Skip to content
Tietosuoja haltuun harrastustoiminnassa -hankkeen logo, jossa on tietosuojalainsäädäntöön ja lapsiin liittyvä kirjainlyhenne GDPR4CHLDRN. Tietosuoja haltuun harrastustoiminnassa -hankkeen logo, jossa on tietosuojalainsäädäntöön ja lapsiin liittyvä kirjainlyhenne GDPR4CHLDRN.
Search
  • English
    • Suomi
    • Svenska
    • English
  • Front page
  • Guiding materials
    • Board of the association
    • Coaches and instructors
    • Parents
    • Children and young people
  • Material bank
    • Term bank
    • Quizzes
    • Downloadable materials
    • Data protection icons 
    • Articles
  • Information on the site
  • English
    • Suomi
    • Svenska
    • English
  • Front page
  • Guiding materials
    • Board of the association
    • Coaches and instructors
    • Parents
    • Children and young people
  • Material bank
    • Term bank
    • Quizzes
    • Downloadable materials
    • Data protection icons 
    • Articles
  • Information on the site
Search
  1. Front page
  2. Board of the association
  3. Why is the protection of personal data important?
  4. 1. Privacy is a fundamental right
Skip to page content

Board of the association

  • Starting page
  • Why is the protection of personal data important?
    • 1. Privacy is a fundamental right
    • 2. Sensitive personal data requires particularly careful protection
    • 3. Personal identity codes may only be processed if necessary
  • What roles are involved in processing?
    • 1. The controller is responsible for the processing of personal data
    • 2. A processor acts on behalf of the controller
  • What principles must be observed in the processing of personal data?
    • 1. Take data protection into account from the start and in all circumstances
    • 2. Processing requires a basis
      • 2.1 Legal bases for processing personal data
      • 2.2 Consent requires an indication of the participant's wishes
      • 2.3 Consent from minors
    • 3. Only use personal data for the planned purposes
    • 4. Inform data subjects transparently of the processing of personal data
    • 5. Only process necessary personal data
    • 6. Only process accurate personal data and rectify inaccurate data
    • 7. Ensure the security of processing
    • 8. Define storage periods for personal data and erase unnecessary data
      • 8.1. Storage period
      • 8.2. Storage location
      • 8.3 Erasure 
    • 9. Demonstrate compliance with data protection legislation
  • What obligations does a hobby organiser have in the processing of personal data?
    • 1. Fulfil the participants' data protection rights
    • 2. Describe the hobby organiser's processing of personal data with a record of processing activities
    • 3. Agree on processing
    • 4. Assess the risks and impact of processing
    • 5. Report personal data breaches
    • 6. Only transfer personal data out of the EU if the conditions are met
    • 7. Give people involved in the hobby instructions and training in data protection
    • 8. Manage the life cycle of personal data from planning to collection, storage and erasure
  • What should you take into account when publishing photos and videos?
  • What should you take into account when processing health data in hobby activities?
  • What should you take into account when disclosing personal data in hobby activities? 
  • Annex 1: Consent form - template
  • Annex 2: Comics to inform about data protection

1. Privacy is a fundamental right

The icon features a person holding a flag with a closed padlock on it. The icon is surrounded by a light green frame. The icon is used to indicate that the situation involves the processing of personal data subject to data protection legislation.

Privacy is a fundamental right. Children, young people and their parents must be able to feel secure that the law is being followed in the processing of their personal data also in hobby activities. The hobby organiser has an important role in ensuring data protection and establishing good practices. When data protection is in order, everyone can focus on the hobby and rest assured that their personal data are in good hands.

What does data protection mean?

Data protection safeguards the right to privacy. Data protection is a fundamental right that safeguards the rights and freedoms of people in the processing of personal data. Data protection also aims to prevent damage from the inappropriate processing of personal data to the people whose personal data are being processed in the hobby activities.

What are personal data?

Personal data refers to all data related to an identified or identifiable person. Directly identifiable personal data include the personal identity code, uncommon names, and photographs featuring the person, while people can be identified indirectly from data such as their address and date of birth. Combining different data can result in personal data if the individual can be identified from the combined data.

What does data protection legislation mean?

Data protection legislation sets the framework for when and how personal data can be processed. The hobby organiser must take the requirements of data protection legislation into account in its activities when processing various kinds of personal data.

Data protection legislation consists of the EU General Data Protection Regulation (EU 2016/679), Finland’s national Data Protection Act (1050/2018), and special legislation providing for matters such as processing patient records or the personal data of employees.

Many kinds of personal data, such as names, personal identity codes, addresses, allergy information, bank account numbers, dates of birth, photographs and videos are processed in hobby activities. Personal data processed in hobbies can include the data of participants and their custodians, employees, volunteers, instructors, coaches and Board members. Such processing includes the collection, use, viewing, transfer, disclosure and storage of personal data.

Everyone involved in hobby activities plays an important role in ensuring compliance with data protection requirements, since many stages of hobby activities involve the processing of personal data in one way or another. Depending on the hobby, personal data can be processed in connection with registering for camps, organising competitions, paying licence fees, and informing members about practice schedules. Personal data can be processed in various electronic systems, on paper, or with a variety of technical devices, such as smart phones and computers.

The hobby organiser must take the nature of the activity into account when choosing processing methods. For example, personal data may have to be processed on paper during a scouts’ hike in the woods, when access to electronic personal data is limited, in which case the organiser has to comply with the requirements for processing personal data on paper.

Who is a data subject?

The data subject is the person to whom the personal data relates. In hobbies, data subjects include club members, Board members, club employees, volunteers, team managers and the custodians of club members.

Why must the hobby organiser comply with data protection legislation?

Compliance with data protection legislation is just as mandatory as following any other law, for example when doing your club’s accounts. When processing is meticulous and legal, the hobby activities run smoothly, personal data are accurate and up to date, decisions are based on correct information, and emails get sent to the right addresses. When that is the case, the participants can also rest easy knowing that the hobby organiser is complying with the law.

Neglecting data protection can cause financial losses, reputation damage and unnecessary work to the hobby organiser. Trust in the hobby organiser can suffer if people are not sure what their personal data is being used for or who it is being disclosed to. Shortcomings in processing can cause reputation damage and financial losses to club members as well.

Data protection rights apply to every child and young person too. When a hobby activity is being organised for children, the organiser must remember that it is processing the personal data of children. Children’s personal data must be protected especially carefully, because children are not always aware of the risks and consequences of processing or of their rights and ways of safeguarding their data.

The purpose and rules of the hobby organiser’s (such as a sports club, craft club or scout troop) activities determine which personal data it needs to collect from participants. The hobby organiser must evaluate the necessity of each item of personal data being collected. It must be able to demonstrate that all personal data collected are necessary for its activities. Personal data may not be collected “just in case”, but only in a planned manner and for purposes defined in advance.

Remember

Identify what personal data is being processed in your hobby activities and by whom. Do not collect personal data “just in case”.

Why is the protection of personal data important?
2. Sensitive personal data requires particularly careful protection
The logo of the Office of the Data Protection Ombudsman.
The logo of TIEKE Finnish Information Society Development Centre.

The European Union flag, with the text "Funded by the European Union" on its right-hand side.

Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the granting authority can be held responsible for them.

Information on the website

The site contains material that provide information on data protection legislation and the protection of personal data, especially for children and young people aged 13–17, their parents, and associations that organise hobby activities. The website has been developed in the GDPR4CHLDRN – Ensuring data protection in hobbies project (2022–2024) implemented by the Office of the Data Protection Ombudsman and TIEKE.

Feedback about the site can be given by e-mail to the address tietosuoja@om.fi. In the message field, you must mention tietosuojaharrastuksissa.fi, so that the feedback is directed to the correct address.

  • Data protection on the website
  • Accessibility statement
Guiding materials
  • Board of the association
  • Coaches and instructors
  • Parents
  • Children and young people

© 2024 Office of the Data Protection Ombudsman and TIEKE. The site uses free Font Awesome icons. The icons have not been changed. License: CC BY 4.0

Touched by Hutcode