Sign-up forms for Swiss clubs: recording member data with care

A gymnastics club in Frauenfeld has a hundred and eighty members, a youth section and a summer camp. Sign-ups used to come in on paper, on a sheet that has grown over the years: name, address, date of birth, phone, email, occupation, employer, parents’ names, health insurer, allergies, “photo consent”. Now there is to be an online form. The club secretary who is building it wonders whether all these fields need to come along.

It is a fair question. Clubs often collect more than they need, not out of curiosity, but because a form is handed down from committee to committee. Moving to an online form is a good moment to look at it with fresh eyes.

What the club’s purpose covers

On its page about data protection in associations, the Federal Data Protection and Information Commissioner (FDPIC) sets a simple standard: the committee may record the data directly related to the club’s purpose as laid down in its statutes. For other data, it has to inform members in advance and obtain their agreement.

That matches the principles of the Swiss Data Protection Act (FADP): personal data may only be collected for a specific purpose that is recognisable to the person concerned (Art. 6 para. 3 FADP), and processing must be proportionate (Art. 6 para. 2 FADP).

For the gymnastics club, this means it needs name, address and a way to get in touch to keep a member register and collect fees. It may need the date of birth if categories, fees or the youth section depend on it. Occupation and employer serve no purpose that is likely to be in a gymnastics club’s statutes.

The fields one by one

Field	Link to the club’s purpose	What suggests itself
Name, address, email	Member register, invitations, fees	Required
Phone	Short-notice cancellations, training	Optional or required, depending on practice
Date of birth	Categories, youth section, fees	Only if something depends on it
Occupation, employer	No direct link	Leave out
Emergency contact	Training and camp with children	Only for the youth section, in its own section
Allergies, medication	Camp, catering	Separately, only for the camp, with its own note
Photo consent	A purpose of its own alongside membership	Its own optional box

Allergies deserve a second look. Information about health is sensitive personal data (Art. 5 let. c no. 2 FADP). The club may need it for a summer camp, but not for membership. A separate camp form, seen only by the camp leaders and deleted after the camp, keeps the two purposes cleanly apart.

Member lists

Many clubs circulate a member list with addresses and phone numbers. The FDPIC is clear here: distributing member lists with addresses to other members requires the consent of each individual member. For sending by email, it recommends blind copy, so recipients’ email addresses are not visible to everyone.

An online form can solve this directly: an optional box, “My contact details may appear on the member list for other members”. Anyone who does not tick it appears only in the committee’s list.

Sponsors and other third parties

Some clubs are asked by sponsors for addresses, for example for a member offer. The FDPIC states that disclosure to third parties is only permitted if members have been informed of the purpose and have expressly agreed. The information must state which data is passed on, for what purpose and to whom.

A blanket tick box, “I agree to my data being passed to partners”, hardly meets this, because it names neither the data nor the recipient. Where a club plans such disclosures, a concrete wording belongs in the form — or a separate request when the case arises.

Photos and the website

Club photos are part of club life: the prize-giving, the camp, the general meeting. The FDPIC points out that the committee should consider context and purpose before publishing. Uploading to the internet carries an increased risk of infringing privacy, because the data becomes accessible worldwide and can no longer be fully deleted. For photos, the FDPIC says the consent of the people concerned is needed, and it can be withdrawn at any time.

What members learn when they fill it in

Whoever collects personal data informs the person concerned appropriately (Art. 19 para. 1 FADP) — at least about the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients (Art. 19 para. 2 FADP). That applies to a club too.

In the gymnastics club’s form, a few sentences above the send button are enough:

• Who receives the details: the gymnastics club, represented by the committee, with a contact address.
• What for: the member register, invitations, fees, assignment to groups.
• Who else sees them: the leaders of the relevant group, and — only with the optional box — other members via the member list.
• For how long: until the member leaves, unless there is a duty to keep them.

A longer text can sit on the club website, linked from the form. But the short version at the form is the one that actually gets read.

Who in the club sees what

Legally, the club as a whole is the controller under the Data Protection Act. The FDPIC notes, however, that criminal sanctions generally do not fall on the legal entity but on the natural persons in leading roles. Access should therefore be arranged, not left to chance.

In a gymnastics club, that might look like this:

• The secretary sees all member data, because she keeps the register.
• The treasurer sees name, address and the status of fees.
• The youth section leaders see the children in their group and their emergency contacts.
• The camp leaders see the camp sign-ups with the health details, and only those.

A change on the committee is a moment clubs often overlook: whoever hands over the role also hands over the access. A spreadsheet on the former secretary’s private laptop is no longer under the club’s control.

When someone leaves

Personal data is destroyed or anonymised as soon as it is no longer needed for the purpose (Art. 6 para. 4 FADP). What a club must keep for accounting reasons stays; a former member’s phone number, allergies or photo on the website need a reason of their own to stay. A simple rule in the club — such as going through the list after the general meeting — takes care of this without much effort.

The form for Frauenfeld

In the end the secretary manages with a shorter form: name, address, email, phone, date of birth for the category, plus three optional boxes — member list, photos, newsletter. The youth section gets a section with an emergency contact, the camp its own form. Occupation, employer and health insurer are gone.

In the Forms app we are building, responses will be encrypted in the browser of the person answering, and team workspaces are meant to set who edits forms and who may read responses — just as a club divides its roles anyway.