Data Protection A Guide to The General Data Protection Regulation for County FAs, National League System and other Football Clubs

Transcription

1 Data Protectio A Guide to The Geeral Data Protectio Regulatio for Couty FAs, Natioal League System ad other Football Clubs

2 Itroductio Data protectio laws are evolvig. The Geeral Data Protectio Regulatio (GDPR) is already i force ad we are curretly i a period of implemetatio with the deadlie for compliace set for 25 May As part of the FA s commitmet to share kowledge ad best practice across the football sector, this Guide has bee created to explai the GDPR ad how you should approach this chage i legislatio. Each club is differet ad there is t a oe-size fits all approach or stadard list of actios that eed to be udertake to achieve compliace. This Guide covers some of the commoly asked questios ad provides liks to further guidace ad iformatio. The FA works with law firm, Muckle LLP, i deliverig free legal support Helplies to Couty FAs ad Charter Stadard Clubs ad Leagues respectively ad has sought their iput i this Guide. Muckle LLP s sports team has advised clubs from grassroots to the top of the professioal game, icludig over three quarters of the 92 professioal clubs i the football league. The specialist Data Team at Muckle LLP ca provide further iformatio ad support to you o the GDPR. If you require further help we have two dedicated helplies to get i touch: Couty FAs Chartered Stadard Clubs ad Leagues Tel: Coutylegalhelp@TheFA.com Tel: CSLegalHelp@TheFA.com 2 Muckle LLP

3 Glossary of Key Terms The GDPR uses specific termiology you eed to familiarise yourself with ad cosider how they apply to your club (for example, what persoal data do you hold?). Data Subject Persoal Data a livig idividual/ atural perso. ay iformatio relatig to a idetified or idetifiable data subject who ca be idetified, directly or idirectly, i particular by referece to a idetifier such as a ame, a idetificatio umber, locatio data, olie idetifier or to oe or more factors specific to the physical, physiological, geetic, metal, ecoomic, cultural or social idetity of that perso. Examples iclude: ame, address, telephoe umber, IP address, membership umbers etc. Special Category Data Processig Data Cotroller persoal data, revealig: racial or ethic origi; political opiios; religious or philosophical beliefs; trade-uio membership; data cocerig health or sex life ad sexual orietatio; geetic data; or biometric data ay operatio or set of operatios performed upo persoal data or sets of persoal data, whether or ot by automated meas, such as collectio, recordig, orgaisatio, structurig, storage, adaptatio or alteratio, retrieval, cosultatio, use, disclosure by trasmissio, dissemiatio or otherwise makig available, aligmet or combiatio, restrictio, erasure or destructio. the atural or legal perso, public authority, agecy or ay other body which aloe or joitly with others determies the purposes ad meas of the processig of persoal data; where the purposes ad meas of processig are determied by EU or Member State laws, the cotroller (or the criteria for omiatig the cotroller) may be desigated by those laws. Muckle LLP 3

4 Data Processor Coset Data Breach a atural or legal perso, public authority, agecy or ay other body which processes persoal data o behalf of the cotroller. ay freely give, specific, iformed ad uambiguous idicatio of a data subjects wishes by which the data subject, either by a statemet or by a clear affirmative actio, sigifies agreemet to persoal data relatig to them beig processed. a breach of security leadig to the accidetal or ulawful destructio, loss, alteratio, uauthorised disclosure of, or access to, persoal data trasmitted, stored or otherwise processed. Does this apply to your club? The GDPR applies to all data cotrollers ad data processors, so if you collect ay persoal data i ruig your club (which you defiitely will do if you have ay members) the the GDPR will apply to you. There are o exclusios for CASCs, charities or ot for profit orgaisatios. It does t make a differece for example if you are structured as a uicorporated orgaisatio or compay limited by guaratee the requiremets are cocered with the data you hold ad how you hadle this. 4 Muckle LLP

5 Mai Resposibilities Fair, lawful ad trasparet processig Persoal data must be processed lawfully, fairly ad i a trasparet maer i relatio to the data subject. Purpose Miimisatio Accuracy Retetio Security Accoutability Persoal data may oly be collected for specified, explicit ad legitimate purposes ad must ot be further processed i a maer that is icompatible with those purposes. Persoal data must be adequate, relevat ad limited to what is ecessary i relatio to the purposes for which those data are processed. Persoal data must be accurate ad, where ecessary, kept up to date. Every reasoable step must be take to esure that persoal data that are iaccurate are either erased or rectified without delay. Persoal data must be kept i a form that permits idetificatio of data subjects for o loger tha is ecessary for the purposes for which the persoal data are processed. Persoal data must be processed i a maer that esures appropriate security of those data, icludig protectio agaist uauthorised or ulawful processig ad agaist accidetal loss, destructio or damage, usig appropriate techical or orgaisatioal measures. The cotroller is resposible for, ad must be able to demostrate, compliace with the Data Protectio Priciples. Muckle LLP 5

6 Key Chages More commuicatio You will eed to give people more iformatio about what you do with their data ad why at the poit you collect it. Respodig to subject access requests Subject access requests (requests for copies of persoal data from idividuals) will eed to be respoded to withi oe caledar moth rather tha the curret 40 caledar day period. It is also o loger possible to charge 10 for dealig with the request. Obligatios There will be direct obligatios o data processors as well as o data cotrollers. This may mea that if you use ay third parties to process data, for example hostig your website, the you must have a writte cotract i place, ad these are likely to be egotiated ad drafted i favour of your processors. Fies icrease sigificatly Curretly the highest fie the ICO ca levy is 500,000. Uder the GDPR, from 25 May 2018, they will be able to issue fies up to 20 millio euros or 4% of your global aual turover (whichever is the higher) for serious breaches. The fie could be 10 millio euros or 2% of your global aual turover (whichever is the higher) for less serious breaches. Gettig coset Coset will be much harder to achieve. If you rely o coset from idividuals to use their persoal data i certai ways, for example to sed marketig s, the there are additioal requiremets to comply with. Data retetio Retetio policies eed to be clear. You ca t keep data for loger tha is ecessary for the purpose for which it was collected. You also eed to iform people how log you will keep their persoal data ad you ca t keep it idefiitely. 6 Muckle LLP

7 Privacy by desig If you are plaig o puttig i place a ew system or electroic portal, the you eed to cosider whether the service provider you choose has adequate security to protect persoal data. Data Breaches You will oly have 72 hours from beig aware of a data breach to report it to the ICO. Childre There are additioal protectios for childre s persoal data. This applies to all participats uder the age of 16. If you collect childre s persoal data the you eed to make sure that your privacy policy is writte i plai simple Eglish. Ad if you offer a olie service to childre, you may eed to obtai coset from the paret or guardia to process the persoal data. Muckle LLP 7

8 Are you ready for ext year s chages? Our top tips to start your jourey to GDPR readiess are: Process Uderstad the jourey that persoal data takes through your club. You should review your club ad map out: 3 What persoal ad special category data you collect/hold; 3 Where you get such data from; 3 Where you sed this data; 3 Who you share data with (iterally ad exterally); 3 What you tell people whe you have collected it; 3 What your legal basis for processig is; 3 Why you have this data; 3 How you secure the data; ad 3 How you dispose of the data whe you o loger eed it. This will allow you to idetify ay areas of risk. Awareess Policy Commuicatio ICO guidace Make sure that your voluteers are aware of the GDPR ad data protectio issues ad that they kow who to talk to if they receive a subject access request or if there is a breach. Make sure the policies ad procedures you have i place help your voluteers deal with data protectio issues. Make sure you tell idividuals at the poit of collectio what you will do with their data ad whe you will delete it. Take a look at the 12 steps to take ow ad the Gettig ready for the GDPR self-assessmet tools o the ICO website. 8 Muckle LLP

9 Data Sharig betwee the FA, League, Clubs ad Members As part of the process mappig to uderstad the jourey persoal data takes through your club, league or Couty FA you eed to cosider how data is trasferred ad shared with the FA, ad other participats withi the game. This will differ for all orgaisatios but we believe that for most set-ups the basic data flow is: FA holds persoal data via WGS for licesig ad registratio of Players ad regulatio of the atioal game The FA (Idepedet Cotroller) FA grats access to WGS to Couty FA for regulatio ad sactioig purposes Couty Football Associatio (Idepedet Cotroller) Each participat Player ( data subject ) is the idetified o WGS by a uique FAN umber Club (Cotroller) Each Club affiliates with the FA or (i most cases) its Couty FA ad submits participat Players persoal data via Whole Game System (WGS) Each Couty FA regulates participatio by Clubs, Leagues ad Players/Members Each League affiliates with its Couty FA ad registers o WGS League(s) (Cotroller) Each Club Member submits persoal details to Club o its stadard membership form Each Club s represetative team(s) participate i League(s) ad provide participat persoal data to such League(s) as required Member/Player ( data subject ) [NB: Uder 16s = paretal / guardia coset] Participat Players are required to submit persoal data to relevat League(s) o stadard registratio sigig o form i order to be eligible to play for Club s represetative team(s) Muckle LLP 9

10 Further Help Muckle LLP have a series of hady factsheets you ca dowload from the Football Associatio sectio of their website. GDPR Factsheets Muckle LLP also has bite-size olie traiig modules which ca help you cut through the oise ad prepare your club for GDPR. You ca register here for access. Charter Stadard Clubs ad Leagues may cotiue to use the dedicated Clubs ad Leagues Legal helplie for up to 30 miutes free advice o GDPR equiries (stadard terms ad coditios of use apply). Couty FAs may (i) cotiue to use the Couty FA dedicated legal helplie for GDPR equiries (stadard terms ad coditios of use apply) ad (ii) cotact Muckle LLP directly to access up to 5 hours support o GDPR issues relatig specifically to their orgaisatio. Couty FAs Chartered Stadard Clubs ad Leagues Tel: Coutylegalhelp@TheFA.com Tel: CSLegalHelp@TheFA.com 10 Muckle LLP

11 This Guide has bee prepared based o iformatio provided by The Football Associatio Limited i order to illustrate ad commet i geeral terms oly o the law ad practice (as at date of publicatio i February 2018) relatig to the Geeral Data Protectio Regulatio (GDPR) which comes ito force effective from 25 May However, please ote that the subject matter covered is i o way exhaustive ad the material does ot stad o its ow or is it iteded to be relied upo as a substitute for obtaiig specific legal advice. The idividual circumstaces of each participat (Couty FA, League or Club) will differ. The iformatio cotaied i this publicatio is give i good faith but ay liability of The Football Associatio Limited or its professioal advisers (icludig Muckle LLP) or their respective members ad/or employees to you or ay third party which may arise out of the reliace by you or ay other party of the cotets of this publicatio is hereby excluded to the fullest extet permitted by law. The Football Associatio Limited, its professioal advisers (icludig Muckle LLP) ad their respective members ad/ or employees accept o duty of care or liability for ay loss occasioed, whether caused by egligece or otherwise, to ay perso actig or refraiig from actios as a result of ay material i this publicatio. We would strogly recommed that you cosult professioal advisers o specific issues before actig or refraiig from actio o ay of the cotets of this publicatio. Muckle LLP 11

12 Pro Boo Awards 2017: Best Cotributio by a Firm with a Eglish Regioal Head Office Heart of the Commuity Award Tyeside ad Northumberlad Top North East dealmaker sice 2014 Muckle LLP Time Cetral, 32 Gallowgate, Newcastle upo Tye, NE1 4BF DX Tel: Fax: Certificate No. EMS