Tackling Privacy at the Rugby World Cup

The Rugby World Cup starts tomorrow, and given how close the top teams are, it promises to be a closely fought competition (I predict South Africa to win it). As millions travel to France to attend the matches (1.7 million people attended the tournament in 2019) and the world’s sporting eyes descend on the tournament, it had me wondering, what right to privacy do people have under the GDPR (both UK and EU) when they attend sporting events.

What does the GDPR say?

Media and sporting organisations continue to embrace data-driven technologies to enhance fan engagement, reporting and event operations. However, this data collection raises concerns about the privacy rights of individuals attending tournaments. To deal with this scenario, Article 85 GDPR provides the framework for safeguarding data privacy while allowing for the needs of the sporting event to be met.

Article 85 tackles the importance of balancing the right to the protection of personal data with rights to freedom of expression and information, including in the context of sports. It recognises that sporting organisations, like World Rugby, and the media have a genuine interest in reporting on matches and broadcasting information to the public. Consequently, Article 85 allows for certain exemptions from some GDPR provisions to accommodate these sporting interests.

What are these exemptions?

Article 85 provides EU member states and the UK with flexibility to introduce specific national laws (e.g. Data Protection Act 2018 in the UK) that removes some GDPR rules for the purposes of journalistic endeavours. 

The range of potential exemptions in Article 85 is extensive and covers some fundamental GDPR rights and obligations.  In the UK, for example, Part 5 of Schedule 2 of the Data Protection Act 2018 allows for an exemption on requiring a lawful basis, obtaining valid consent and complying with safeguard requirements for data transfers outside the UK. However, the journalistic exemption does not provide a blanket exemption to the GDPR but requires the publishing organisation to balance public interest with the fundamental rights and freedoms of individuals. Furthermore, in making this assessment, the publishing organisation will also have to take into account any relevant national codes of practice (e.g., BBC Editorial Guidelines and the ICO’s new Code of Practice on Journalism, which will have statutory force when it comes into force in the UK).  

Given the flexibility introduced under Article 85, the application and interpretation of the journalistic exemption will vary between different EU member states and the UK, and so it is important for media organisations to carefully consider how they handle personal data while engaging in journalistic activities to ensure compliance with the GDPR, national laws, relevant codes of practice, the incoming European Media Freedom Act (EU only) and the principles of responsible data processing.  

Who qualifies as a journalist?

A question which has sparked some debate is whether all types of journalists, such as bloggers, can rely on the journalistic exemption. This question was deliberated on in 2019 by the Court of Justice of the European Union (CJEU) in the case of Sergejs Buivids v. Datu valsts inspekcija, where the CJEU stated that the notion of ‘journalism’ should be interpreted broadly and the fact that Mr Buivids was not considered as a journalist under national law could not automatically stop him from relying on the journalistic exemption. 

This CJEU decision will potentially be put to the test during the Rugby World Cup as it directly conflicts with the national laws of France where a sports blogger is not considered as a professional journalist and, therefore, does not benefit from the journalistic exemption. 

Which national law applies?

With Article 85 allowing each EU member state to exempt parts of the EU GDPR in accordance with its own national laws, the question is, which national law applies if you are reporting in one EU member state about a sporting event held in another EU member state (not relevant to the UK)? 

In the recitals of the EU GDPR, it states that where a journalistic exemption differs from one EU member state to another, the law of the EU member state to which the controller is subject should apply. This means that when the Rugby World Cup is being reported by a Belgian media outlet, then the laws of Belgium will take precedence over French laws.

How do organisations comply?

As we have seen, Article 85 does not provide media or sporting organisations with blanket permission to process personal data without any regard for privacy. To rely on the journalistic exemption, they must be able to demonstrate compliance with the GDPR and journalistic exemptions set out in national laws.  Whether or not the journalistic exemption applies often involves nuanced decision making. It will be easier for an organisation to demonstrate compliance with these data protection laws if appropriate policies and procedures are in place, as well as evidence of how decisions are reached.