Personal data is routinely processed in connection with amateur sports. Processing often continues after the event has been held. For example, text message (SMS) services may be offered giving competitors' latest and final placings, results may be published on the Internet, or lists of competitors may even be passed on to sponsors to allow them to distribute advertising material. From a data protection standpoint, however, some of these processing activities may be problematic. The following explanations are intended to show where problems can arise and how to handle competitors' data correctly.
The problem with additional processing activities
Competitors are no doubt aware that a certain amount of data processing is needed for a sports event to run smoothly. Clearly, the data that is obtained from competitors registering for an event will be used to compile starting or results lists. In addition, as sports events are normally public occasions, it is reasonable that the results should be made public, whether on a scoreboard or by announcement over a loudspeaker. This type of data processing is also justified by the event organiser's private interest in running the event successfully.
The situation is different when it comes to any further data processing. Publishing results on the Internet or sending text messages to third parties with the latest and final results is not essential for running a sports event and is not something that the competitors may necessarily be aware of. And providing data to third parties for advertising purposes or similar has nothing to do with the original purpose of the data collection and is cannot be justified by claiming it contributes to the smooth running of the event. This is also the case when the sponsors have made their financial support dependent on competitors' data being handed over. It should be assumed that competitors register for events trusting that their data will only be used to organise the event and certainly not that it will be made accessible to third parties for some other purpose.
These additional activities by the event organiser violate the principles of proportionality, transparency and good faith under data protection law. It therefore follows that such activities may only be carried out if the competitors concerned have not objected to this type of data processing.
Data protection requirements
When data processing is not essential for running a sports event, it may only be carried out if the competitors concerned have given their consent. Event organisers must therefore comply with the following rules in order to avoid any unlawful violation of competitors' privacy rights:
1. During the registration process, competitors must be informed comprehensively and clearly of the following:
- why personal data is being processed (e.g. to organise or report on the event or for advertising purposes, etc.);
- how starting lists and results will be published (Internet, newspapers etc.);
- whether data will be passed on to third parties. The reasons for passing on data and the recipients of the data should be given, at least in categories (e.g. sponsors, subscribers to SMS services, photographers, etc.);
- whom competitors should contact if they have any further questions.
2. This information can be included in the event conditions or regulations or in a separate data protection declaration. The information must be made available to participants when they register for the event (e.g. on a separate sheet or, in the case of online registration, by providing a link on the registration form).
3. If data is to be passed on to third parties, notice of this must also be given on the registration form.
4. When registering, competitors must be given the opportunity to refuse to allow data processing that is unnecessary for running the event. The easiest way to do this is to provide on the registration form a box that can be ticked or details of a person to be contacted. It must be possible to refuse to allow the following specific forms of processing:
- publication of the competitor's name on the Internet (e.g. when publishing the starting list or results)
- providing data to third parties (e.g. sponsors, subscribers to SMS services, etc.)
5. Competitors must be able to have their data deleted at any time from results published on the Internet. The process must be easy and free of charge, with competitors simply having to identify themselves and provide sufficient details of the information they wish to see deleted (e.g. the list of results concerned).