Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Newsletters for clubs
For many clubs and associations, email is the most important line to their members: dates, invitations to the general meeting, reports from the sections. Then there are often people who are not members – parents, supporters, spectators, interested parties. This page sets side by side what the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information (LfDI) says in his guidance “Datenschutz im Verein nach der Datenschutzgrundverordnung (DS-GVO)” (data protection in clubs under the GDPR, as of 24 June 2020), what the German Data Protection Conference (Datenschutzkonferenz, DSK) says and what the laws say about these groups – verbatim, without our own classification. It describes the situation in Germany.
The GDPR and clubs: what the guidance says
Quotations from German laws, court rulings and authority papers are our working translations; only the German wording is authoritative (see the German version of this page). The Baden-Württemberg guidance writes in section 1.1:
“If a club (association) processes personal data of its members and other persons wholly or partly by automated means, or if personal data that are stored or are to be stored in a filing system are processed by non-automated means, its scope is opened under Art. 2(1) GDPR.
It is irrelevant whether the club is entered in the register of associations and thus has its own legal personality, or whether it is an unincorporated association.” (our translation)
— LfDI Baden-Württemberg, Datenschutz im Verein, section 1.1
Among personal data it lists, for example, “marital status, number of children, occupation, telephone number, email address, postal address” (our translation; section 1.2).
Mailings to your own members: two authority texts side by side
LfDI Baden-Württemberg: “On the basis of Art. 6(1)(b) GDPR, when someone joins the club (application for membership or declaration of accession) and during membership, a club may only collect such data from members as are necessary for establishing and carrying out the quasi-contractual obligation that arises between member and club through joining. This means that all data may be collected that are necessary for pursuing the club’s aims and for looking after and administering the members (such as name, address, as a rule also date of birth, as well as bank details, bank sort code and account number).” (our translation; section 2.1)
LfDI Baden-Württemberg: “The club may use the data of its club members only for appeals for donations and for advertising to achieve the club’s own aims (Art. 6(1)(b) GDPR). The use of member data for advertising by third parties is, as a rule, not permitted without the members’ consent (see no. 1.3.4 above).” (our translation; section 4.3)
Data Protection Conference: “On the other hand, advertising is also contact made by parties, associations and clubs or charitable and social organisations with data subjects in order to make their aims known or to promote them (on advertising by political parties see, for example, Federal Constitutional Court order of 1 August 2002, 2 BvR 2135/01).” (our translation; guidance on direct marketing, February 2022, section 1.1, p. 3)
Whether invitations, dates and club news sent to members by email belong to “looking after and administering the members” within the meaning of the Baden-Württemberg guidance or fall under the DSK’s concept of advertising is not expressly answered by the two texts.
The classification under competition law also remains open. Section 7(1) sentence 1 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) reads: “A commercial practice by which a market participant is unacceptably harassed is not permitted.” (our translation; Section 7(1) UWG) Under the Act, a commercial practice is “any conduct by a person for the benefit of their own or another business before, during or after the conclusion of a transaction which is directly and objectively connected with promoting the sale or purchase of goods or services or with the conclusion or performance of a contract concerning goods or services” (our translation; Section 2(1) no. 2 UWG). Whether a club mailing is a commercial practice in this sense is not expressly answered by the Act.
Newsletters to non-members
For data of people who are not members, the Baden-Württemberg guidance writes:
“Data of third parties known to the club, for example of people who regularly buy tickets for matches, may be used by the club for advertising purposes if they have either consented to this (see no. 1.3.4 above) or the club has a legitimate interest in using them for advertising purposes and no interests or fundamental rights of the third party prevail (Art. 6(1)(f) GDPR). […] Telephone advertising to third parties is not permitted without the express consent of the person concerned, nor, as a rule, is email advertising.” (our translation)
— LfDI Baden-Württemberg, Datenschutz im Verein, section 4.3
How a sign-up procedure with a confirmation email works and what Germany’s Federal Court of Justice has said about it is on the page Consent and double opt-in; on unsubscribing see Unsubscribing.
No open distribution list
A common mistake in everyday club life: the circular goes from the normal mailbox to all members, with all addresses in the “To” or “CC” field. Every recipient then sees all the other addresses – and can reuse the list.
Common approaches:
- Blind copy (BCC) for all recipients if you stay with the normal mailbox – and check every time which field the addresses are in,
- a mailing list or a sending platform where recipients cannot see the others’ addresses and can unsubscribe themselves.
On service providers, the Baden-Württemberg guidance writes: “The club may also commission a company to carry out such advertising measures with the help of the data that the club makes accessible to it as part of commissioned data processing (see no. 3.2 above). The commissioned company must be obliged not to use either the data provided by the club or the data collected during the advertising campaign for its own purposes – in particular for advertising campaigns for third parties – and to return all data completely to the club after the end of the campaign.” (our translation; section 4.3) And elsewhere: “Using the services of the post office (letter mail) or of the operator of a mail server (when sending emails) does not give rise to commissioned data processing.” (our translation; section 3.2)
Art. 28(3) sentence 1 GDPR begins: “Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller […]” (Art. 28(3) GDPR). Whether a particular newsletter sending platform acts as a processor is not expressly answered by the texts quoted.
Unsubscribing and objection
The GDPR says: “Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing […]” (Art. 21(2) GDPR) and: “At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.” (Art. 21(4) GDPR)
From practice: some clubs separate club information such as the invitation to the general meeting from a voluntary newsletter with reports and appeals for donations. A member can then unsubscribe from the newsletter and still receive the invitation to the meeting.
Children and young people
Many clubs have members who are minors. The Baden-Württemberg guidance writes on consent:
“Outside Art. 8 GDPR (this provision applies only in connection with child-oriented telemedia, such as online shops and games aimed at children), the GDPR does not recognise a fixed age limit for the capacity to consent. Children and young people can therefore consent to the processing of their personal data themselves if they are able to understand the consequences of the use of their data and can therefore also express themselves on it in a binding manner. What matters is the respective context in which the data are used and the degree of maturity or life experience of the person concerned. For children under 13 it must as a rule be assumed that they cannot understand the consequences of the use of their data. If the capacity for insight is to be denied, the processing of their personal data is only permitted with the consent of the person with parental custody.” (our translation)
— LfDI Baden-Württemberg, Datenschutz im Verein, section 1.3.4
On balancing under Art. 6(1)(f) GDPR it says: “For children under 16, the interests of the child worthy of protection regularly prevail here; between the ages of 16 and 18, on the other hand, a balancing with other interests can take place.” (our translation; section 2.1)
Art. 8(1) subpara. 1 GDPR reads: “Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.” (Art. 8(1) GDPR)
Whether a club newsletter is an offer of information society services within the meaning of Art. 8 GDPR is not expressly answered by the texts quoted.