What does this Policy cover?
This Policy describes your data protection rights, including a right to object to some of the processing which The FA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.
Summary of how The FA uses your data
- The FA processes information about individuals who are named or who are referred to, whether directly or by use of a coded reference, within the Report. The FA processes this data for the purposes of analysing and implementing the recommendations resulting from the Review, publishing the Report, investigating any complaints received following publication of the Report and in connection with any legal, compliance, regulatory or investigative purpose arising out of publication of the Report.
- The information processed by The FA involves both special category and criminal records data – particularly the Report discusses the evidence given by survivors and details of criminal offences. This is processed on the basis of explicit consent or for the purposes of safeguarding children and individuals at risk and protecting the integrity of, and standards of behaviour in, football through sharing the Report’s findings.
What do we mean by personal data, special category personal data and criminal offence data?
- Personal data means information relating to a person that enables them to be identified or identifiable, whether directly or indirectly. This data includes a person’s name, address, location and other factors that might reveal their identity, such as physical features.
- Special category personal data means personal data that reveals any of the following about an individual: racial or ethnic origin; political opinions; religious or philosophical beliefs; or trade union membership or personal data that consists of genetic data; biometric data used for the purpose of identifying an individual; data concerning health; or data concerning an individual’s sex life (this would include any details in relation to sexual abuse) or sexual orientation.
- Criminal offence data means personal data relating to criminal convictions, allegations, investigations and offences. Data concerning survivors of criminal offences also amounts to criminal offence data. Where references are made to criminal offence data in this Policy, this would, where relevant, include data relating to you, where a crime has been perpetrated against you.
What information does The FA process about me?
The FA process information about a range of individuals whose information has been collected or provided in the context of the Review. In particular, the Report and other information provided to The FA contains data relating to survivors, perpetrators and suspected perpetrators who have not been convicted, current and former FA staff, current and former employees of relevant football clubs and County FAs, family members, campaigners, journalists and other individuals who provided evidence or about whom evidence was provided or whose data is publicly available and warrants inclusion in the Report or other information provided to The FA. In particular, the types of information The FA holds about these individuals include:
- the details of any allegations, whether made to The FA, Clive Sheldon QC and his team or otherwise brought to the attention of the Review;
- details of club affiliation at the time of the allegations, or the person’s role, as relevant to the Review;
- details of actions taken by the individuals in relation to these allegations;
- details of relevant public statements made by the individuals;
- information provided or made available to the Review which was key to providing context or information contained in the media, relevant reports or publications;
- details of any family relationship mentioned and relevant to the Review;
- details of any investigation carried out into any allegations;
- data about physical and mental health, including details of sexual abuse perpetrated against or by these individuals, and the impact that has had on survivors and their family members;
- criminal offence data relating to perpetrators, alleged perpetrators and survivors; and
- other information relevant to the Review.
How does The FA use this information, and what is the legal basis for this use?
The FA will use this information for the following purposes:
- Where you give us your consent:
- if you are a survivor named within the Report, we will publish your data (including any special category personal data or criminal offence data) within the Report where you have given your explicit consent;
- As required by The FA to conduct our business and pursue our legitimate interests and, so far as special category data is concerned, substantial public interests, in particular:
- to publish your data within the Report, including criminal offence data and special category data where this is warranted, to protect participants in football from serious improper conduct and protect the sport’s current participants against risk of harm;
- to analyse and implement the Review’s recommendations, understand whether there are systemic issues in football which allowed non-recent sexual abuse to occur and determine whether The FA’s safeguarding practices should change;
- to communicate with you, where necessary;
- to investigate any complaints received from you or from others or to conduct follow up actions arising from the publication of the Report;
- in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation);
- protect the integrity of, and standards of behaviour in, football and the wider sports community.
- For purposes which are required by law:
- in response to requests by legal advisers, government or law enforcement authorities conducting an investigation; and
- where we are required to hold or collect personal data to meet our legal requirements.
Wherever we rely on your consent, you will always be able to withdraw that consent. If you consented to your data being included in the Report, you can withdraw your consent at any time, and The FA will endeavour to have changes made to any current online version of the Report that it is making available to the public. However, a withdrawal of consent will not invalidate our initial publication of the Report up to that point and it will not be possible to amend hard copy or electronic versions already in circulation.
How is data shared, where and when?
Personal data will also be shared with our third-party service providers, who will process it on behalf of The FA for the purposes identified above. These third parties include the providers of software and archiving services used by The FA to maintain safeguarding records and to store information on behalf of The FA.
Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not considered adequate under UK law, data is adequately protected by EU Commission approved standard contractual clauses, or a vendor's Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review – you can ask for this using the contact details below.
What rights do I have?
You have the right to ask The FA for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us in a structured, machine readable format. Where you have consented to The FA’s inclusion of your personal data in the Report, you are also entitled to withdraw any consent you have given to The FA. As explained above, any withdrawal of your consent will not invalidate our initial publication of the Report, however, The FA will endeavour to have changes made to any current online version of the Report made available to the public.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where one of the data controllers doesn’t have to process the data to meet a contractual or other legal requirement).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.
To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office in the UK.
How do I get in touch with you, or your data protection officer?
If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at firstname.lastname@example.org or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.
How long will you retain my data?
The FA will retain your personal data as follows:
- The data contained in the Report will be retained for a period of 2 (two) years, forming part of the record of the Report, following which The FA will continue to review on a periodic basis if the Report should continue to be made available to the public.
- Data received and held by The FA in connection with the Review, including as part of the Report and other evidence passed to The FA, will be retained for a period of 2 (two) years, forming part of the record of the Report for FA purposes only, following which The FA will continue to review on a periodic basis if the underlying data held by The FA need to be retained.