This seems to satisfy some of the data protection requirements, but I think @tomheath will say that we need to say something about where the data about their membership is stored.