Privacy Policy at the 2020 UEFA European Championships regarding the body temperature measurement used on spectators watching matches in Hungary during the entry into a sports facility
Privacy Policy at the 2020 UEFA European Championships regarding the body temperature measurement used on spectators watching matches in Hungary during the entry into a sports facility
1. Where can you find information about data processing?
The Hungarian Football Federation (hereinafter: MLSZ) prepared this privacy policy in accordance with the provisions of the General Data Protection Regulation of the European Union 2016/679 (hereinafter: GDPR or Regulation) with the express purpose of making the data processing operations transparent in an understandable way. The privacy policy is available on the Internet at adatvedelem.mlsz.hu and will also be placed at the entry points.
Data of the data controller:
name: Hungarian Football Federation
email address: mlsz@mlsz.hu
name of data protection officer: dr. Ádám Németh (Lawyer of Dr. Németh Ádám Law Office)
email address of the data protection officer: adatvedelem@mlsz.hu
postal address: H-1386 Budapest 62. Pf. 906/1
2. Presentation of processing cases and the scope of processed data
All persons who intend to enter the sports facilities hosting the 2020 UEFA European Championship matches in Hungary shall pass through an automatic body temperature measuring corridor that measures the person's body temperature.
MLSZ set the limit of the low temperature at 37.8° C according to international health regulations. Only a person may enter the sports facility who is subject to the test and has no fever.
If the measured body temperature reaches or exceeds 37.8° C, repeated measurements shall be made using a method other than the automatic body temperature measuring corridor.
The secondary body temperature measurement shall be recorded by the person performing the body temperature measurement, in which the name and identity of the person seeking entry, the measured body temperature and, if the body temperature of the person seeking entry repeatedly exceeds 37.8° C, the reasons for refusing entry shall be stated.
The secondary body temperature measurement is performed on the match days by the employees or agents of the partner who performs the entry in the given sports facility, and outside the match days by the staff of the National Ambulance Service.
3. Duration of data processing
Data processing for primary body temperature measurements cease after the measurement, the automatic gate does not store body temperature data, and for secondary body temperature measurements 1 year after the end of the 2020 UEFA European Championships.
4. Purpose of data processing
The purpose of the data processing is to filter out the appearance of a new type of coronavirus in the sports facilities hosting the matches of the 2020 UEFA European Championship in Hungary.
5. Recipients of data, categories of recipients
MLSZ handles the data closed, however, if the secondary body temperature measurement is necessary, which takes place on non-match days, the MLSZ informs the staff of the National Ambulance Service of the reason for the repeated examination.
6. Source of personal data
The data is provided by the data subject to the MLSZ.
7. Legal basis for data processing
The legal basis for data processing under Article 6 (1) (f) of the Regulation is the legitimate interest of the MLSZ that it prevents the spread and appearance of the new type of coronavirus in sports facilities hosting the matches of the 2020 UEFA European Championship in Hungary, therefore it prevents the entry of persons who have a temperature (low fever), which is a symptom of the presence of the virus.
8. Your rights
8.1. Data processing related to complaint handling
Complaints about data processing will be answered no later than within 1 month, which can be extended for another 2 months if justified.
If you intend to exercise your rights, for which we need your identification, and we need to communicate with you.
MLSZ ensures the identification of the applicant in the following ways:
- personal identification: this is possible at the MLSZ county directorate of your choice or at the MLSZ headquarters, in this case your identification will be done in person with the help of your identity card. This is the only form of identification that does not involve the recording of personal data.
In the case of a legal representative, if the statement of the right to representation is not available in our system, we will also need the applicant to make a statement on the legal representation on the form provided by MLSZ, which also includes the processing of the name, ID number, and address of the declarant and the witnesses verifying the statement.
During the identification and/or the statement, the data provided by the data subject and/or the legal representative and the witnesses, as well as the request shall be kept by the MLSZ for 5 years in accordance with its records management rules. The request and the related correspondence will also be available in our email account.
In case of any doubt, the applicant may be called upon to carry out further identification actions; this is the case if, based on the request, the execution of the request would have legal effect on the applicant or the data subject. This could be the case, for example, if someone requests the erasure of his/her data, but he/she is an active football player, and the erasure of the data would mean that we would also have to revoke the football player's competition license.
Legal basis for data processing under Article 6 (1) (f) of the Regulation, the MLSZ has a legitimate interest in handling complaints and be able to verify how it has acted and what measures were taken to each complaint.
The processor related to the processing of the request is the operator of mlsz.hu website, the RelativeGROUP Kft. (registered seat: 2000 Szentendre, Tölgy utca 12.).
The storage and filing tasks of our documents are performed by the PRIV-DAT Dokumentum Archiváló és Tároló Kft. (registered seat: 1211 Budapest, Weiss Manfréd út 5-7.).
8.2. Request for information and request for a copy (right of access)
You have the right to receive feedback on whether your personal data is being processed and, if data processing is in progress you are entitled to:
- receive access to the processed personal data (that is, ask for a copy of them) and
- be informed about the following information:
- the purposes of the data processing;
- the categories of personal data processed about you;
- information about the recipients or categories of recipients to whom your personal data have been or will be disclosed by us;
- the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- your right to request the rectification, erasure, or restriction of the processing of personal data concerning you and to object to the processing of such personal data in the event of a data processing based on legitimate interest;
the right to file a complaint to the supervisory authority; - if the data was not collected from you, any available information about your personal data source;
- the fact of automated decision-making (if such a procedure is used), including profiling, and at least in those cases, understandable information about the logic used and the significance of such data processing and the expected consequences for you.
The purpose of exercising the right may be to establish and verify the lawfulness of the data processing, therefore, in case of repeated requests for information, we may charge a fair fee, in return for the provision of the information.
We provide access to personal data in the form you request, it can be in electronic form, by post, or information by personal.
8.3. Right to rectification
You have the right to request from us the rectification of your inaccurate personal data without delay.
8.4. Right to restriction of processing
You are entitled to request the restriction of data processing if one of the following is met:
- you dispute the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data, if no verification is required, no restrictions will be applied;
- if the data processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their use instead
- we do not need the personal data for the processing, but they are required by you for the establishment, exercise, or defence of legal claims; or
- you have objected to the processing, but because our legitimate interest can be legal ground to our processing, in this case, the restriction is pending until the end of the verification whether our legitimate grounds override those of yours.
If the data processing is restricted, such personal data shall be processed, except for storage, only with the consent data subject, or for filing, enforcing, or protecting legal claims, or for to protect the rights of another natural or legal person, or in the important public interest of the Union or a Member State.
We will inform you about the lifting of the data processing restriction in advance (at least 3 working days before the lifting of the restriction).
Please note that in some cases, restricting the right to data processing may have other consequences, such as losing the benefits associated with data processing (e.g. buying tickets online, taking advantage of fan discounts, or even losing the right to play as a player). We will inform you of such possibilities during the exercise of the right.
8.5. Right to erasure - Right to be forgotten
You have the right to request to delete personal data about you without undue delay if any of the following reasons exist:
- personal data are no longer necessary to the purpose for which they were collected or processed;
- you withdraw your consent and there is no other legal basis for data processing;
- you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (namely legitimate interests) for the processing;
- we have processed the personal data unlawfully and this was established based on the complaint;
- personal data shall be deleted to comply with a legal obligation under Union or member’s state law applicable to us.
If for any lawful reason, we have disclosed personal information about the Handball Player, and for any of the reasons set out above, we are required to delete, taking account of available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to inform other personal data processing data controllers that you have requested the erasure of links to such personal data, or a copy or replication of this personal data (right to be forgotten). As the main rule, your personal data will not be disclosed. With disclosure, the data of the certified and former certified football players as indicated in the Privacy Policy of the MLSZ public Databank are affected. (You can find our information about the public Database of the MLSZ here.)
- The deletion shall not apply if the processing is necessary:
- for the exercise of the right to freedom of expression and information
- to fulfil an obligation under Union or member state law which applies to us concerning the processing of personal data (such a case is, for example, data processing in the framework of invoicing, as the preservation of the invoice is required by law, or the mandatory registration of the athlete, or the registration of a competition license);
- for the submission, enforcement, or protection of legal claims (e.g.: if we have a claim against you and you have not fulfilled it yet, or a consumer or data processing complaint is being processed).
9. Legal remedies
If you think we have violated any statutory provision on data processing or have not completed any of your requests, you have the right to initiate an investigation procedure to eliminate a putative unlawful data processing before the National Data Protection and Information Authority (mail address: 1363 Budapest, Pf.: 9, e-mail: ugyfelszolgalat@naih.hu).
In addition, we also inform you that you can file a civil lawsuit in court.
10. Data Security
During the operation of the IT systems, we ensure the necessary authorization management, internal organization, and technical solutions to ensure that your data cannot become the property of unauthorized persons, and the data cannot be deleted or saved from the system or modified by unauthorized persons. We also enforce data protection and data security requirements against our data processors.
We keep a record of possible privacy incidents. According to our incident management procedure, if an incident occurs according to the provisions of the Regulation, we will inform you (if we can do so) and the supervisory authority.
11. Other provision
MLSZ reserves the right to modify its privacy policies in a way that does not affect on the purpose of the processing and its legal ground.
However, if we intend to carry out further processing of the data collected but for a different purpose than the purpose of collection, before the further processing, we will notify you about the purpose of the processing and the following information:
- the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- your existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, and in case of processing based on legitimate interest, you have the right to object to the processing of personal data, and in case of processing based on consent or contractual relationship, you may request your right to data portability to be guaranteed;
- in case of processing based on consent, you may withdraw your consent at any time;
- your right to file a complaint with the supervisory authority;
- whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data;
- the existence of automated decision-making (if any), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
The processing can only begin after this. If the legal ground of the new processing is consent, your consent is required for the processing in addition to a notification.
This Privacy Policy is valid from 28.07.2021.
