Trade union membership is explicitly listed as special category data under Article 9(1) UK GDPR. This places unions among the organisations subject to the most stringent data protection obligations.
Why Membership Data is Special Category
Merely holding a record showing an individual is a union member triggers Article 9 protections. Processing requires both an Article 6 lawful basis AND an Article 9(2) condition.
Key Article 9 Conditions for Unions
- Article 9(2)(d): Not-for-profit bodies with a trade union aim — the primary condition for member data. Critically: data must not be disclosed outside the organisation without member consent.
- Article 9(2)(b): Employment obligations — for collective bargaining and representation work
- Article 9(2)(f): Legal claims — for employment tribunal proceedings
- Explicit consent: Required for political campaigning use of member data
Industrial Action Ballots
- Ballot scrutineers are data processors — DPAs required
- Industrial action participation records are highly sensitive — do not disclose to employers
- Retain ballot records per statutory obligations then destroy
Sharing Member Data
Article 9(2)(d) prohibits disclosing member identity data outside the union without consent. This includes:
- Political parties (even affiliated ones)
- Campaign organisations
- Media (anonymise case studies without explicit consent)
Retention
- Current members: duration of membership
- Former members: 6 years post-membership
- Employment tribunal files: 6 years from conclusion
- Financial records: 6 years
This guide was produced by Custodia — AI-powered GDPR compliance for small businesses. Scan your union website free.
Top comments (0)