Gymbox - PT added me on Facebook

Blackbeard_of_Perranporth wrote: »

Just FB'd Hannah Dee.


Interesting list with at least 6 with fully open profiles!

This forum does suggest on registration that users here should not post under their real names, but I agree that many people leave their Facebooks wide open and vulnerable.

(My own original Facebook account was hacked for just that reason in the early days of Social Media, so I fully realise the potential consequences)

SuperHan wrote: »

I think there is a blur here, as her information is freely available.

It's likely that the PT added the OP's number to his phone. Facebook would then automatically (where relevant settings are selected) show the OP's profile to the PT as a suggested friend, where he has added her.

This is likely for legitimate business reasons as it is probably for arranging more sessions/providing a discount as others have highlighted - a lot of PT's conduct their business on Facebook, even through personal profiles.

There is a question over whether Facebook having access to the numbers in his phone would breach GDPR from a data storage perspective, but at the end of the day Facebook has only tied the number with the OP because she has specifically allowed it to.

If the OP is so concerned about privacy, she should really do more at her end.

We're supposing her data is freely available. There's no information either way as to whether the OP does have her Facebook account linked to her phone number - if she doesn't, and the trainer has got her details from the gym office, then it's a data breach on the part of the gym as well.

marliepanda wrote: »

GDPR is mostly to do with how data is stored, rather than used.

I'd have to disagree with that statement. The GDPR covers pretty much everything on GDPR and that is shown by the very wide GDPR definition of processing.

@steampowered

Good point, and this is exactly why the GDPR (and the e-Privacy Directive, which regulates marketing in more detail than the GDPR) allows organisations to market to their existing customers without needing customer consent.

The PECR (current privacy regulations) require consent except in circumstances when you can rely on the "soft opt-in" exemption. There are three conditions to be met and if I recall, the PECR stipulates that the soft opt-in only exempts you from marketing similar products or services by email or text. Adding a friend on Facebook is neither of these so the PT would likely be breaching the PECR. Likewise, I don't think the new e-privacy regulations have changed in that respect but I may be wrong.

From a common sense and practical perspective, the OP should ask the PT to delete her information that he holds about her since she has not taken up any further PT sessions so there is no need for him to retain it. Although I don't really use Facebook I assume there is a option to block that person so maybe that's something she should do too.