7. Give people involved in the hobby instructions and training in data protection
Everyone involved in hobby activities deals with data protection in a variety of everyday situations. Everyone involved in hobby activities has responsibilities related to data protection. The hobby organiser’s level of data protection is only as good as the level maintained by the people involved in the hobby. Data protection is a permanent part of the daily work of organising a hobby, not a one-off exercise or something that can be taken care of with a couple of documents.
People with access to personal data must process it according to the controller’s instructions. For everyone involved in the processing of personal data to be able to correctly implement data protection in the hobby, the hobby organiser must ensure their competence by drawing up instructions for the processing of personal data and/or by arranging for their participation in data protection training. It is also important to give new personnel an orientation to data protection.
For the practical implementation of data protection, the club or association can draw up data protection instructions of various levels or checklists for different roles. The important thing is to emphasise the need to be careful when processing personal data and to instruct people to only process personal data for purposes related to the hobby.
You should give people guidance on confidentiality, for example, so that those involved in the hobby will not disclose information to third parties unlawfully. The non-disclosure obligation continues even after a person quits the hobby. The controller should define what ‘third-party’ means in this context.
Those involved in the hobby should be aware of the roles in which they are processing personal data in any given situation. If a person has several roles, they must know how they are permitted to process personal data in each role.
The GDPR4CHLDRN-project by the Office of the Data Protection Ombudsman and TIEKE has developed quizzes of data protection skills for those in an administrative role in associations and for coaches and instructors. The quizzes can be used to assess basic understanding of data protection. By scoring high enough on the quiz, the participant will receive a visual badge in a report to represent their data protection skills. The quizzes can be used to support the induction of new staff in associations. Those who are already involved in the association can be asked to take the quiz for example every year, and to refer to the additional material indicated in the report after the quiz.
