Since the new privacy legislation, the General Data Processing Regulation (AVG), came into force, the Personal Data Authority has received a striking number of complaints from members of sports associations. Increasingly, the balance in the sports industry is tipping to the commercial side, acting at odds with the spirit of privacy legislation.
Last week, the Personal Data Authority raised concerns about how sports associations handle members' personal data. After dozens of complaints about multiple associations, the Personal Data Authority has launched an investigation into the way one association, the KNLTB, has handled personal data in recent months. The KNLTB is being vetted in order to sharpen the rules for all unions and alert them.
Meanwhile, questions have also been raised in the House of Representatives. Van Dam of the CDA expressed concern that sports associations have sold personal data on to commercial parties and asked the Minister for Legal Protection, Mr. Dekker, how it is possible that sports associations are "missing the mark." According to Dekker, the law is clear and sufficient education has taken place regarding the new privacy rules. The minister judged, "Good that the authority is spreading the word and saying that it is going to intervene when things really go wrong."
When personal data are processed, different rules must be used:
- Always tell the data subject what you are doing (transparency principle);
- Use the data only for the purpose for which you obtained it (principle of purpose limitation);
- Do not collect, use and retain more data than you need and only when there is no less far-reaching way to achieve the same goal (data minimization);
- The more privacy-sensitive the data, the less is allowed;
- Process personal data only if based on a legal basis;
- Secure data against loss and unauthorized access;
- Arrange sufficient safeguards when personal data is disclosed to third parties.
If sports associations continue with commercial actions, without complying with privacy rules, multiple investigations and fines are imminent. For large organizations, the fine could reach 20 million euros or 4 percent of global turnover. For now, the Personal Data Authority is only targeting the KNLTB "to set a standard." When actual fines will be imposed, the size, the amount of data being processed and the financial possibilities of the associations will be taken into account. According to the chairman of the Personal Data Authority, Mr. Wolfsen, the fines "have to hurt, otherwise it won't stop."
Thus, sports associations would be wise to re-evaluate their privacy policies and increase internal awareness to avoid possible fines in the future.
Author: Arne Al
Email: aa@bmdw.nl
