GDPR for sports clubs and federations is not optional. This is what the regulation asks of every club that keeps member data.
The General Data Protection Regulation (the “AGV”, also known by its English abbreviation “GDPR”) will enter into force throughout the European Union on May 25, 2018.
The GDPR has a number of consequences for every organisation that processes personal data. The concepts of “personal data” and “processing” are very broadly defined, so that in fact almost every entity will sooner or later be confronted with these new rules.
Sports clubs, sports federations and even competition organizers also fall within the scope of the GDPR. Since sports clubs and sports federations process personal data in many ways, such as membership or participant lists, or via databases for subscriptions and ticket sales, special attention is required. This attention is all the more justified now that sports clubs and sports federations often work with -13 year olds, which entails additional obligations.
The GDPR builds on existing privacy legislation, but also changes it substantially. A selection of the most important obligations under the GDPR:
- Any sports club or federation that has personal data processed by other companies (for example certain IT services, personnel administration, certain subcontractors) is obliged to conclude a written agreement (a so-called processing agreement) that complies with the GDPR and which specifies the obligations of this service provider or subcontractor with regard to data protection.
- The requirements for valid consent from an individual to process their personal data are becoming stricter;
- Any sports club or federation that processes personal data must maintain an internal register of its processing activities, have an appropriate privacy policy and implement measures that comply with the principles of data protection by design (privacy by design) and data protection by default settings (privacy by default).
- Certain sports clubs or federations may need to submit a ‘Data Protection Impact Assessment‘ to execute (Data Protection Impact Assessment – PIA);
- Certain organisations may also require one data protection officer (Data Protection Officer) have to appoint;
- In certain circumstances, leaks of personal data must be reported to the competent authority (in Belgium the Data Protection Authority) within 72 hours.
- Infringements can be punished with fines (up to 20 million euros or 4% of global turnover);
As mentioned, the GDPR comes into effect May 25, 2018. Until then, organisations have time to comply with the GDPR.
However, the implementation of all these obligations requires the necessary time and adjustments within the sports club, sports federation or competition organisation.
We therefore recommend all sports clubs, federations and organizers to tackle this issue as quickly as possible. A first step is to analyse which personal data is processed within your club, federation or organisation and what obligations this will entail for your club or federation under the new legislation.
Everest Sport can guide your company in drawing up an initial analysis and further implementation of the obligations.
What GDPR for sports clubs means in daily practice
Most clubs do not fail on the large obligations. They fail on the ordinary ones. A membership list that circulates by email, a group chat holding the phone number of every parent, photographs of a youth team published without a clear basis, medical notes kept in a shared folder: each of those is processing, and each needs a reason that holds up.
Start with the register of processing activities, because writing it forces the rest into the open. For every category of data, record why you hold it, on which basis, who has access, how long you keep it and to whom you pass it. Once that list exists, the gaps become visible without any legal analysis: data nobody can justify, retention periods nobody ever set, and access that was never limited.
Young members and images
Youth work raises the two questions clubs ask most. For children, consent given by the child alone is not sufficient below the age set in national law, so consent has to come from the person holding parental responsibility, and it has to be recorded in a form you can still produce two years later. For photographs, separate an image that reports on an event from an image used to promote the club. The second needs its own permission, and a permission given once is not a permission for every later use.
When something goes wrong
Decide in advance who takes the call when data is lost or exposed, because the period to notify the authority is counted in hours rather than in days. Keep a short internal note of every incident, including the ones you conclude do not have to be reported, together with the reason for that conclusion. That record is what turns an incident into a handled incident.
For more information and advice about the GDPR, do not hesitate to contact us via our contact form, by email (sport@everest-law.be) or by telephone (09/334.94.70).
GDPR for sports clubs in practice
Years on from its entry into force, the question clubs bring us is no longer what the regulation says but what they have to be able to show. When a supervisory authority asks, the first three documents on the list are the register of processing activities, the processing agreements with suppliers, and the privacy notice that members actually receive. A club that can produce those three stands in a very different position from one that cannot, even where the underlying practice is identical.
Two areas cause most of the difficulty in sport. The first is health data. Injury files, fitness certificates and rehabilitation notes belong to a special category, and the club doctor cannot simply pass them to the coaching staff because the team would like to know. The second is images. Team photographs, match footage and social media posts raise questions about consent that become sharper as soon as minors are involved, and consent given by a parent can be withdrawn later. Decide in advance what happens to the material when it is. We advise clubs, federations and organisers on data protection in sport.