Bulletin 9: GDPR and Personal Information on Websites

IEEE Technical Activities Bulletin #9
Topic:  GDPR and Personal Information on Websites
Bulletin Type: Action
Audience:  IEEE Volunteers and IEEE Staff
Version 9, 22 October 2018
Use of Personal Information on IEEE Technical Activities Websites and Compliance with GDPR 
IEEE Technical Activities Organizational Units (OUs), including Societies, Councils, Technical Communities, etc., often provide information about volunteers on websites. Learn how your OU can provide relevant information while complying to the European Union’s General Data Protection Regulation (GDPR).
What personal information can and cannot be included on websites?
As with all things, it depends on the purpose and use of the information, including:
1) Volunteer Leadership Groups – Any Society AdCom or ExCom members, Conference or Technical Committee chairs, and other volunteer leadership groups who wish to be listed should only provide the information needed to allow other community members to contact them during the current term. For example:
  • Acceptable: First name, last name, email, photo, and IEEE leadership position
  • Not Acceptable: Address (home/work) and phone numbers (home/office/mobile)
  • Acceptable only if required to be disclosed as part of the position: Affiliation or employer
  • Note: When an individual’s term expires, the email address should be removed from the website.
2) Reviews or Testimonials - IEEE websites may include personal review or testimonial content, either in written or video format. This content could be related to IEEE events, products and services, where the individual is expressing a personal experience or viewpoint. The review or testimonial may include the individual’s name, likeness, and IEEE affiliation.  Including the individual's contact information is not appropriate. Employer or school affiliation should only be included if it is important or essential.

When obtaining a testimonial or review, the local IEEE volunteer/staff should ensure they have gotten the permission of the person providing the endorsement.  A good way to do this would be to obtain an agreement from the individual to use their image or video, name, comments, and opinion on a website or any other communications. If this agreement is obtained, it should be kept with other important IEEE documents at the local level. Documenting the permission can be done by:

  • Signing an IEEE Photo/Video Release (Preferred method)
  • Sending an email stating they agree to and understand how and where their likeness and name may be used and that the video may be edited
  • Filming the person saying they understand how their image will be used and agree to let IEEE use their image for the video
3) Awards or Honors Recipients - IEEE websites may include announcements of IEEE awards or honors. This may include competitions, grants, scholarships, Hall of Fame, and other honorary recognition. The award recipient’s name, likeness, and IEEE affiliation relevant to the nature of the recognition can be provided, however, the individual's contact information should not be included. For example, for a scholarship winner it would be appropriate to include the university they attend. Photos of the award presentation are appropriate but should only be used for announcement purposes.

In the award process, the following language should be included:

  • In cases of self-nomination, include the following language in the application or entry form, “Winners may be announced on the IEEE XYZ Society website and newsletter.” 
  • When nominations are made by third parties, include the following language when notifying winners, “Your award may be announced on the IEEE XYZ Society website and newsletter.” 
How can I learn more?
Visit the Technical Activities GDPR Resource Page or the IEEE GDPR page
Please share this information with additional volunteers, contractors, temporary employees, interns, and consultants as needed.

TA Answer Central