On Fri, Aug 10, 2018 at 11:12:09AM +0100, Matthew Vernon wrote: > On 10/08/18 09:28, Jonathan McDowell wrote: > > > Legitimate interest should be a suitable basis for processing such > > information; it sounds like a reasonable chunk of the funding for > > DebConf was conditional on these government funds, so in order to run > > the conference it's required to hand the details over. However this is > > something that should have been made apparent to attendees up front, so > > they could make an informed decision about whether to attend or not. > > DebConf team, please note this for future DebConfs. > > I think we should be telling people in advance how we will use their > personal data. Even if this is legally OK, I think some Debconf > attenders will be (not unreasonably) unhappy about their data being used > like this without their consent.
For the avoidance of doubt I think we're in full agreement here. *If* we had informed people up front before registration there wouldn't be an issue with legitimate interest as a justification but because we haven't we should be contacting attendees before sharing their information. J. -- I'm dangerous when I know what I'm doing. This .sig brought to you by the letter I and the number 40 Product of the Republic of HuggieTag
