Register to download or access job board GDPR compliant?

[evcom]

We would like to increase the number of sign-ups by offerings downloads (mostly PDFs) and a job board for registered community members only. The hope is, that some of those new "members" would then also join the discussions. But the main idea is to increase memberships. This has been discussed already here: https://www.theadminzone.com/threads/free-download-for-registration-or-not.130183/
It's important to note that registering members can optionally opt-in to receive a newsletter when they register. So it's not necessarily a "bundle sale" or "package deal". Plus, the Community is non-commercial, any income from selling e.g. accessories or the like would go towards covering the running costs.

However, our main concern is, whether this is compliant with the EU's Data Protection Reg's (GDPR). To collect personal data, one must have a lawful basis for processing:

Lawful basis for processing

There are six available lawful bases for processing. Which basis is most appropriate to use will depend on your purpose and relationship with the individual.

ico.org.uk

One legal basis is "Legal obligation" where it says: The processing must be necessary. If you can reasonably comply without processing the personal data, this basis does not apply.

On the other hand I could also have "Legitimate interests". But to use this legals basis is somewhat on the thin ice.

I think making downloads for members-only is somewhat easier to justify, e.g. if there was a lot of work involved in a work that is offered for download.
Making a job forum for members only, would certainly work well in terms of increasing sign-ups, but difficult to justify...

What do you think about such a "sign-up promotion" in times of GDPR?

 

[evcom]

Well, I was thinking a little bit more about it and and I think it will be better to keep a job forum and also a download section open for guests. The advantage of this is, it will probably generate more traffic, compared to an option where users have to sign up to view the content. To turn guests into memberships, I will recommend visitors to create an account so that the can follow the forum and get notified each time a new job or download is posted. It's a cleaner and friendlier option. Any other suggestions are welcome.

 

[zappaDPJ]

I'd suggest your lawful basis is consent... 'the individual has given clear consent for you to process their personal data for a specific purpose' the purpose being to join your forum.

It's not uncommon to offer potential members some degree of enticement to join and I don't see this as being any different.

 

[User37935]

What do you think about such a "sign-up promotion" in times of GDPR?

"Sign up to receive our... [insert product or service]". Very common and it sounds fine... think of GDPR as being 1. Honest with the user about what you want to do with their data, 2. Give them clear warning so they can decide whether to register or not based on that and 3. Give them rights to remove their data or to get copies of their data later on. 4. Don't do anything else with their data without clear consent.

So it won't stop you doing things or offering services. You just need to spell out what the purposes of their registration is and what you want to do with their data.

 

[evcom]

Thanks for your comments and thoughts about it. Yes, I think as long as users are properly informed and point 1.-4. is taken care of, downloads and specific forums for members only should not be a legal issue.

At the moment I tend (for traffic reasons) to keep both sections also open for guests. But it's nice to have the other option available too.

 

[zappaDPJ]

"Sign up to receive our... [insert product or service]". Very common and it sounds fine... think of GDPR as being 1. Honest with the user about what you want to do with their data, 2. Give them clear warning so they can decide whether to register or not based on that and 3. Give them rights to remove their data or to get copies of their data later on. 4. Don't do anything else with their data without clear consent.

So it won't stop you doing things or offering services. You just need to spell out what the purposes of their registration is and what you want to do with their data.

I can't help thinking if data protection laws were set out like this rather than couched in pages of legalease, everyone would understand them

 

[Nev_Dull]

Don't be silly. If legislation was written in plain, simple language, there would be no wiggle room for all the myriad interpretations and "exceptions" that legislators love to use.