Legitimate Interests Assessment

Summary

The Society believes it would be beneficial for its members to be kept up-to-date. We will do so with a newsletter, and processing a small amount of personal data (name and email address) is necessary for this purpose. We believe this is compatible with members' interests and rights and freedoms, and will always give members the opportunity to opt-out of receiving the newsletter.

Purpose test

The Edinburgh University Railway Society (the “Society”) intends to process personal data — specifically, name and email address — for the purpose of delivering an email newsletter to its members. The aims of the newsletter are:

• to give notice for Annual and Emergency General Meetings;
• to communicate the Society’s upcoming activities;
• to communicate any other information that may be relevant to the Society’s activities, such as news about rail travel.

These aims are given in descending order of importance.

The Society will benefit by ensuring it satisfies the Students’ Association’s requirement to give adequate notice of its general meetings. This also means that proposals for constitutional amendments and nominations can be received and processed in advance of the general meeting. And it is expected to increase the likelihood that a quorum is present. The Society will also benefit by raising awareness of its events. It is expected to increase turnout and contribute to the success of these events.

The Society’s members will benefit by receiving adequate notice of the Society’s general meetings. This will enable them to propose constitutional amendments and nominate themselves for committee roles in advance of the general meeting. They will also benefit by being made aware of the Society’s events, which they may be interested in attending as members. And they will benefit from being made aware of other relevant information and updates, as users of public transport, particularly the railway.

No benefits are anticipated for third parties and the wider public.

Not processing personal data impacts the Society’s ability to give adequate notice of general meetings. All members are required to register via the Students’ Association in the first instance, which requires them to supply an email address. As such, by collecting these email addresses, the Society can ensure that all members can be contacted in advance of a general meeting. It would also impact the Society’s ability to update its members about upcoming events, which risks lower turnouts and less success. Members would miss out on other relevant news and information which they might not have otherwise been aware of, too. And, more generally, not delivering an email newsletter would be a missed opportunity to engage the Society’s members.

The Society will comply with the General Data Protection Regulations (“GDPR”). It makes a privacy notice available on its website at www.railsoc.eu/privacy. Personal data is stored within the European Economic Area; its storage and transfer is subject to GDPR Adequacy Decisions. The Society endeavours to keep the personal data of its members secure, will never use it for marketing purposes without consent for that purpose, and will never sell or rent it to third parties for any purpose.

The Society expects that its members will be comfortable with the processing of their names and email addresses. In any case, it will take care to address any member’s concerns.

Necessity test

Processing personal data is necessary and proportionate for delivering an email newsletter. It would not be possible to deliver emails without recipients’ email addresses. Keeping names is required to match email addresses to members in the Students’ Association database, so that newsletters are delivered to the correct recipients. No other personal data will be processed.

An alternative to delivering an email newsletter would be to rely on social media. Social media posts can be used to achieve the same aims of an email newsletter. However, it is not clear whether the full membership follows the Society’s social media accounts. There is also a risk of the Society’s posts not being shown to members by a social media platform. The Committee therefore could not demonstrate that adequate notice has been given to all members in the case of a general meeting, as per Students’ Association requirements.

Granted, it is less imperative that members are made aware of upcoming activities, and less so that they receive other relevant information, but it again risks not reaching members who otherwise would have wanted to know. Even so, the Society will mitigate this by allowing its members to opt-out of general meeting notification and general newsletter emails separately.

Balancing test

Nature of the personal data

The personal data collected is not special category data or criminal offence data. It is not children’s data or data relating to other vulnerable people. The data collected is about members in their personal capacity, but the Society does not view it as data that its members are likely to consider particularly ‘private’, relative to other types of personal data.

Reasonable expectations

The member has a relationship with the Society insofar as they have activately registered themselves with the Society, via the Students’ Association website. Data is not collected directly from the member. It is supplied by the Students’ Association. This is standard practice for societies registered with the Students’ Association and is covered by their privacy notice. The Society assumes that, by registering for membership, the member expects their data to be accessible to the Society, and the member expects to hear about the Society’s activities and for their data to be used for this purpose.

Likely impact

Members will not lose any control over the use of their personal data, as far as the Society and its email newsletter is concerned. The use of personal data by the Students’ Association is outside the scope of this assessment. The Society does not expect members to object to the processing, but will allow members to opt out of receiving the email newsletter, or toggle the types of emails they receive. Members will be allowed at any time to make a subject access request, update their information, request its deletion, or exercise any of their other rights.

Decision

Having completed the purpose, necessity, and balancing tests, I conclude that the Society can rely on legitimate interests for processing personal data to deliver an email newsletter. There is legitimate interest behind the processing, the processing is necessary for the identified purpose, and there is not a case in which members’ interests and rights and freedoms override the legitimate interests. A full data protection impact assessment is not required, given the small scale of the data processing and low associated risks.

Seb Jensen
Secretary (2025–26)

8 May 2025

This assessment was ratified by the committee at the meeting held 16 May 2025.

Please direct any queries about this assessment to the Secretary.