Circular issued by International Group clubs As advised in our circular 7 March 2018, the General Data Protection Regulation ("GDPR") provides for significant penalties in the event of a data breach. The purpose of this circular is to provide members, correspondents and others with further guidance on how to try and reduce the risk of a breach and advise you of some changes we will be making in how we handle personal data. People claims such as those involving crew or passenger illness and injury present the greatest challenge to the Club in ensuring the adequate protection of personal data. Data minimisation and privacy by design As mentioned in our previous circular, the Club is a controller for the purposes of the GDPR, and thus responsible for demonstrating compliance with the Regulation. As a result and in line with the key GDPR principles of data minimisation and privacy by design, the Club wishes to start limiting the amount of personal information in circulation, make greater use of existing technology to transfer personal data more securely and where possible, anonymise the data that is exchanged. E-mail circulation lists continue to expand which means it can be difficult to spot when someone who should not be included has inserted themselves into an email chain. In addition, attempted fraud by e-mail is increasing, with communications received from impersonators of those involved in the industry. These imposters are usually seeking financial gain but responding to such a message could lead to a data breach by the Club as well. In handling personal illness or injury files it is often necessary to exchange sensitive personal data with members, correspondents and service providers around the world on an urgent basis. Implementing GDPR principles is particularly important. We would like to offer readers some "best practice" guidance in the form of 10 tips for the treatment of personal data: Respect - treat everyone's personal data with the same respect you wou