Initial survey results in line with prior surveys – high demand for the project’s outputs in the field
The initial survey for the GDPR4CHLDRN – Ensuring data protection in hobbies project was carried out in November and December. The survey charted the data protection knowledge and opinions of data processing of children and young people aged 13–17, their parents and associations that organise hobby activities.
Another purpose of the survey was to collect information on data protection issues for which the target groups especially want support from the project. The project’s stakeholders – the Football Association of Finland, Finnish Olympic Committee and the Guides and Scouts of Finland – helped distribute the initial survey to the target groups. More than 250 replies were received to the survey.
The awareness of children and young people of the processing of their personal data in hobby activities varies
A total of 57 replies were received from children and young people. The children and young people who took the survey felt that they had a reasonable understanding of how their personal data is being processed in hobby activities and what rights they have over their personal data. On the other hand, a third of these respondents said that they were unable to assess their understanding. This can indicate that the subject is difficult or feels distant for children and young people.
It should also be kept in mind that the survey was openly distributed among associations that organise hobby activities, so the survey may have attracted more answers from children and young people with an interest in the subject and thus a better than average understanding of it. Based on earlier surveys on the topic (e.g. the 2019 Eurobarometer and Sitra’s Digital Profile Test, 2021), it can be assumed that there is still room for improvement in the awareness and understanding of data protection and its significance among children and young people.
Another perspective into the awareness of children and young people of the protection of personal data is provided by the fact that approximately half of the respondents had not discussed matters involving the processing of personal data with anyone during the past year. None of the children or young people who took the survey said that they have such discussions regularly. If they have thought about the subject, it has thus been mostly limited to private reflection.
The 13–17-year-olds were also asked which data protection issues they would like to know more about. The children and young people were especially interested in knowing how they could access personal data collected on them (54% of respondents) and how they could ask the party that had collected the personal data to erase it (38% of respondents). The children and young people also wanted more information on topics such as the storage periods of personal data, requesting the rectification of personal data and the bases for collecting personal data.
Development of written materials and illustrative data protection icons for children and young people will begin this spring in cooperation with the associations involved in the project. The most concrete and visible form of this cooperation will be the workshops implemented together with children and young people. The workshops will not only collect information for the project’s needs, but also provide the children and young people with more information on topics such as those identified in the initial survey.
Associations say that they understand their obligations, but there is plenty of room for improvement in their practices
The survey contained dedicated sections for people in administrative roles in associations that organise hobby activities, such as team leaders and club board members, as well as for people in instructional roles, such as instructors and coaches. A total of 99 association personnel answered the survey. Associations act as controllers when processing the personal data of their members and, as controllers, are responsible for the processing of personal data carried out in connection with their activities and the lawfulness of such processing including, for example, data processing instructions issued to instructors and coaches.
As a rule, those in administrative roles felt that their associations understood the requirements imposed on the processing of personal data by data protection legislation. On the other hand, a fourth of these respondents disagreed somewhat with the statement ”My association has defined clear procedures for taking care of data protection.”. Even though association personnel told that they understood the obligations imposed by data protection legislation on associations as controllers, challenges remain in putting the legislation into practice.
The parents, custodians or other representatives of children and young people had varying degrees of confidence in the personal data processing practices of hobby associations. A total of 105 people from this target group took the survey. A fifth of the respondents disagreed somewhat or completely with the statement ”In my opinion, the association that offers recreational activities to my child takes care of matters relating to data protection at an adequate level.”. If the associations organising hobby activities have ensured adequate data protection, the answers to the survey indicate that associations have not succeeded in communicating this to the parents of children and young people clearly.
Associations look especially to their umbrella organisations for data protection support – training still requires development
The discussions held with associations in the early stages of the project also showed that support for the application of data protection legislation has been in demand since the entry into force of the EU General Data Protection Regulation (2018). Of the respondents in administrative roles in their associations, 55% had sought help with the application of data protection legislation from their own umbrella organisation. Help had also been received from other associations (19%), service providers (19%) and the Office of the Data Protection Ombudsman (18%). On the other hand, 26% of the respondents said that they had not sought or received any help.
Associations that organise hobby activities instruct their employees and other people involved in their activities in the fulfilment of data protection obligations. A total of 59% of the respondents said that they offer individual guidance when required, while a quarter said that they never provide any instruction on the subject. The results show that there is still room for improvement in instruction and training. Guidance provided when required has the problem that people like coaches and instructors may not even realise when they should ask for instructions.
Half of the respondents in instructional roles said that they had discussed data protection once or twice in their association during the past year. Of these respondents, 21% said that they had discussed data protection on several occasions in the past year, while 18% had not discussed the subject at all.
The project will design a practical toolkit to support associations in applying data protection legislation and complying with it in their everyday hobby activities. The toolkit will be freely available on the web and will offer concrete assistance to those who are making decisions concerning data protection and thinking about data protection issues in associations.
Challenges related to data protection include motivating hobby organisers to take care of data protection, access rights to systems and the processing of allergy information
We asked those in administrative roles in their associations to list the issues they have found to be challenging in the processing of personal data. Motivating and instructing personnel to take care of data protection, the storage periods and erasure of personal data, informing data subjects about the processing of personal data, and access rights to and the maintenance of membership data were felt to be challenging subjects.
In the free-form answers the unnecessary sharing of personal data to a wide group of people through various systems was mentioned as a data protection challenge. The associations also wanted better practices for system access rights and their management.
The publication of photographs and videos in the association’s communications and on social media was seen as challenging. Especially parents who took the survey wanted the associations to pay more attention to the lawfulness of publishing photographs of children and young people, competition results and other personal data.
Both associations and parents were concerned about the processing of the health data of children and young people, either due to unnecessarily extensive processing or because the data was not available to those who actually needed it. The respondents hoped that they could rely on the data not being available to an unnecessary extent, but that people such as instructors and coaches on trips related to the hobby would still be sufficiently familiar with the health data of the children and young people.
What next?
The participants expect the GDPR4CHLDRN project to provide them with training from the fundamentals up, for example in the form of webinars and practical example cases. Those in instructional roles in their associations requested clear and practical instructions for everyday situations. Material intended for the children and young people themselves was also requested.
Based on the results of the initial survey, the project will now start designing the toolkit for supporting the application of data protection legislation as well as the icons for clarifying data protection concepts to children and young people. Feedback and comments on the deliverables will also be obtained in the workshops, in which the actual deliverables will also be piloted at a later date.
Author
Mikko Eloholma
Mikko Eloholma works at TIEKE and participates in the GDPR4CHLDRN project as an expert.