This legitimate interest assessment has been compiled in order to set out the reasons why Chiltern U3A (the U3A) processes membership information.

Purpose Test

The U3A requests personal data in order to be able to register individuals for membership of the U3A. The personal data provided will also be used to communicate with members regarding the activities of the U3A and to keep members informed regarding any groups or activities that they undertake with the U3A. Members' information is shared with third party processors for the supply of its quarterly newsletter and the Third Age Trust's publication - Third Age Matters (TAM) - sent to members requesting it. The U3A also uses a third party processor for its membership management system. Gift Aid data is passed to HMRC in respect of members using this facility. Other than this the U3A does not share membership information outside the U3A.

Membership information is securely held and access is restricted to those who need to process data for membership purposes. Storage and processing of membership data is done in line with GDPR and safeguarding requirements. The U3A operates with a data protection policy and privacy statement and has sought advice from the Third Age Trust in developing guidance in respect of our practice in relation to data protection.

Necessity Test

The U3A requests minimal information from potential members which includes personal details and contact details. This information is proportionate to the requirements of the U3A fulfilling its responsibilities in relation to being able to communicate effectively with its membership. The U3A would not be able to register members or process applications without the provision of a certain amount of membership information. The U3A has a duty of care to its membership and needs to retain a certain amount of personal information in order to know who its members are and which members are paid up members of the U3A. This is necessary for meeting the requirements of the insurance provision for U3A members.

Balancing Test

The personal data requested is that which is needed for registering and processing individuals as members of the U3A. The data requested is minimal personal data and that which is needed for communicating with members. All the data gathered is from individuals who provide the information as part of their application to join the U3A. Membership is renewable each March, at which time members have the option to renew or not, and have the opportunity to update their personal information, which may also be done at any other time. The reasons for collecting personal information are explained to potential members at the point of joining.

A copy of the U3A's Privacy Policy is available to all members who wish to have further details about how their information is used and who it is shared with. Members who are unhappy about their data being shared with third party processors are able to opt out of receiving those publications for which a processor is used.

The U3A holds information securely and it will only be accessed by those who need to see it. Membership data will not be processed for any purpose other than in connection with an individual's membership. Communications sent will be relevant and targeted to the individual's membership activities. U3A members will not be sent marketing materials or information that does not relate to The U3A. The U3A group leaders/convenors will be informed of the importance of restricting their communications with members to that which is needed for organisation of the group. All those who process membership information for the U3A will receive an induction into the requirements of GDPR and the restrictions around data processing. In addition, volunteers will be informed of the need to keep data secure and restricted to those who need access to it.

Through compilation of this assessment the U3A considers that it has a legitimate interest to collect, hold and process membership information. This document will be held by the Committee and communicated to the membership, as required. The assessment will be reviewed every 3 years in order to ensure that legitimate interest remains the most appropriate lawful basis for gathering membership information.

Reviewed: 19 November 2020

Review date: November 2023