Privacy Policy on the Accreditation Procedure for the European Football Championship 2020 (EURO2020)

Privacy Policy on the Accreditation Procedure for the European Football Championship 2020 (EURO2020)

1. Where can you find information on data processing?

The Hungarian Football Federation has prepared this policy in accordance with the provisions of the General Data Protection Regulation of the European Union 2016/679 (hereinafter: GDPR or Regulation) with the specific purpose of making the data processing operations transparent in an easily understandable way. This privacy policy is available on the Internet at adatvedelem.mlsz.hu and in the accreditation centre.

Data of the Data controller:

Name: Hungarian Football Federation (”EURO2020 Local organising structure Budapest (LOS)”)

e-mail address: mlsz@mlsz.hu

name of data protection officer: dr. Ádám Németh (Lawyer of Dr. Németh Ádám Law Office)

e-mail address of data protection officer: adatvedelem@mlsz.hu

mailing address: 1386. Budapest 62. Pf. 906/1

This Privacy policy doesn’t contain the information about the data handling of the UEFA. 

The information about the UEFA data handling accessible in the Accreditation and the UEFA FAME Terms and Conditions and the Privacy Notification (which is available on the UEFA Accreditation Portal (”UEFA platform”) at https://uefa.fame.uefa.com/Repository/General/43/5/0/0/9/4/0/5/1/30.pdf  

Towards the UEFA You may exercise your rights in e-mail to accreditation.euro2020@uefa.ch.

2. Presentation of processing cases and the scope of processed data

The UEFA EURO 2020™ is governed by UEFA. The LOS organizes matches and other events at the tournament venues in Budapest according to UEFA regulations. For professionals who wish to participate in the event, entry to matches or other events is subject to accreditation. 

The UEFA provides accreditation through its platform. The UEFA forwards the information provided by persons requesting accreditation to the LOS. The LOS will forward certain personal data received from UEFA regarding the person requesting accreditation to the police, who will carry out the background check and then return only the data of the persons who are questioned or not recommended by the Police for accreditation. The LOS sends back the received feedback from the Police to the UEFA, who thus denies the accreditation of the person questioned during the background check. Due to lack of this the accreditation will be recorded, issued and handed over in the register.

LOS receives the following information through the dedicated UEFA platform:

• last name,
• first name,
• gender,
• nationality,
• date of birth,

• type and number of the identity document
• UEFA ID.

For the purpose of issuing the accreditation, UEFA, with the support of LOS, records a photograph of the person concerned on the UEFA platform. This photograph is printed on the accreditation device.

Jointly with the issue of accreditation, its date, serial number and the signature of the person concerned are recorded by UEFA, with the support of LOS, on the UEFA platform, for the purpose of proving delivery. These data are not accessible by LOS.

The LOS, in order to handle security events, may get the photograph from the UEFA.

At the accreditation centre, beside the LOS exclusively designated accreditation specialist, police document experts can verify the authenticity of identity documents. 

The personal data detailed in point 5. are collected by the LOS on behalf of the UEFA. 

3. Duration of data processing 

The LOS retains the processed data for 60 days after the last event. 

4. Purpose of the data processing

The purpose of completing the accreditation process is to carry out background checks of persons requiring accreditation for the organization of highlighted international sporting events in Hungary in order to meet the safety requirements set by UEFA and to have the necessary data on the persons applying for accreditation in order to ensure the security of the events and to support law enforcement activities.

5. Data recipients, categories of recipients

The LOS does not disclose the data, however, it transmits the data to the Police and to UEFA as described in section 2. If the accreditation already issued is invalidated, the necessary personal data may be also transferred to the security company of the event. 

In addition to the above, certain data - determined by the UEFA as data controller - are collected, processed and forwarded by the HFF to the UEFA. 

These personal data are the followings:

• The first name(s), surname(s)
• for Azeri nationals: Azeri surname(s), Azeri first name(s), patronymic in Azeri, national ID card number and current address 
• for Russian nationals: Cyrillic surname(s), Cyrillic first name(s) and Cyrillic patronymic), national ID card number and current address
• email address
• mobile number 
• date of birth, country of birth, place of birth
• gender 
• nationality
• picture
• ID document type, date of issue and expiry, ID Document number 
• address detail 

as obligatory data for accreditation.

6. Source of personal data

The personal data of the person requesting accreditation is provided by UEFA to LOS. Personal data shown in section 5. are given by the data subject.

7. Legal ground of data processing

The legal basis for data processing is Article 6 (1) (e) of the Regulation, regarding that it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In the case of accreditation, the LOS shall act in accordance with Section 22 (1) (j) of Act I of 2004 on Sport, which states that it is the task of the professional association, that is the MLSZ, is responsible for the execution of the state tasks related to the organization of the outstanding international sports events in the case of the winning tender.

8. Your rights in relation to processing

8.1 Processing concerning handling of complaints

We will answer to the complaints in relation to the processing not later than within a month, which may be extended by further 2 months, where appropriate.

If you want to exercise your rights, we will need you to be identified and we will have to necessarily communicate with you.

LOS ensures the identification of the applicant in the following ways:

• personal identification: you can do it at any County Directorate you choose or at the centre of LOS, in this case we will carry out your identification personally by using your identity document; and this is the only form of identification which does not involve the recording of your personal data.
• identification by verifying data: if you cannot appear in person for a personal identification, you may provide us with any proof of your identity. On the basis of the provided data, we do our best to identify you. If it is not succeeded you may provide additional data to us.
• Please note that if you choose to be identified by without personal appearance LOS excludes its responsibilities if any damage and/or other disadvantage will be caused to you or any legal entity or natural person by fulfilling your request.

In case of a legal representative - if the statement of the right to representation is not available in our system - we will also need the applicant to make a statement on the legal representation by a form provided by LOS, which also includes the processing of the name, ID number and address of the declarant and the witnesses verifying the statement.

During the identification and/or the statement, the data provided by the data subject and/or the legal representative and the witnesses as well as the request will be retained for 5 years. The request and the related correspondence will also be available in our email account.

In the event of any doubt, we can call the applicant for the carrying out of further identification processes; we will need this if the execution of the request has a legal effect on the applicant or the data subject on the basis of the request. This may be the case if, for example, a person requests the erasure of his data but he is an active football player, and the erasure of the data would mean that we should withdraw his football licence.

On the basis of point f) of paragraph (1) of Article 6 of the Regulation, the legal ground of the processing is the legitimate interest of LOS in order to handle the complaints and be able to verify how it acted and what measures it took in respect of the individual complaints.

The processor related to the processing of the request is the operator of mlsz.hu, Relative Kft. (Registered seat: 2000 Szentendre, Tölgy utca 12.).

The hosting and organisation of our documents is performed by PRIV-DAT Dokumentum Archiváló és Tároló Kft. (registered seat: 1116 Budapest, Hauszmann Alajos u. 1.).

8.2 Request for information and request for a copy (right of access)

You shall have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, you are entitled:

• to gain access to the data processed (namely request a copy) and
• to be informed about the following:
• the purposes of the processing;
• the categories of your personal data processed;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed;
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, and in case of a processing based on legitimate interest, you have the right to object to such processing;
• the right to lodge a complaint with the supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making (if any), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

The purpose of the exercise of right may aim to assess and check the lawfulness of processing; therefore, in case of multiple requests for information, we may charge a reasonable fee for the fulfilment of the information requests.

We will provide you with an access to personal data in a form you ask which can be via email, by post or personal information.

The form is available here. In case of difficulties, please send an e-mail to adatvedelem@mlsz.hu .

8.3 Right to rectification

You shall have the right to obtain from us without delay the rectification of inaccurate personal data concerning you.

The form is available here. In case of difficulties, please send an e-mail to adatvedelem@mlsz.hu.

8.4 Right to restriction of processing

You shall have the right to obtain from us restriction of processing where one of the following applies:

• the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data (if there is no need for verification, we will not apply any restriction either);
• if the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead;
• we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; 
• you have objected to processing but it is based on our legitimate grounds (in this case, until the verification whether our legitimate grounds override yours, the processing must be restricted).

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

We will inform you about the lifting of restriction of processing in advance (at least 3 working days before the restriction of processing is lifted).

Please note that in some cases the restriction of processing might have other consequences and thus you might lose some benefits going with processing (e.g. purchasing tickets on the Internet, obtaining discounts for fans or even losing the right to enter the pitch as a player). We will inform you about these contingencies during the exercise of this right.

The form is available here. In case of difficulties, please send an e-mail to adatvedelem@mlsz.hu .

8.5 Right to erasure – right to be forgotten

You shall have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw your consent, and there is no other legal ground for the processing;
• you object to the processing based on legitimate interest, and there are no overriding legitimate grounds (namely legitimate interests) for the processing;
• the personal data have been unlawfully processed, and it has been established on the basis of the complaint;
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject.

If, for any legitimate ground, we have made your personal data public and we are obliged to erase them for any reason listed above, and by taking account of available technology and the cost of implementation, we shall take reasonable steps, including technical measures, to inform other controllers which are processing the personal data that you have requested the erasure of any links to, or copy or replication of, those personal data (right to be forgotten). As a rule, we will not make your personal data public. The disclosure only concerns the registered and former registered football players’ data specified in the information notice on the public data bank of LOS. (You can find our information notice on the public data bank of LOS here)

The erasure shall not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject (such case is, for example, the processing carried out during invoicing, since the storage of the invoice is required by law, or the compulsory registration of the sportsman, registration of the license);
• for the establishment, exercise or defence of legal claims (e.g. if we have a claim you have not fulfilled, or if the processing of a consumer complaint or a complaint against data processing is in progress).

The form is available here. In case of difficulties, please send an e-mail to adatvedelem@mlsz.hu .

8.6 Remedies

If you think we have breached a legislative provision relating to the processing of personal data, or we have not executed your request for the termination of alleged unlawful processing of personal data, you may request an investigation procedure from the Hungarian National Authority for Data Protection and Freedom of Information (mailing address: 1363 Budapest, Pf.: 9., email: ugyfelszolgalat@naih.hu).

Furthermore, please note that you also have the right to bring a civil action in a court. 

9. Security of personal data

By using necessary access managing, internal organisational and technical solutions during the operation of IT systems, we ensure that unauthorised persons cannot take possession of your data, unauthorised persons cannot erase, save the data from the system or modify them. We also enforce the privacy and data security requirements against our processor.

We keep records of the personal data breaches; according to our procedure for managing breaches, if a breach under the Regulation happens, we will inform you (if possible) and the supervisory authority.

10. Miscellaneous provisions

LOS reserves the right to modify its privacy policies in a way that has no effect on the purpose of the processing and its legal ground.

However, if we intend to carry out further processing of the data collected but for a different purpose than the purpose of collection, before the further processing, we will notify you about the purpose of the processing and the following information:

• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• your existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, and in case of a processing based on legitimate interest, you have the right to object to the processing of personal data, and in case of processing based on consent or contractual relationship, you may request your right to data portability to be guaranteed;
• in case of processing based on consent, you may withdraw your consent at any time;
• your right to lodge a complaint with the supervisory authority;
• whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data;
• the existence of automated decision-making (if any), including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

The processing can only begin after this. If the legal ground of the new processing is consent, your consent is required for the processing in addition to notification.

In other cases, we will inform you about the modification by notice placed on adatvedelem.mlsz.hu

This Privacy Policy shall be valid from 28.07.2021.; its archived version - if available - can be found under the policy, among the downloadable documents.

Downloads

• UEFA_EURO_2020_BUD_accreditation_process_privacy_policy_eng_07.28.2021.
• 20200129_UEFA_EURO_2020_BUD_accreditation_process_privacy_policy_eng_01082020_final
• 20200129_UEFA_EURO_2020_BUD_accreditation_process_privacy_policy_eng_01082020_mod
• 20200129_UEFA_EURO_2020_BUD_accreditation_process_privacy_policy_eng_18022020.pdf
• 20200129_UEFA_EURO_2020_BUD_accreditation_process_privacy_policy_eng_mod_18022020.pdf
• 20200129_uefa_euro_2020_bud_accreditation_process_privacy_policy_eng_04022020.pdf