GDPR – Data Ownership

The data belongs to each Association and that association is free to do whatever you like with it.

You will (or should have) a publicly available, data protection/privacy policy in which you specify what you undertake to do (or not do) with members data.
In terms of the responsibilities of the data within eReturn2, officers sign up to a set of principles when they first log into eR2.

The Association is the ‘Data Controller’. The BDI are the ‘Data Processors’ and they have separately agreed that they will not disclose it to third parties.