GDPR: is Helga prepared?

[jover]

As of May 25th 2018, the EU General Data Protection Regulation (GDPR) will take effect.

Is Helga prepared for this?
Which steps have been taken already?
How will Helga cooperate with partners (like VVO & FRSO for example) who are giving access to the members database publicly?

[rma]

I am not a lawyer !

From the link you mentiion, I can read

Who does the GDPR affect?
The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects.
...
What constitutes personal data?
Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

About the Helga files, they are directly donwloaded from the FRSO and VVO databases, but strictly limited to the basis ID's to allow their handling in Orienteering,
i.e. Name, Firstname, Gender, Year of birth, Nationality, Club, E-card number if any

That means only the sport datas that the competitor himself indicates when registering his license.

If a specialist can give further explanations, or help, he is welcome

[mho]

Indeed, if any lawyer within our sports family can give advice..

Anyway, HELGA can perfectly update its database offline, meaning any user can put the latest update file into the HELGA folder, and the database will be updated (if FRSO/VVO decide to close down the anonymous download).

[jover]

I'm not a lawyer either Just interested in the topic and how Helga can/will tackle this.

But basically, it comes down to this (AFAIK):
- "Hi Helga, I'm person X and I want to know what do you know/store about me"
- "Hi Helga, I'm person X and I want you to forget/delete everything you know about me"

In case Helga retrieves such a question, Helga must:
- Find a way to know that person X really is person X (so person X is the one he/she says he/she is) - So person X must identify him-/herself (using copy of ID-card?)
- Find a way to query all details about this person X in any datasource Helga maintains

The fact that those data are private or publicly available doesn't really matter AFAIK.
Although, it's not clear to me what this means for data which is considered open data, like results for example.
Besides that, Helga software currently uses an Access database, but these are initially maintained and stored on other servers (e.g. like on VVO-website).
So I guess that's not Helga's problem anymore.

[rma]

... but these are initially maintained and stored on other servers (e.g. like on VVO-website).

Similar for FRSO, FRSO, etc ...

After some explanation to a lawyer inside my club, I receive (and don't translate)
"à mon avis cela doit se solder par une simple privacy notice à l’inscription (sur place) ou lors de la demande de licence de coureur etc. "

In case Helga retrieves such a question, Helga must:
- Find a way to know that person X really is person X (so person X is the one he/she says he/she is) - So person X must identify him-/herself (using copy of ID-card?)

No specific other data than Name, Firstname, Nationality, Year of Birth, Gender and E-card are known by Helga.

- Find a way to query all details about this person X in any datasource Helga maintains

Deleting a runner in MY database will delete him for any competition in MY CURRENT database
If mandatory, we also can cancel any result of this runner on WebRes by deleting him

My summary : I think that there is not a problem to be examined by HELGA, but well by the Secretary Offices of liga's or countries

[jover]

OK, so Helga is kind of prepared for May 25th 2018
Thanks!