Apologies if there's an obvious answer to this one that I'm missing: We operate several theatres and concert halls which are sometimes hired out to third parties. When this happens tickets are sold through *our* box office and personal data (names & addresses) is recorded on our box office system. We are registered for our own use of this data. What concerns me is what happens when the third party asks for a list of names and addresses of the people who bought tickets. We are not registered for trading in personal information but are we merely an intermediary in this case (that is, the third party pays for the hall, takes the ticket money and is clearly responsible for the concert on the publicity and programmes)? On the other hand, the personal data is on our computer system not theirs. My first instinct was not to pass on the information unless we register for trading in personal information and inform data subjects when they book their tickets, what do other people advise? Regards Gordon ************************************************************ Gordon Hunt Head of Information Services Royal Scottish Academy of Music & Drama 100 Renfrew Street Glasgow G2 3DB Tel: 0141 332 4101 x269 Fax: 0141 332 5924 *********************************************************** %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%