Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 5
Security – what are the requirements when paper statements of support are collected by voluntary or contracted campaigners?
As paper statements of support are normally collected in a decentralised way, the collection is often carried out by voluntary or contracted campaigners, other than the initiative organisers themselves. These campaigners should be considered as data processors and should act based on a written agreement with the representative.
An agreement with a ‘campaigner’ is therefore a controller-processor agreement within the meaning of Article 28 GDPR and needs to cover the aspects listed in that Article.
Indicatively, such an agreement in this context could contain:
- Representative’s authorisation for a campaigner to collect statements of support (and signatories’ email addresses) for a given initiative on their behalf.
- Representative’s instructions on how to address possible data protection related questions and requests from signatories/data subjects.
- Campaigner’s engagement to respect the data protection policy of the organisers and in particular to:
- collect statements of support (and signatories’ email addresses) only according to the instructions from the organisers, and only via the forms communicated to them by these organisers;
- refrain from collecting other data;
- inform signatories of the content of the initiative and on their rights according to the privacy statement;
- inform signatories that providing email addresses is only optional and does not condition their rights to support the initiative;
- store collected statements of support (and email addresses) in a safe place until their transmission to the initiative organisers;
- transfer the collected statements of support and email addresses in a secure way, e.g., by registered post or by courier and to the initiative organisers only.
- Campaigner’s confirmation that:
- he/she has read and understood the provisions of the privacy statement defined in Annex III to the Regulation on the European citizens' initiative and has familiarised himself/herself with the initiative’s content, as well as with the materials the organisers use to communicate it (website, other relevant documents or information);
- he/she is aware of his/her responsibility for the collected data.
References:
- Articles 28 and 32 of the GDPR
