Pitchero is able to support sports clubs by helping them become clued up on General Data Protection Regulation (GDPR) as well as offering tools to make the process of having a GDPR-compliant website as smooth as possible.
Our blog articles explain how GDPR affects a sports club and 6 Steps your club must take so a club can audit the information it holds while learning about individuals’ rights under GDPR and updating their website and offline data practices.
The Information Commissioner’s Office (ICO) has a useful snapshot on 12 steps to take to prepare for GDPR and here on the Pitchero blog, we’ll look at some of those now and how they relate to your sports club.
If they don’t know already, those actively involved in the running of your sports club should be informed about GDPR and its implications.
Pitchero has emailed all webmasters and team admins about recent and future updates concerning GDPR (also see the GDPR hub) but anyone handling an individual’s personal data (such as coaches and club secretaries) should be briefed.
Information You Hold
On an ongoing basis, consider what personal data your sports club holds, whether it needs to collect and store it and where it starts and stops. Where you got the information from is important as is how it is shared with others. It could be quite a task to consider all the personal data that flows through your club but a brainstorming session will help capture the ideas.
Communicating privacy information
Under GDPR, an individual has these rights:
The right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to data portability; the right to object; and the right not to be subject to automated decision-making including profiling.
From a sports club’s perspective, they should put in place a way to provide a copy of a person’s data or delete it entirely on request. Here are the GDPR rights and how they are relevant to sports clubs.
Subject Access requests
GDPR makes it possible for any individual to request all of the data held on record by a sports club about them. This is called a ‘subject access request’ and must be done in a month or less. Pitchero will soon provide tools to help clubs access data needed for subject requests, but it’s worth bearing in mind, personal data includes everything offline too.
Lawful basis for processing personal data
A sports club can reasonably claim to have a legitimate need to collect personal data for the running of its activities such as the management of its members. Now there are more stringent measures in place, it should review if it needs to hold all the personal data it does.
With GDPR, permission to collect, store and use personal data (consent) cannot be assumed. According to the ICO, it must be given freely, be specific, informed and unambiguous. Pitchero has video consent forms (adult, parent or adult visitor) and will soon release tools to help clubs access data needed for subject requests (as mentioned above).
Consent forms completed by parents of young people under 18 is common at sports clubs and parental/guardian consent, along with verification of age, is very important. A club typically uses photography and video to promote its members and teams but permission is non-negotiable. It’s a good idea to have a club policy on photography and video - each sport’s governing body will have resources (here’s cricket).
Data Protection Officers
The formal appointment of a Data Protection Officer is usually undertaken by a company or larger organisation than a sports club to manage data protection strategy and implementation. Volunteers juggle enough roles without another job title but it is sensible to have someone in charge of data protection at the club who knows about GDPR and how it affects the club.
GDPR has sometimes been described as a journey, not a destination and hopefully the advice above helps you on that data voyage. So long as sports clubs can show they are actively working on GDPR and trying to implement the steps required, they should have nothing to worry about.