Data Privacy Information for the Accreditation Process for the Matches of Bundesliga and Bundesliga 2

The respective home club of the Bundesliga or Bundesliga 2 is required, as a so-called controller within the meaning of the European General Data Protection Regulation (“GDPR“) and the German Data Protection Act (Bundesdatenschutzgesetz, “BDSG“) to comply with provisions in data privacy laws when handling personal data.

Employees and representatives of accreditable media and service providers in the following fields of activity

  • PRINT/ONLINE
  • PHOTO
  • AUDIO

are hereby informed about the collection, storage, processing and use of their personal data (“Data“) by the home club in the context of the conduction of the accreditation process for the matches of the Bundesliga and Bundesliga 2 to the extent described below. If an employee or a representative of accreditable media and service providers does submit the accreditation application via a central contact person and not himself or herself, this central contact person must ensure that the available data privacy information is forwarded and provided.

Employees and representatives of accreditable media and service providers are only required to provide the Data required for the decision on issuing the accreditation and its use or which the home clubis legally obliged to collect. Without this information, the home club will usually not be able to consider and review the application for accreditation.

In detail:

I.       Controller, data protection officer

Controller is the home club of the Bundesliga or Bundesliga 2 to which the employee and representative of accreditable media and service providers is applying for accreditation.

Employees and representatives of accreditable media and service providers can contact the data protection officer of the home club under the contact details being provided on its official website.

II.      Source of Data and Data categories

The home club processes the Data received from the employees and representatives of accreditable media and service providers in the accreditation process.

Relevant Data of the employees and representatives of accreditable media and service providers are master data (first and last name, date of birth), contact data, professional status, legitimation data (e.g. media/press ID for proof of full-time status).

III.     Purpose and legal basis of the processing, Data recipient

The home club processes the Data in accordance with the provisions in the GDPR and the BDSG. This means that the Data will only be processed if there is a legal permission (especially if the Data processing is necessary for the decision on issuing the accreditation or is prescribed by law or is based on the legitimate interests of the home club or third parties), or if the respective employee or representative of accreditable media and service providers has given his or her consent in individual cases.

Within the home club, those departments which need the Data to fulfil their contractual and legal obligations receive the Data. Processors engaged by the home club (Art. 28 GDPR) and other contractors may also receive Data for these purposes. Depending on the respective home club, these could be companies in the categories of match day and stadium organisation, stadium security, printing and mailing, as well as IT services.

Information about the employees and representatives of accreditable media and service providers will only be disclosed to recipients outside the home club, if permitted or required to do so by law. Under these prerequisites, recipients of the Data may be, for example, the recipients mentioned above (including other companies affiliated with the home club and other third parties).

1.      For purposes of the accreditation process, Art. 6 para. 1 b) GDPR

The processing of the Data (Art. 4 no. 2 GDPR) is carried out for purposes of deciding on issuing the accreditation and its use.

2.      In the course of weighing interests, Art. 6 para. 1 f) GDPR

If necessary, the home club processes the Data in addition of the actual purposes of the accreditation process to protect its legitimate interests or the legitimate interests of third parties. Examples:

  • Production and public distribution of visual and audio-visual recordings of the matches of the home club which show the employee and representative of accreditable media and service providers in this capacity, as well as the exploitation of these visual and audio-visual recordings for commercial and for non-commercial purposes without any restriction in time and territory either by DFL Deutsche Fußball Liga e.V. and DFL Deutsche Fußball Liga GmbH or third parties designated by them, the home club and the other clubs of the Bundesliga and Bundesliga 2, as well as by licensees and partners of DFL Deutsche Fußball Liga e.V. and DFL Deutsche Fußball Liga GmbH, as well as the home club (i.e. cooperation, media and marketing partners). The exploitation can take place in every physical form (especially production and dissemination of all digital and analogue media formats) and every non-physical form (especially broadcast, public communication or accessibility, for example, as download or streaming) in all media and on all platforms.
  • Assertion and exercise of legal claims, as well as defence in legal disputes
  • Ensuring IT security and IT operations.

Employees and representatives of accreditable media and service providers have the right to object at any time to the above processing of Data concerning them for reasons arising from their particular situation. If an employee or a representative of accreditable media and service providers files an objection, the home club will no longer process his or her Data, unless the home club can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the respective employee or representative of accreditable media and service providers or the processing serves to assert and exercise legal claims or to defend legal disputes.

3.         Performance of tasks carried out in the public interest, Art. 6 para. 1 e) GDPR, and for prevention of threats to state or public security, § 24 para. 1 no. 1 BDSG

Where required, the home club processes the Data for the purposes of security checks and transmits Data to the responsible security authorities in the event of a concrete risk situation, if this is necessary

  • for the performance of a task carried out in the public interest or in the exercise of official authority vested in the home club (Art. 6 para. 1 e) GDPR); or
  • to prevent threats to state or public security (§ 24 para. 1 no. 1 BDSG).

Employees and representatives of accreditable media and service providers have the right to object at any time to the above processing of Data concerning them pursuant to Art. 6 para. 1 e) GDPR for reasons arising from their particular situation. If an employee or a representative of accreditable media and service providers files an objection, the home club will no longer process his or her Data, unless the home club can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the respective employee or representative of accreditable media and service providers or the processing serves to assert and exercise legal claims or to defend legal disputes.

4.      Processing due to legal requirements, Art. 6 para. 1 c) GDPR

In addition, the home club is subject to various legal obligations, i.e. legal requirements (e.g. tax laws). The purposes of the processing include, among other reasons, the fulfilment of fiscal control and reporting obligations.

5.      Processing based on consent, Art. 6 para. 1 a) GDPR

If the employee or representative of accreditable media and service providers gives his or her consent to home club to the processing of Data for specific purposes, this processing is lawful on the basis of the consent. A given consent can be withdrawed at any time. The withdrawal is only effective for the future. Processing that took place before the withdrawal is not affected.

IV.     Storage period of the Data

If necessary, the home club processes and stores the Data for the duration of the use of the respective accreditation by the employee or representative of the accreditable media and service provider. The processing, storage and use of the Data by the home club may in individual cases, depending on the purpose of the storage, also extend the duration of this use, e.g. for the purposes of asserting and exercising legal claims, as well as defending legal disputes.

The Data collected and processed within the scope of the weighing of interests pursuant to Clause III.2. will be stored for as long as this is permitted on the basis of legitimate interests.

Futhermore, the home club is subject to various retention and documentation obligations, which result, among other reasons, from the German Commercial Code (Handelsgesetzbuch, “HGB“) and the German Tax Code (Abgabenordnung, “AO“).

V.      Further Data transmission to third countries or an international organization

Data is transmitted to third countries (countries outside the European Economic Area – EEA) only if permitted by law (especially if the processing of Data is necessary or required or prescribed by law for conducting the accreditation process and issuing an accreditation or due to legitimate interests of the respective home club (including affiliated companies within the meaning of §§ 15 seq. AktG or other third parties) and under the prerequisites of Artt. 44 to 49 GDPR (e.g. for countries with an appropriate level of data protection in accordance with Art. 45 para. 1 GDPR or if EU Standard Contractual Clauses have been concluded, Art. 46 para. 2 d) in conjunction with Art. 93 para. 2 GDPR).

VI.     Data privacy rights of the employees and representatives of accreditable media and service providers

Employees and representatives of accreditable media and service providers have the right of access under Art. 15 GDPR in conjunction with §§ 29, 34 BDSG, the right to rectificationunder Art. 16 GDPR, the right to erasure under Art. 17 GDPR in conjunction with § 35 BDSG, the right to restriction of processing under Art. 18 GDPR in conjunction with § 35 BDSG as well as the right to data portability under Art. 20 GDPR.  There is also a right to lodge a complaint with a supervisory authority (Art. 77 GDPR).