What personal data does a Barcelona cannabis association ask for, and what happens to it afterwards? The first part has a general answer: proof that you are an adult and an identity document, because membership of an association means being entered on a nominal register. The second part does not have a general answer, and that is the honest position. What any specific association does with your data is set out in that association’s own privacy notice, and the useful thing this article can do is tell you which questions to ask and what the European framework entitles you to.
Why identification is required at all
Adult age is a condition
Access is restricted to adults, and the only way to establish that is a document. This is not a formality that can be waived for a visitor, and it applies identically to residents.
The register is nominal
An association has members, not customers. Being a member means being on a register kept by the entity, which is what distinguishes an association from a venue with a door. A nominal register requires a name, and a name has to be verified against something.
It is the same for everyone
Nationality does not change the requirement. A passport does the same job as a national identity document. The requirements in general are set out in our article on what you need to join.
What the European framework establishes
The rules that apply
Any entity in Spain handling personal data operates under the EU General Data Protection Regulation (Regulation 2016/679, applicable since May 2018) and Spain’s own Organic Law 3/2018. That framework is general: it applies to a sports club, a bookshop mailing list and an association alike.
The principles it sets
- Purpose limitation. Data is collected for a stated purpose and not repurposed freely.
- Minimisation. Only what is necessary for that purpose.
- Storage limitation. Not kept indefinitely without a reason.
- Integrity and confidentiality. Kept securely.
- Transparency. You are told what is collected and why, before it happens.
The rights it gives you
Under that framework a person can, in general terms, request access to their data, ask for it to be corrected or erased, object to certain processing, ask for it to be restricted, and request portability. How an entity handles those requests is something it is required to explain.
A necessary caveat
This is a general description of a legal framework, not advice about your situation and not a statement about any particular association’s practices. For anything that matters, consult a professional.
What to ask before you apply
Five questions, in one message, before handing anything over:
- What exactly do you collect, and is a document scanned or only checked?
- What is it used for?
- How long is it kept, and what happens when a membership ends?
- Who has access to it, and is any of it shared with anyone else?
- How do I exercise my rights over it, and who do I write to?
An association that handles this seriously will have answers, and giving them costs it nothing. Ask them in writing, at the same time as everything else you are asking — the same message we recommend in how far in advance to request membership.
What this article is not going to tell you
Not what any specific association does
We are not going to summarise anyone’s data practices, including our own, in a blog post. That belongs in a privacy notice, where it is precise and binding, not in an article where it would be neither.
And be sceptical of articles that do
If you find a piece confidently describing how associations in general handle personal data, ask yourself how the author could possibly know. Each entity is separate, and each answers for itself.
What to do with an association that will not answer
Treat it as information. An entity that cannot say what it collects and why is telling you something useful about how it operates, and you are free to act on it.
Frequently asked questions
1. Why is a document needed if I am only asking a question?
It is not. You can ask about the membership process without providing anything. Identification comes in at the application stage.
2. Does a passport work if I am not Spanish?
A valid identity document is what is required, and a passport is one. Each association sets its own conditions, so confirm with it.
3. Can I ask for my data to be deleted later?
The European framework provides for erasure requests, subject to the exceptions it sets out. How a given entity handles one is something it should be able to explain to you.
4. Is a copy of my document kept?
That depends on the entity, and it is exactly the kind of thing to ask before applying rather than after.
5. Who can I complain to?
In Spain, the supervisory authority for data protection is the Agencia Española de Protección de Datos. Its procedures are published on its own site.
In short, on the data requested when applying for membership: identification is required because the register is nominal and adult age is a condition, the European framework sets the rules and gives you rights over your data, and the specifics of any association belong to that association to state. Kush Weed Coffeeshop is a private association of adults on Carrer de Freixures, in the Santa Caterina area, with access restricted to registered members on prior application and identification. If you want to know what the membership application involves, get in touch and we will explain the process and the conditions that apply.