Are volunteer coaches for a rugby club who share personal data of other coaches on Whatsapp and in Facebook groups (without the knowledge of the rugby club) in any way liable for failures to comply with data protection laws?
Whether the individual is fully incorporated into the organisation's structure or operates more independently, like a solo entrepreneur or sole trader; If it would be fair and reasonable to hold the organisation vicariously liable for the actions of the individual.
The degree of control the organisation has over the actions of the individual in question (although not necessarily the methods they use to carry out those actions), and whether the organisation has the authority to intervene if tasks are not carried out correctly;
As to whether the rugby club would have vicarious liability for the actions of the volunteers, this is not clear cut. There have been cases where organisations have been held to have vicarious liability for independent contractors.
the volunteer coaches are swapping their own personal data and it has no control over the platforms on which they are sharing the data i.e. WhatsApp and Facebook.
Find this answer and more in my latest Linkedin newsletter, packed with useful legal insights to help you navigate the complex world of business law: linkedin.com/posts/suzanned…
And now, with our Total Legal Protection Programme, I'm thrilled to offer you a game-changing solution that will empower you and your business like never before. 💪
However, it's important to note that being joint controllers doesn't necessarily mean that the liability is shared equally. The GDPR allows for the possibility that one controller might be more responsible than the other, depending on the circumstances.
The question here is who is the data controller. A data controller is somebody who decides what to do with the personal data that it holds about certain individuals. In this instance, it is questionable as to whether the rugby club is the data controller as it is unaware that +
If a complaint was to be made about such advertising – and this would typically be by your competitors – the ASA would investigate and make a ruling on your advertising.
The person with agreed responsibility should actually action that request. However, even if one person has taken responsibility for dealing with data subject requests, all of the joint controllers would be potentially liable for compliance with this.
Start selling online and offline in minutes with Shopify. Enjoy the freedom to build a brand your way, grow your own customer base, and scale at your pace.
Virtual Virginia's online K–12 courses are available to students anywhere in the world, whether they're in public or private schools, homeschooled, or even beyond Virginia.
Register your students today for 2023–2024 online instruction!
As such, they should agree between them who would deal with things like data subject requests, such as where a coach may contact another coach and request that all of his data is deleted from a Facebook group.
