SSAA Data Protection


From 25th May 2018 the laws surrounding Data Protection Act (1998) were added to, realigned and tightened by the implementation of the EU General Data Protection Regulation (GDPR).


The following outlines the terms under which we operate:


GDPR affects all organisations that collect data.


Our organisation is the Somerset Schools Athletic Association (SSAA).


Data is anything about an individual; the individuals allied to SSAA are the athletes and additionally team managers and officials.


GDPR requires that such data is ‘necessary’.


GDPR requires that organisations obtain ‘consent’ to acquire and process (use) the data obtained and that proof of the consent is retained.


GDPR states that data obtained should be stored appropriately to the nature of the information.


Within SSAA the data it is necessary to collect is related specifically to our staging of and entering into athletic championships.


The data collected will not be passed by SSAA to other individuals or organisations other than necessary data to the SSAA championship organisers, the South-West Schools Athletic Association (SWSchAA) championship organisers; English Schools Athletic Association (ESAA) championship organisers and third-parties such as programme printers, results processors and results publishers.


Data:


Name – SSAA requires an athlete’s first and last name. [see note 1]


This may be published in an event programme, will appear in results of the event, may be printed on certificates an athlete receives, may appear in historical records and may be used on promotional/souvenir garments. (3)


This will be included in entries to SSAA, SWSchAA and ESAA championships.


Sex – SSAA rarely asks for this but it is obtained through ‘default’ by an entry to, for example, a Junior Boys’ event.


DoB – SSAA requires an athlete’s date of birth.

This is necessary to ensure entry into the correct age group.

 

This will be included in entries to SSAA, SWSchAA and ESAA championships.


It will be checked by the entering championships’ organiser and double checked by the hosting championships’ organiser.


SSAA considers this to be sensitive personal information. This information will not be disclosed to anyone other than the organisers of each event, SSAA Area team managers and SSAA team managers.


SSAA will never publish dates of birth. Age data will be used and published in the results of events at the most general level, ie. age group, eg. Intermediate Girls or, simply, IG.


School attended – SSAA requires the name of the school an athlete attends.


This is needed for the receipt of entries; subsequently for the feedback of results; the notification of further selection and information relating to further championships.


 Results usually contain the representative team name: school name at Area Championships, area name at County Championships, county name at Regional Championships, county name at National Championships and Country name at International Championships.


Email address – SSAA may ask for an athlete’s contact email address.


This is the most used communication method between SSAA and an athlete.


Via emails an athlete can be informed of selection, organisation, results, and future events.


SSAA considers this to be sensitive personal information. This information will not be disclosed to anyone other than SSAA Area team managers and SSAA team managers and, where appropriate, other representative team managers eg. ESAA team managers.(2)


An athlete’s email will never be included in any mailing lists and all batch emails will be Bcc’d.


Phone number – SSAA may ask for an athlete’s contact telephone numbers.


With the use and ease of email a telephone number is becoming less important but remains essential in the case of urgency; consequently an athlete’s contact telephone number is required.


An additional contact telephone number (not the athlete’s own) is required in the case of an emergency.


Event season’s best performance – SSAA may ask for an athlete’s event season’s personal best or more usually obtain this from the results of a championship.


This information will be used within entry procedures and championships’ organisation to ensure an athlete is in the correct event heat or pool for their ability.


This will be included in entries to SSAA, SWSchAA and ESAA championships.


Athlete performances will appear in results of the event, may be printed on certificates and may appear in historical records.


Medical information – SSAA will ask for current medical information from those athletes who are representing the county at championships.


Up-to-date medication and medical conditions, such as asthma or allergies, are required so team managers are aware of possible reactions whilst travelling to championships, in overnight accommodation and food outlets and importantly during competition. If requested this information will be passed to the accredited First Aid personnel at a championships.


Up-to-date medication details are required in the eventuality that an athlete is randomly chosen to submit a urine sample for analysis by the accredited testing laboratory at an ESAA championships. (ie. a drug test.)


SSAA considers this to be sensitive personal information. This information will not be disclosed to anyone other than First Aiders, testing laboratory staff and SSAA team managers.


Necessary:


In practice this means acquired data shall be adequate, relevant, accurate, up-to-date and not kept for longer than is needed.


Data would be updated when an athlete is at the end of a competitive season; when an athlete moves up to another age group or when an athlete moves school within the County.


Data is deleted when an athlete leaves a Somerset school or when an athlete is too old for SSAA championships, unless we acquire a new consent to retain it.


Medical information is only relevant to one particular championship and is deleted immediately after its conclusion.


Consent:


An athlete’s consent allows SSAA to acquire and process data, but only if we have proof that we have prior permission to do so.


All such consents can only be given freely and unconditionally, after an athlete has been made fully aware of exactly what the data is, what it will be used for and to whom it may be passed.


GDPR states that the consent must be a ‘clear affirmative action’ and that this is ‘verifiable’.


Much of the data SSAA acquires is through ‘webforms’ contained on the SSAA website.


These contain the statement, “I fully understand that by submitting this form I am allowing my personal information (including my date of birth) to be used by Area and SSAA Team Managers during my possible selection and entry to Somerset Schools' AA,  South-West Schools’ AA and English Schools’ AA Championships.”


Linked to this statement are ‘buttons’ for the athlete to confirm they agree or disagree with the statement - requiring a clear affirmative action.


If medical information is submitted the statement, “I fully understand that by submitting this form I am allowing my personal medical information to be used by SSAA Team Managers during my participation at the South-West Schools’ AA Championships.”


Linked to this statement are ‘buttons’ for the athlete to confirm they agree or disagree with the statement - requiring a clear affirmative action.


When a webform is sent the receiving email is date stamped; meaning a log can be kept of the consent.


Participation in SSAA activities can never be conditional on an athlete consenting to giving such data, i.e. refusal cannot stop an athlete taking part.  However, without much of the necessary data it would be most difficult to enter SSAA activities.


SSAA does not use ‘cookies’ in any data transfer via the SSAA website.


[Anonymous analytics cookies: every time someone visits the website a third party organisation (at present Clustrmaps.com) generates an ‘anonymous analytics cookie’. These cookies can tell (through your IP address) whether or not you have visited the site before. This allows SSAA to view statistics of the website’s usage for information and possible future development. These statistics are readily available from the SSAA website’s Home Page.] (1)


Historical data


GDPR states that an individual has the ‘right to be forgotten’.


The saving and publishing of historical records are excluded from the regulation. However, athletes have the right to request any record of them be deleted from the SSAA website or future SSAA publications.


At SSAA events, either hosted or entered, there will be numerous photographers and thus many images of athletes taken. Many of these will be posted on social media, some in the press and some on the SSAA website. Athletes have the right to request any image of them, where they are the focus of the image, be deleted from the SSAA website or future SSAA publications.


GDPR is not focussed solely on electronic data. Paper records must also comply with the regulation.


SSAA still acquires data through paper forms. These too contain the webform statements and require a signature from the athlete to confirm they agree with the statement.


Storage:


The data SSAA acquires from an athlete, an athlete’s school teachers, or area secretaries is stored on personal computers of SSAA officers or in paper files at their premises.


GDPR requires that any statement requiring consent from children must be capable of being fully understood by a 13 year old child.


SSAA strives to make webforms, paper forms and also this document easy to read.


____________________



A comprehensive step-by-step explanation of the GDPR legislation is displayed on the webpage:

 http://www.sendentry.com/gdpr/gdpr.html


SSAA is affiliated to ESAA; on its website there is an in-depth explanation of the GDPR legislation and how it relates to ESAA activities: http://www.esaa.net/v2/info/privacy.php


The detailed information on the above two web pages has been thoughtfully compiled by Joe Lee, the Data Controller for ESAA, to whom SSAA is most grateful.


The GDPR legislation in full can be viewed on the website of the Information Commissioner's Office: https://ico.org.uk/


This is a working document particularly as SSAA may introduce new events, championships and organisational structures requiring Data Protection update.


First published March 2018


(1)   Updated 24th May 2018

(2)  Updated 15th July 2018

(3) Updated 6th October 2018





Note 1

First or last names that are ‘double’ may cause errors using computerised entry systems. These are easily eradicated by the use of apostrophes or hyphens at the initial entry/typing stage.


Eg. Simon de Wilton would become Simon Wilton. With the introduction of an apostrophe Simon de’Wilton remains as Simon de’Wilton and if need be the apostrophe can be removed at the proofing stage.


Eg. Emma Radford James would become Emma James. With the introduction of a hyphen Emma Radford-James remains and if need be the hyphen can be removed at the proofing stage.


Eg. Mary Anne Smith would become Mary Smith. With the introduction of a hyphen Mary-Anne Smith remains and if need be the hyphen can be removed at the proofing stage.


Eg. Ben James Taylor. Without a hyphen at the initial entry/typing stage: is it Ben-James Taylor or Ben James-Taylor?




Pdf download - SSAA Data Protection