PARTICIPANTS PRIVACY POLICY

Summary of how The Football Association Limited (“The FA”) uses your data

• The FA processes Participants’ (as defined in The FA’s rules from time to time) data to carry out its regulatory functions as set out in The FA’s rules and regulations. Participants may include players, managers, coaches, relatives, intermediaries, match officials, owners and directors, or any other individual who may be subject to the FA’s rules and regulations from time to time. For a full list of those considered to be ‘Participants’, please see The FA’s rules which can be found in The FA Handbook on The FA’s website.
• The FA will particularly use your data to ensure that Participants and contracts are appropriately registered, that on and off-field discipline is maintained and that the integrity of the game is upheld. It may also collect and process information relating to some players for the purposes of talent identification for England squads, and use information about those who participate in FA competitions to promote those competitions.
• The FA will process some sensitive personal data in carrying out these functions. This will usually be done for the purposes of protecting the integrity of the game.
• The FA may use information such as photos and footage (featuring your image) collected in our competitions and at other events for the purpose of broadcasting our competitions, and in order to promote The FA, The FA’s competitions, the game of football in England and for use in promotional campaigns involving our commercial and broadcast partners. 
• Subject to your consent, The FA will collect personal data relating to diversity, inclusion and disability for monitoring purposes and to allow The FA to better identify and improve engagement with minority groups that are underrepresented in football, identify the reduction in engagement in certain groups as they grow older and to provide associated reports to County FAs, Sport England, the National Game Board (NGB) and key selected partners.
• Data may be shared with a number of third parties. Data may need to be shared with clubs, for example in relation to the registration or your contract or your conduct, County FAs, leagues and competition organisers, including international governing bodies such as UEFA and FIFA. Information may be shared with the police where there is evidence of criminal conduct. Data is also shared with The FA’s panel members as necessary for disciplinary and tribunal proceedings.
• We may offer you the ability to contact Sporting Chance – where you accept this, we may transfer relevant information to them. You can also choose to share information about a matter, charge or investigation with other third parties, such as the PFA, LMA, another trade union representative, lawyer or relative. You can withdraw this consent at any time.
• Our Participant Privacy Policy sets out more details in respect of your data protection rights, including your right to object to certain processing.

What does this policy cover?

This policy describes how The FA will make use of your data as a Participant in football and in its role as a governing body. The FA also has other privacy policies (for example, there are specific privacy policies describing use of intermediary data, match official data and describing the use of information collected through Whole Game System (The FA’s football administration system) which may be relevant to you.

Participants should be particularly aware of The FA’s Anti-Doping Privacy Policy and Safeguarding Privacy Policy and how we process diversity, inclusion and disability data (which is set out below).

Players who are part of England long lists and squads will also receive specific privacy policies, as will players who participate in women’s leagues managed by The FA. Please take your time to read any of The FA’s privacy policies which may be relevant to you.

This policy describes your data protection rights, including a right to object to some of the processing which The FA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information does The FA collect?

The FA collects and processes personal data about Participants in forms that are completed and submitted by Participants, or that are submitted on their behalf by their intermediary, parent, club or league. This particularly includes details that are submitted when registering with The FA, and information submitted in response to disciplinary charges, as well as any other data you choose to provide when you contact us.

What information is provided by third parties?

Where you are submitting information on registration, we may receive information from third parties such as club officials, your existing and previous clubs, leagues and other governing bodies. Where we are carrying out checks to confirm the registration of an international player to provide a governing body endorsement, we may also receive information from third parties nominated to provide evidence and from public authorities as required.

When we carry out disciplinary activities, we will receive information from witnesses and from other individuals involved in any relevant incident. We will involve your club and often your league as a matter of course. As part of our integrity activities, we also actively gather intelligence from relevant sources, such as betting providers, other governing bodies, the Gambling Commission, the media and members of the public.

Where you choose to involve a third party, for example, the PFA, LMA, other trade union representative, lawyer or relative, we will receive and share data with this person.

How does The FA use this information, and what is the legal basis for this use?

As required by The FA to conduct its business and pursue its legitimate interests, in particular:

• carrying out The FA’s role as the governing body of football, to administer the registration of various Participants, and to administer and manage FA competitions in which you are participating;
• maintaining intelligence in respect of integrity matters to ensure that we carry out appropriate investigations into possible breaches of our rules and regulations;
• carrying out The FA’s disciplinary role in enforcing The FA’s rules and regulations, including sharing information with relevant third parties as necessary and described below;
• publishing our decisions in appropriate disciplinary cases to ensure transparency and in accordance with our rules and regulations, and sharing decisions with others such as leagues and County FAs to ensure that suspensions are upheld;
• where you are a player eligible for an England national team, we may carry our talent identification activities where we monitor your progress and potential for international call-up;
• using information such as photos and footage (featuring your image) collected in our competitions and at other events for the purpose of broadcasting our competitions, and in order to promote The FA, The FA’s competitions, the game of football in England and for use in promotional campaigns involving our commercial and broadcast partners;
• where you are a player, we may require you to undergo cardiac or other health screening to ensure that you will not be put at risk. We will seek your consent to this screening, but our processing will be based on this being necessary for occupational medicine. This is better described in relevant notices provided as part of this screening;
• we may contact some individuals to carry out appropriate research on the views of Participants in the game;
• for use in formal scientific research projects;
• we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal processes or litigation or to other relevant regulators, such as the Gambling Commission or other governing bodies, law enforcement bodies or to clubs and other employers where appropriate); and
• we will maintain footage, images, records of results and on-field conduct as part of our interest in maintaining a record and history of the game.
  
  

For purposes which are required by law:

• in response to requests by government or law enforcement authorities conducting an investigation.
  
  

Where you have given your consent:

• where you wish to involve a third party in a matter, investigation or charge, we may share your details with the PFA, LMA, other trade union representative, lawyer or relative; and
• where you wish to be referred to Sporting Chance, we will share relevant information with them. This may include sensitive data, which we will share with your explicit consent.
  
  

Where you have given your explicit consent and you are 16 or over:

• we will process your diversity, inclusion and disability data to carry out appropriate monitoring of equal opportunity and analysis of participation in the game to allow The FA to better identify and improve engagement with minority groups that are underrepresented in football and identify the reduction in engagement in certain group as they grow older;
• for security, we will encrypt the link to your diversity, inclusion and disability data and store that data on a pseudonymised basis, separated from other data contained in your account;
• no diversity, inclusion and disability data collected from children aged 16 or 17 data will be accessible to any parent who continues to have access to the child’s account via a linked account;
  
  We will provide reports (segmented against specific attributes, including but not limited to coach, referee and player specific attributes, age range or geographical area, but no specific individual will be directly identifiable) to:
•  your relevant club to enable reporting at club level against the new voluntary code for Equality In Football Leadership;
• your relevant County FA;
• report progress against government targets as part of a consolidated report to Sport England, the NGB, the government and/or other non-commercial organisations; and your data will only be used for diversity, inclusion and disability monitoring purposes as set out above from the date of this privacy policy.  No previous indications of diversity, inclusion and disability data provided by you will be used for diversity, inclusion and disability monitoring purposes – only newly collected data will be linked to a user account. Furthermore, we will only process diversity, inclusion and disability data that has been collected directly from you.]

For some of these purposes, particularly in respect of disciplinary and integrity related processing, we may be required to process your sensitive personal data – unless we state otherwise - we will process this for the purposes of enforcing the measures we have put in place to protect the integrity of the game.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent.

Where we rely on your explicit consent, you will always be able to withdraw that consent.  In addition, you can manage, amend or delete any of your diversity, inclusion and disability data by logging into My Account.

How is data shared, where and when?

Data may be shared with a number of third parties in accordance with the terms of this privacy policy. Data may need to be shared with clubs, whether about your registration or your conduct, County FAs, leagues and competition organisers, including international governing bodies such as UEFA and FIFA. Where we are investigating integrity matters, we may choose to share information with other relevant regulators such as the Gambling Commission or governing bodies in other sports. Information may be shared with the police or other law enforcement bodies where there is evidence of criminal conduct. Data is also shared with The FA’s panel members as necessary for disciplinary and tribunal proceedings. We will also publish certain information or share it with the media, on disciplinary charges and findings and on results and records of the game, whether as statistics or promotional content.

We may offer you the ability to contact Sporting Chance – where you accept this, we may transfer relevant information to them. You can also choose to share information about a matter, charge or investigation with other third parties, such as the PFA, LMA, another trade union representative, lawyer or relative.

Personal data may also be shared with third party service providers, who will process it on behalf of The FA for the purposes identified above. This may include the providers of IT services, survey providers and event organisers. The FA may also share information with third parties, like universities, for research projects.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor's Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review – you can ask for this using the contact details below. In the case of transfers to UEFA and FIFA, data is in these cases transferred to a country considered to adequately protect data under an EU adequacy decision.

What rights do I have? 

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

We will always inform you where information you provide is mandatory. Information that is provided in order to comply with The FA’s rules and regulations is mandatory. Failure to provide this information could result in a charge under those rules or regulations.

How do I get in touch with you, or your data protection officer?

If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.

How long will you retain my data?

Information relating to:

• intelligence or evidence gathered about integrity or disciplinary matters;
• The FA’s internal records of decisions and the written reasons for decisions taken by The FA in respect of disciplinary matters; and
• The FA’s internal records of decisions and the written reasons for decisions taken to prevent or withdraw a registration on integrity grounds,

will be reviewed every 7 years. If The FA considers that ongoing retention is justified, it will continue to retain relevant information until at least its next review. We will also review the information we hold about you at the end of any investigation or case to ensure this remains relevant. For particularly serious cases, and where you may have an ongoing role in football, we may inevitably hold information indefinitely, but this will remain subject to review.

The FA will publish information relating to decisions taken on charges and cases where it has jurisdiction for 5 full seasons following the decision, unless any ban or suspension imposed is longer than this period, in which case the decision will be published until the end of that ban or suspension.

The FA will retain referee reports for a minimum of 7 full seasons to ensure that The FA is in a position to protect itself from any claim. After this 7 year period, ongoing retention will be subject to review in accordance with the above review period.

Information about on-field results, such as who has scored, who was substituted in a match, and who received red and yellow cards will be retained indefinitely to keep a record of the match. This is also the case for footage and images captured during an FA competition.

Data that is used for surveys will be retained in accordance with our privacy policy on FA surveys.

Diversity, inclusion and disability data will be retained for 2 full seasons after you stop being an active participant in football or accessing your My Account.

Where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.

Last updated: 27 January 2023