Data Protection Bill

Written evidence submitted by the Sport and Recreation Alliance (DPB13)

The Sport and Recreation Alliance

The Sport and Recreation Alliance believes that the power of sport and recreation can change lives and bring communities together. Together with our members and in partnership with the wider sector, we make the most of opportunities and tackle the areas that provide a challenge. We provide advice, support and guidance to our members and the sector, who represent traditional governing bodies of games and sport, county sports partnerships, outdoor recreation, water pursuits, and movement and dance exercise. As the voice of the sector, we work with Government, policy makers and the media to make sure grassroots sport and recreation grows and thrives. Having an active nation is important as it delivers huge benefits to society and the millions of participants, volunteers, staff and spectators.

Summary

1. The Sport and Recreation Alliance represents over 300 sports organisations in the UK, many of which are the national governing bodies of sport (NGBs) for some of our largest national sports including the British Horseracing Authority (BHA), British Swimming, Swim England, the England and Wales Cricket Board (ECB), The Football Association (The FA) and the Rugby Football Union (RFU).

2. The Alliance and its member organisations have a particular interest in the Data Protection Bill given the regulatory role that NGBs play in protecting sport from threats to integrity – notably doping and betting corruption – and in ensuring fair competition. NGBs need to process a range of personal data so that they can carry out these regulatory functions effectively and in a way that gives participants, spectators and the wider public confidence that sport is fair, clean and free from corruption.

3. In this context, it is critical that the Data Protection Bill ensures that NGBs have a firm legal basis on which to process sensitive data in order to fulfil their regulatory functions. Our main concerns with the Bill as currently drafted relate to two specific aspects of the provision which provides for the processing of data for integrity purposes (Schedule 1 Para 23):

· Consent is not a workable legal basis on which to process data in a sports regulatory context given the potential detriment which may be suffered by someone found in breach of a sports rules, for example as a result of a ban from competition. However, as drafted, the existing integrity provision may still require NGBs to seek consent in most circumstances – a position which could be considered unlawful and which could potentially restrict an NGB’s ability to protect the integrity of sport. This is an anomalous position and one we believe should be rectified in the Bill to make it crystal clear that sports bodies can process data for integrity purposes without the need for consent.

· In certain sporting contexts, notably disability sport, governing bodies need to process medical data in order to ensure fair competition between competitors, for example by making sure athletes are eligible to compete in the correct category in para-sports. As above, consent is not a valid ground for such processing as the individual concerned may face detriment (exclusion from competition) if they were to withhold this data. However, processing data for the purposes of assessing eligibility is not currently included as a specific heading within the integrity provision and we believe it should be added so that NGBs can process sensitive data to ensure fair competition.

4. These concerns are explained in more detail below, alongside illustrative examples of the problems which would arise in the absence of changes to the legislation. We have put forward specific amendments to the integrity provision in the annex to this submission which we believe address these issues in a sensible and pragmatic way and we strongly encourage the Committee to implement the proposed amendments to put the legal position of sports governing bodies beyond doubt and ensure the public can continue to have confidence in the integrity of sport in the UK.

Sport’s concerns with the existing drafting of the Bill

Schedule 1 Paragraph 23(1)(b): a flawed provision if consent is still required

What should the provision do?

5. This provision, described in the Bill as the provision discussing "standards of behaviour in sport", is intended to allow governing bodies and others to process sensitive data about participants such as athletes, coaches and administrators where this is necessary to protect the integrity of a sport or sporting event. The condition should allow sports to process sensitive data without consent to robustly and proactively combat match-fixing, protect participants against racism and prevent corruption.

What is the problem?

6. As drafted, the condition only allows governing bodies to process sensitive personal data without consent in situations where they are unable to seek it (for example because the person cannot be contacted) or where asking for consent would tip-off a suspect. In all other circumstances, governing bodies must still ask participants for consent to process sensitive personal data for integrity purposes.

7. The GDPR states that consent is only valid where it is freely given; and that consent will not be freely given if an individual will suffer detriment if he or she refuses or withdraws consent. Data protection authorities (in the Article 29 Working Party) have recently issued guidance stating that consent can never be valid where failure to agree would or could result in a substantial disadvantage - such as a ban on participation in a sport.

8. The current drafting therefore requires governing bodies to run their integrity activities in a way which is invalid and likely unlawful under data protection law. Without change, the condition may not provide a valid basis for governing bodies to carry out their integrity functions.

Example

9. Enforcement against serious misconduct by both amateur and professional participants may involve the processing of sensitive data – whether this is evidence relating to a victim’s ethnicity in cases of discrimination, information about a medical condition processed as part of a participant’s defence, or details of a source’s criminal history that is needed so a governing body can assess the reliability of their intelligence.

10. Consents have typically been sought from participants when they first register their involvement in a sport. This could never be obtained without there being a potential detriment to the participant if they refuse – because they could be barred from participating if they don’t accept a sport’s rules. To rely on the provision as it is currently drafted, a sport would need to seek consent, and then inform participants that they will rely on paragraph 23 when consent is withdrawn and withheld. This would require "switching" between legal grounds for processing – something that both the ICO and Article 29 Working Party say is prohibited – and an illogical process.

How can it be fixed?

11. Any safeguard that would require sports to seek consent here would make the provision unworkable under GDPR. Schedule 1 para 23(1)(b) should be removed, so that sports do not need to try and seek consent before they can rely on this provision to allow their important integrity processing.

Schedule 1 Paragraph 23(2): a missed opportunity to protect disability sport

What is the problem?

12. The recent guidance on consent has also made it clear that governing bodies will be unable to rely on consent to process health data to determine an athlete’s eligibility for a particularly sport or competition. Although such data would be provided voluntarily, an athlete’s consent cannot be a valid basis for holding or processing such data under the GDPR because they could be prevented from participating.

13. In disability sport in particular, it is crucial that governing bodies can process health data. As recently addressed in the Commons’ DCMS Select Committee inquiry into sports governance, it is vital that classifications in disability sport are made on appropriate scientific grounds so that talent and dedication are the determining factors in an event, rather than the severity of the athlete’s impairment. Without access to medical information, accurate and fair classifications cannot take place.

Why is this not covered by the existing Paragraph 23?

14. Eligibility processing is vital to ensure a sport’s integrity – a sport cannot be fair unless it can ensure that competitors are not put at unfair disadvantage compared to their peers. Unfortunately, the existing integrity provision discussed above is not a valid alternative to consent in its current form. This is because the "measures designed to protect integrity" defined in the existing condition must address misconduct, dishonesty or breaches of rules on behaviour, not the use of data to ensure fair and equal competition where an athlete is not at fault.

Example

15. British Swimming classifies disabled swimmers, using medical data provided directly by the swimmer, by their medical professional and evidence collected and created by its qualified classifiers in assessing intellectual, physical or visual impairment and technical impairment at classification sessions. Detailed processes are in place to ensure that this classification is fair and carried out by appropriately qualified individuals.

16. Currently, such classifications rely on the athlete’s consent. If a swimmer withdrew or withheld his or her consent, then British Swimming would be unable to allow them to compete in its competitions under a relevant classification. This would be considered a detriment, and therefore any consent given by the athlete must be invalid.

How can this be fixed?

17. A small amendment – adding to the list of integrity topics in paragraph 23(2) - would fix this problem, and no separate legal condition would be required. If addressed now, governing bodies could appropriately prepare their processes and notices in advance of 25 May and the deadline for GDPR compliance.

18. Failure to amend the provision to permit such processing would have a major detrimental impact on inclusive sport.

March 2018

Annex: Proposed amendments

Schedule 1, page 131, line 18, leave out sub-paragraph (b)

Explanatory statement:

The existing condition would require the affected data controllers to seek consent where this would be invalid under the GDPR. To ensure that sports can carry out important public interest activities in preventing match fixing and protecting participants from racism and corruption, appropriate bodies must be able to process sensitive personal data for these purposes without consent. This condition should be removed as an inappropriate safeguard.

Schedule 1, page 131, line 28, at end insert –

"( ) risks to fair and equal competition"

Explanatory statement

Integrity of sports goes beyond misconduct and misbehaviour, and addresses the very fairness of competition. This is particularly important in disability sport, to ensure that talent and dedication are the determining factors, not the severity of an athlete’s impairment. The addition of this sub-paragraph to the list of integrity topics that justify the processing of sensitive data will allow data controllers to ensure that athletes are competing in an appropriate category and event based on fair and legitimate medical evidence.

 

Prepared 12th March 2018