GDPR Experts - Photos to play sport?
Discussion
Boring question sorry, but I've been asked to supply a passport photo and Date of Birth if I want to play for a local sports team so they can give it to the league to hold on a third party website. It's essentially to stop some of the less honest teams fielding ineligible players.
I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
there talking b
ks and opening themselves up to a big fine
The term is defined in Art. 4 (1). Personal data are any information which are related to an identified or identifiable natural person. ... For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.
so a photo and a name is defiantly personal data
i suspect providing they are following GDPR they can insist on a photo
ks and opening themselves up to a big fineThe term is defined in Art. 4 (1). Personal data are any information which are related to an identified or identifiable natural person. ... For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.
so a photo and a name is defiantly personal data
i suspect providing they are following GDPR they can insist on a photo
Edited by Dave Hedgehog on Friday 6th September 14:31
paulrockliffe said:
Boring question sorry, but I've been asked to supply a passport photo and Date of Birth if I want to play for a local sports team so they can give it to the league to hold on a third party website. It's essentially to stop some of the less honest teams fielding ineligible players.
I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
surely two different issues:I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
1 - do they comply with GDPR in how they handle the photos etc.
2 - do they choose that only those with a photo on the website can play
not sure how the two are linked directly - you might have justification in getting them to tighten up their approach, but in telling them how to choose their teams - not so likely...
it does sound as though they have provided the basis for the need - if you want to play, then we have a verification system in place, your photo is needed... not sure that is all that different to a workplace insisting on photo ID. They have asked for consent in as much as if you agree to play then you give consent...
doesn't sound all that unusual for an amateur sports set up - if it is important to you that they do it differently and that you play, then you might need to get involved in running the league - saying that you will dob them into the ICO won't get you very far, and I can't imagine that the ICO will be terribly interested...
I think they'd be hard pressed to argue that photo plus DoB isn't personally identifiable info in this age of facial recognition. Presumably it's + name as well.
I don't think they need a DPO, but I would say they do need a privacy policy and a consent mechanism. But none of that helps you really, just keeps them out of trouble.
In practical terms, does it bother you or not. If so, refuse to give the info. If they say you can't play, then you could fight that or not, up to you.
Bert
I don't think they need a DPO, but I would say they do need a privacy policy and a consent mechanism. But none of that helps you really, just keeps them out of trouble.
In practical terms, does it bother you or not. If so, refuse to give the info. If they say you can't play, then you could fight that or not, up to you.
Bert
Sorry, I'm not sure I was clear in my question; it is the League that are requiring the information and choosing to bar anyone from playing that doesn't supply a photo. The club are enforcing that by asking for the data to then pass onto the League or their third-party.
Whats the view on the requirement for only data that is necessary and proportionate to be collected?
We already supply name, address, DOB, medical conditions, so lots of personal info. I don't know about general compliance with GDPR, though I suspect it's all held on the third-party system rather than with the league or the club and that's reasonably professional, so probably compliant.
I read there was a requirement to make the legal basis available, I wondered what the legal basis would be for requiring a photo to make it a bit easier to enforce an eligibility rule that can be enforced in other ways and has been enforced in other ways for decades?
My instinct is that they shouldn't have or need the photo and that it's not necessary or proportionate to do it this way.
Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
Whats the view on the requirement for only data that is necessary and proportionate to be collected?
We already supply name, address, DOB, medical conditions, so lots of personal info. I don't know about general compliance with GDPR, though I suspect it's all held on the third-party system rather than with the league or the club and that's reasonably professional, so probably compliant.
I read there was a requirement to make the legal basis available, I wondered what the legal basis would be for requiring a photo to make it a bit easier to enforce an eligibility rule that can be enforced in other ways and has been enforced in other ways for decades?
My instinct is that they shouldn't have or need the photo and that it's not necessary or proportionate to do it this way.
Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
BertBert said:
I think they'd be hard pressed to argue that photo plus DoB isn't personally identifiable info in this age of facial recognition. Presumably it's + name as well.
I don't think they need a DPO, but I would say they do need a privacy policy and a consent mechanism. But none of that helps you really, just keeps them out of trouble.
In practical terms, does it bother you or not. If so, refuse to give the info. If they say you can't play, then you could fight that or not, up to you.
Bert
My understanding is if they rely on consent, I'm not obliged to provide it and they can't treat me differently if I don't provide it? If they want to, they need a different legal basis for requiring the photo, I don't know if that exists.I don't think they need a DPO, but I would say they do need a privacy policy and a consent mechanism. But none of that helps you really, just keeps them out of trouble.
In practical terms, does it bother you or not. If so, refuse to give the info. If they say you can't play, then you could fight that or not, up to you.
Bert
I deliberately asked a legal question rather than a practical one as it only applies for the 1st team at the moment, not my team. On principle I don't like the idea that someone with legitimate reasons for not wanting to have their picture on this website would be told they can't then play hockey. It's clearly not essential to prove identification to that level of reliability, it's still open to abuse and there are other ways of doing it that don't involve publishing the data at all.
paulrockliffe said:
Sorry, I'm not sure I was clear in my question; it is the League that are requiring the information and choosing to bar anyone from playing that doesn't supply a photo. The club are enforcing that by asking for the data to then pass onto the League or their third-party.
Whats the view on the requirement for only data that is necessary and proportionate to be collected?
We already supply name, address, DOB, medical conditions, so lots of personal info. I don't know about general compliance with GDPR, though I suspect it's all held on the third-party system rather than with the league or the club and that's reasonably professional, so probably compliant.
I read there was a requirement to make the legal basis available, I wondered what the legal basis would be for requiring a photo to make it a bit easier to enforce an eligibility rule that can be enforced in other ways and has been enforced in other ways for decades?
My instinct is that they shouldn't have or need the photo and that it's not necessary or proportionate to do it this way.
Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
It goes back to the question of why you are worried about the photo? If they hold lots of personal info which you are happy with, why does holding the photo offend you? And does it offend you enough to stop you playing their game?Whats the view on the requirement for only data that is necessary and proportionate to be collected?
We already supply name, address, DOB, medical conditions, so lots of personal info. I don't know about general compliance with GDPR, though I suspect it's all held on the third-party system rather than with the league or the club and that's reasonably professional, so probably compliant.
I read there was a requirement to make the legal basis available, I wondered what the legal basis would be for requiring a photo to make it a bit easier to enforce an eligibility rule that can be enforced in other ways and has been enforced in other ways for decades?
My instinct is that they shouldn't have or need the photo and that it's not necessary or proportionate to do it this way.
Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
Bert
BertBert said:
It goes back to the question of why you are worried about the photo? If they hold lots of personal info which you are happy with, why does holding the photo offend you? And does it offend you enough to stop you playing their game?
Bert
Like I said, my question is legal rather than practical. I don't mind registering with the league and them holding the information. But to be able to use my photo to stop other clubs playing ineligible players, they need to publish my photo to whatever audience is going to enforce those rules, I don't want that to happen and I object to what I think is a disproportionate approach to a minor issue.Bert
From a practical point of view, if I was directly affected I would provide my photo, play and then challenge the league to try to get the rules changed.
paulrockliffe said:
My instinct is that they shouldn't have or need the photo and that it's not necessary or proportionate to do it this way.
Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
If there is an issue with ringers or identity, then they can clearly identify a need for a photo - I see no GDPR issue in identifying need...Given it's a very amateur organisation, I'm tempted to comply and then go onto the website and change my photo to a picture of someone else that plays for a different club, I'm sure they'll just be using that rather than publishing elsewhere.
If you change your photo as you suggest, then you are probably in a dodgier position then they are!
I think it comes down to play by their rules, or don't play in the league - clearly they are trying to deal with an issue they have, why would you not wish to help?
paulrockliffe said:
Boring question sorry, but I've been asked to supply a passport photo and Date of Birth if I want to play for a local sports team so they can give it to the league to hold on a third party website. It's essentially to stop some of the less honest teams fielding ineligible players.
I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
The Club will be Data Controller as far as its own players are concerned. Whether it has a DPO or not, it is bound by the GDPR.I assume it will 'work' by letting everyone see who everyone is so if there's an issue everyone can bicker about whether it was the person on the website or not.
I'm not bothered in principle, but the league is a shambles and I don't think people should be being barred from playing because they don't want their photo publishing. It seems a disproportionate response to what is a minor issue.
I've asked the Club about it, they say they don't need a Date Protection Officer, that Photos aren't Biometric Data, that it isn't being processed. They've not asked for consent, provided information on how the data is being stored and moved to the third party or provided the legal basis for requiring the data.
Does anyone know what the legal position is if I say I'm not going to consent to my picture being held and published, but I'm going to play anyway?
Sorry, I know that's very boring for a Friday!
The League will be a Data Controller as well in respect of all the member Clubs if it keeps all or part of the same data.
The third party website in this case will be a Data Processor.
https://www.ascentor.co.uk/2017/06/gdpr-data-prote...
The bit in bold is, imo, a clear breach.
The League will have a legitimate purpose in weeding out ineligible players.
Whether the publication of a photo on a website is proportionate to that aim is something else.
Particularly if it is accessible by the public at large.
You are perfectly entitled to withhold your consent but you might find the League tries to bar you from playing.
Your Club is in a cleft stick because it has to abide by the rules of the League.
I have found that many amateur organisations and small companies remain completely clueless about GDPR.
If it is a condition of joining the club to play that you provide a photo that goes public and you agree to that at the start then I don't think arguments around consent and proportionality are going to help you - I suspect those are there to stop things being done with your data that you don't expect rather than something you consent to.
paulrockliffe said:
BertBert said:
It goes back to the question of why you are worried about the photo? If they hold lots of personal info which you are happy with, why does holding the photo offend you? And does it offend you enough to stop you playing their game?
Bert
Like I said, my question is legal rather than practical. I don't mind registering with the league and them holding the information. But to be able to use my photo to stop other clubs playing ineligible players, they need to publish my photo to whatever audience is going to enforce those rules, I don't want that to happen and I object to what I think is a disproportionate approach to a minor issue.Bert
From a practical point of view, if I was directly affected I would provide my photo, play and then challenge the league to try to get the rules changed.
Bert
Why do some people insist on making life difficult?
I can absolutely see the need for photos (my local non-league semi-pro club were kicked out of the FA Cup for an ineligible player infringement more than once!) - if you don't like it, then you are free not to play.
I'm a running coach, so I'm sure my photo appears in a few places. I don't really care. In fact, I am more than happy with the situation, as it gives people confidence in what I'm doing.
I can absolutely see the need for photos (my local non-league semi-pro club were kicked out of the FA Cup for an ineligible player infringement more than once!) - if you don't like it, then you are free not to play.
I'm a running coach, so I'm sure my photo appears in a few places. I don't really care. In fact, I am more than happy with the situation, as it gives people confidence in what I'm doing.
I was an official at a sports club - not association football - and the association treated personal data carelessly.
I brought various situations where they did not conform to regulations to their attention and I was ignored. The website security was farcical, and this was updated in a manner that exposed the personal data to those who had no business with it. This included personal data of children. In the end I gave up my role as, I felt, I was being complicit.
My club conformed as well it could but data we supplied was not being deleted after it was of no relevance. 'We're allowed to . . .' I was told.
My belief is that you'll get nowhere by trying to get them to conform to the regs.
I considered reporting the umbrella organisation to the ICO. I'm not sure why I didn't.
I brought various situations where they did not conform to regulations to their attention and I was ignored. The website security was farcical, and this was updated in a manner that exposed the personal data to those who had no business with it. This included personal data of children. In the end I gave up my role as, I felt, I was being complicit.
My club conformed as well it could but data we supplied was not being deleted after it was of no relevance. 'We're allowed to . . .' I was told.
My belief is that you'll get nowhere by trying to get them to conform to the regs.
I considered reporting the umbrella organisation to the ICO. I'm not sure why I didn't.
It shouldn't be publicly listed, it should just be for league officials to access.
Shouldn't have to publicly disclose your data to play in an amateur league. What are they thinking?
With GDPR at the moment there are no definites because nothing has really been tested and it's very easy to interpret parts in different ways.
Best of asking the ICO for advice imo.
Shouldn't have to publicly disclose your data to play in an amateur league. What are they thinking?
With GDPR at the moment there are no definites because nothing has really been tested and it's very easy to interpret parts in different ways.
Best of asking the ICO for advice imo.
Even the lowest level development football leagues have to use the FA’s “whole game system” now to register players to specific leagues and prevent unauthorised transfers of players between different clubs or dual registration to multiple teams in the same league/age group. The ID photo is an FA requirement for registration and will be held on the FA’s system not your local club’s.
The leagues enforce rules about players needing to be registered on the FA system and can/will take steps to ensure unregistered players from taking part. Again this is not your own club being awkward.
Lastly, the photos are not published nor accessible by anyone except your approved team officials; their job is to have a printout of the team sheet available for inspection by opposing teams or league officials before a match, ie.e those with a a legitimate interest in the data. The printout simply shows a thumbnail image of each player registered for that team alongside name and date of birth.
The leagues enforce rules about players needing to be registered on the FA system and can/will take steps to ensure unregistered players from taking part. Again this is not your own club being awkward.
Lastly, the photos are not published nor accessible by anyone except your approved team officials; their job is to have a printout of the team sheet available for inspection by opposing teams or league officials before a match, ie.e those with a a legitimate interest in the data. The printout simply shows a thumbnail image of each player registered for that team alongside name and date of birth.
Mojooo said:
If it is a condition of joining the club to play that you provide a photo that goes public and you agree to that at the start then I don't think arguments around consent and proportionality are going to help you -
What you have overlooked is that he is already a member and the Club, presumably bowing to the League, is now moving the goalposts. If you read what he wrote earlier you'll notice that he hasn't consented. Indeed the Club/League doesn't appear to have even got the fundamentals right.
Mojooo said:
I suspect those are there to stop things being done with your data that you don't expect rather than something you consent to.
Expectation doesn't come into it. GDPR places obligations on the Data Controller vis-a-vis the individual (the Data Subject).Consent is a key element (it cannot be assumed) - https://ico.org.uk/for-organisations/guide-to-data...
If the League is relying on Legitimate Interest it has to show that the objective cannot be achieved by another less intrusive route.
Of course if you withhold consent then you may find yourself at a disadvantage.
However it doesn't prevent you mounting a challenge on the grounds of proportionality and/or compliance.
See Derek Smith's post
.
chrisch77 said:
Even the lowest level development football leagues have to use the FA’s “whole game system” now to register players to specific leagues and prevent unauthorised transfers of players between different clubs or dual registration to multiple teams in the same league/age group. The ID photo is an FA requirement for registration and will be held on the FA’s system not your local club’s.
The leagues enforce rules about players needing to be registered on the FA system and can/will take steps to ensure unregistered players from taking part. Again this is not your own club being awkward.
Lastly, the photos are not published nor accessible by anyone except your approved team officials; their job is to have a printout of the team sheet available for inspection by opposing teams or league officials before a match, ie.e those with a a legitimate interest in the data. The printout simply shows a thumbnail image of each player registered for that team alongside name and date of birth.
This makes a lot more senseThe leagues enforce rules about players needing to be registered on the FA system and can/will take steps to ensure unregistered players from taking part. Again this is not your own club being awkward.
Lastly, the photos are not published nor accessible by anyone except your approved team officials; their job is to have a printout of the team sheet available for inspection by opposing teams or league officials before a match, ie.e those with a a legitimate interest in the data. The printout simply shows a thumbnail image of each player registered for that team alongside name and date of birth.
Forums | Speed, Plod & the Law | Top of Page | What's New | My Stuff