone who's not a golfer and doesn't have skin in the game.

monkeybutter · 21-04-2023 11:07am

https://www.boards.ie/discussion/comment/120502236#Comment_120502236

have you done any of this or are you just a googler?

A bit of googling

https://gdpr.eu/gdpr-consent-requirements/#:~:text=According%20to%20Recital%2042%2C%20%E2%80%9CConsent,provide%20them%20with%20your%20service.

Consent must be freely given

“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

The one exception is if you need some piece of data from someone to provide them with your service. For example, you may need their credit card information to process a transaction or their mailing address to ship a product.

say you sign up for something that requires you phone number to stop spoofers, you can't remove consent for this to be used after the fact and still use the system

its fairly simple

you can't remove consent for your name to be used and still use the booking system

its basically to stop freeman of the land idiot types 😆

i never signed a contract!!!!!

the negative consequences thing is to cover the likes of refusing marketing refuse service

BENDYBINN · 21-04-2023 11:08am

https://www.boards.ie/discussion/comment/120502727#Comment_120502727

Why does four golfers who play a friendly round at 10 o clock on a Monday morning need to tell all a sundry that they are on the golf course?

Bar the administration of the club it’s nobody’s business but their own.

monkeybutter · 21-04-2023 11:12am

https://www.boards.ie/discussion/comment/120502892#Comment_120502892

so that I don't turn up and tell you no, i booked 10 o clock on monday, not you

now the real question is what else are you hiding from your wife

coillcam · 21-04-2023 11:21am

https://www.boards.ie/discussion/comment/120502256#Comment_120502256

Last post but the member's area is typically a different software system to the BRS/booking. In ours, some people and juniors revoked consent so you can't see their name/scores/handicap on results. You also need to add them as a buddy and be accepted to view certain info even if they were public. If a hidden user wins a prize their name and score WILL be listed on results pages publicly, however. This is non-negotiable.

There's absolutely no detrimental/negative effect in this scenario when you withdraw consent. I think it's somewhat meh but still a fairly reasonable application of GDPR.

BENDYBINN · 21-04-2023 12:42pm

Local community alert guard tells us never to share on social media when we are on holidays or away from our property. This info can get into the wrong hands he says.

I can tell everyone now Richie Rich the local millionaire bachelor is on the golf course 2 o'clock Saturday.

bakerbhoy · 21-04-2023 12:48pm

But where are Randolph and Daisy, his loyal dobermans.

awec · 21-04-2023 1:29pm

https://www.boards.ie/discussion/comment/120503304#Comment_120503304

Still not a GDPR issue.

AndrewJRenko · 21-04-2023 4:45pm

https://www.boards.ie/discussion/comment/120502727#Comment_120502727

Yes, I’m sure the social connections are part of the club, and I’m sure that some people will know some other members by name, but is it really credible that most members will know most other members, and their gender, and their handicap, and their playing style, by name?

https://www.boards.ie/discussion/comment/120502880#Comment_120502880

Sorry, but you’ve outlined one fairly obvious negative consequence yourself in your first sentence - that a member who wishes to remain anonymous can only book when someone is available to answer the phone within business hours, while other members can book 24x7. That is absolutely a negative consequence for members who withhold or withdraw consent.

If you want to book alongside your buddies, you can ask them outside of the booking system about their golf plans, and make your booking accordingly. They can choose who they share this information with, and when it is shared, given them far greater control that the system automatically sharing their information with everyone.

https://www.boards.ie/discussion/comment/120502885#Comment_120502885

I’m not talking about withdrawing consent for a previous booking. I’m talking about a member, who decides today, maybe because he’s just separated from the missus, who is also a member, that he doesn’t want to share his booking information with other members. That member needs to be able to continue to book to play golf with no negative consequences for withdrawing his consent. He needs to be able to book sessions, just like other players book their sessions.

https://www.boards.ie/discussion/comment/120502903#Comment_120502903

Just to be clear, to solve that problem, member A doesn’t need to know that member B is booked on Monday at 10 am. He just needs to know that the course is booked on Monday at 10am. The system should be able to show that the slot is booked without showing who booked it to everyone.

https://www.boards.ie/discussion/comment/120502938#Comment_120502938

A facility to ‘add a buddy’ is a great way to control sharing of information, so presumably, you allow your buddies to see your bookings, but you don’t allow everyone to see your bookings. That’s a good solution, but it doesn’t seem to cover the scenario outlined by the OP

monkeybutter · 21-04-2023 4:57pm

https://www.boards.ie/discussion/comment/120504335#Comment_120504335

it has nothing to do with withdrawing consent for a previous bookings

where did you get that from

they don't have to be able to play golf after they withdraw consent, that's clearly stated

you can't withdraw consent to process you name in one way and leave it for another way, in the same way as you can't withdraw consent for them to use your credit card details and still expect to be able to book something

just like you can't chose to have you picture removed from you passport and it still to function

or at work to stop people being able to see if you are online

AndrewJRenko · 22-04-2023 9:50am

https://www.boards.ie/discussion/comment/120504375#Comment_120504375

So if you withdraw consent to sharing your data with other players, you can’t play - is that your position?

Trampas · 22-04-2023 10:15am

What legal background do you work in as you seem to be an expert in it

AndrewJRenko · 22-04-2023 11:46am

https://www.boards.ie/discussion/comment/120506819#Comment_120506819

No legal background, I build the systems that manage this data. Well, not for golf clubs, but in other areas. I’ve worked closely with DPOs and with very expensive lawyers on GDPR matters.

So I wouldn’t claim to be an expert, but I’ve a good working knowledge.

slave1 · 22-04-2023 1:19pm

Well this one has grown arms and legs, OP I think there's been plenty of debate and we're going in circles.

This is not a Legal Forum and the thread has constantly being derailed into legalities of GDPR, so feel free to take this debate to either a Legal Forum or PM.

Thread closed.

BRS and GDPR

Comments

Consent must be freely given