What does this Policy cover?

This privacy policy (“Policy”) describes how The Football Association Limited (“The FA”) will make use of your data when your data is processed in relation to the independent review into non-recent child sexual abuse allegations carried out by Clive Sheldon QC and his team (the “Review”). This Policy covers The FA’s analysis and implementation of the Review’s recommendations, the publication of the report into that Review (the “Report”) to ensure the transparency of the findings of the Review, and ancillary issues that may arise following this publication. The FA will also process some of this data to prevent and detect unlawful activity and where necessary to protect children and adults at risk from neglect or physical, mental or emotional harm or to protect their physical, mental or emotional wellbeing.

Where you are a survivor named in the Report, you will have already received a privacy policy explaining how The FA processes your personal data. This Policy repeats the information in that policy but covers a wider group of individuals.

This Policy describes your data protection rights, including a right to object to some of the processing which The FA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

Summary of how The FA uses your data

• The FA processes information about individuals who are named or who are referred to, whether directly or by use of a coded reference, within the Report. The FA processes this data for the purposes of analysing and implementing the recommendations resulting from the Review, publishing the Report, investigating any complaints received following publication of the Report and in connection with any legal, compliance, regulatory or investigative purpose arising out of publication of the Report.
• The FA will also process some of this data to collect, share and retain evidence and intelligence in relation to safeguarding and enforcing applicable FA rules and regulations regarding safeguarding, including the processing of criminal offence and special category personal data to prevent and detect unlawful activity and where necessary to protect children and adults at risk from neglect or physical, mental or emotional harm or to protect their physical, mental or emotional wellbeing. This processing is covered in The FA’s Safeguarding Privacy Policy, available at https://www.thefa.com/public/privacy.
• The information processed by The FA involves both special category and criminal records data – particularly the Report discusses the evidence given by survivors and details of criminal offences. This is processed on the basis of explicit consent or for the purposes of safeguarding children and individuals at risk and protecting the integrity of, and standards of behaviour in, football through sharing the Report’s findings.
• Data is shared through the publication of the Report. Other information held by The FA, including data not included in the Report, may be shared with legal advisers, government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of the parties’ legal or legitimate interests in compliance with applicable laws. It may also be shared in accordance with The FA’s Safeguarding Privacy Policy.
• This privacy policy sets out more details of your data protection rights, including your right to object to certain processing.

What do we mean by personal data, special category personal data and criminal offence data?

• Personal data means information relating to a person that enables them to be identified or identifiable, whether directly or indirectly. This data includes a person’s name, address, location and other factors that might reveal their identity, such as physical features.
• Special category personal data means personal data that reveals any of the following about an individual: racial or ethnic origin; political opinions; religious or philosophical beliefs; or trade union membership or personal data that consists of genetic data; biometric data used for the purpose of identifying an individual; data concerning health; or data concerning an individual’s sex life (this would include any details in relation to sexual abuse) or sexual orientation.
• Criminal offence data means personal data relating to criminal convictions, allegations, investigations and offences. Data concerning survivors of criminal offences also amounts to criminal offence data. Where references are made to criminal offence data in this Policy, this would, where relevant, include data relating to you, where a crime has been perpetrated against you.

What information does The FA process about me?

The FA process information about a range of individuals whose information has been collected or provided in the context of the Review. In particular, the Report and other information provided to The FA contains data relating to survivors, perpetrators and suspected perpetrators who have not been convicted, current and former FA staff, current and former employees of relevant football clubs and County FAs, family members, campaigners, journalists and other individuals who provided evidence or about whom evidence was provided or whose data is publicly available and warrants inclusion in the Report or other information provided to The FA. In particular, the types of information The FA holds about these individuals include:

• name;
• the details of any allegations, whether made to The FA, Clive Sheldon QC and his team or otherwise brought to the attention of the Review;
• details of club affiliation at the time of the allegations, or the person’s role, as relevant to the Review;
• details of actions taken by the individuals in relation to these allegations;
• details of relevant public statements made by the individuals;
• information provided or made available to the Review which was key to providing context or information contained in the media, relevant reports or publications;
• details of any family relationship mentioned and relevant to the Review;
• details of any investigation carried out into any allegations;
• data about physical and mental health, including details of sexual abuse perpetrated against or by these individuals, and the impact that has had on survivors and their family members;
• criminal offence data relating to perpetrators, alleged perpetrators and survivors; and
• other information relevant to the Review.

How does The FA use this information, and what is the legal basis for this use?

The FA will use this information for the following purposes:

• Where you give us your consent:
• if you are a survivor named within the Report, we will publish your data (including any special category personal data or criminal offence data) within the Report where you have given your explicit consent;
• As required by The FA to conduct our business and pursue our legitimate interests and, so far as special category data is concerned, substantial public interests, in particular:
• to publish your data within the Report, including criminal offence data and special category data where this is warranted, to protect participants in football from serious improper conduct and protect the sport’s current participants against risk of harm;
• to analyse and implement the Review’s recommendations, understand whether there are systemic issues in football which allowed non-recent sexual abuse to occur and determine whether The FA’s safeguarding practices should change;
• to communicate with you, where necessary;
• to investigate any complaints received from you or from others or to conduct follow up actions arising from the publication of the Report;
• in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation);
• to collect, share and retain evidence and intelligence in relation to safeguarding and enforcing applicable FA rules and regulations regarding safeguarding, including the processing of criminal offence and special category personal data provided by you to prevent or reduce the risk of recurrence of similar incidents, detect unlawful activity, where necessary to protect children and adults at risk from neglect or physical, mental or emotional harm, to protect their physical, mental or emotional wellbeing and to promote and share information about improvements to practices with safeguarding practitioners. More details on this processing can be found in our Safeguarding Privacy Policy, available at https://www.thefa.com/public/privacy; and
• protect the integrity of, and standards of behaviour in, football and the wider sports community.

• For purposes which are required by law:
• in response to requests by legal advisers, government or law enforcement authorities conducting an investigation; and
• where we are required to hold or collect personal data to meet our legal requirements.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent. If you consented to your data being included in the Report, you can withdraw your consent at any time, and The FA will endeavour to have changes made to any current online version of the Report that it is making available to the public. However, a withdrawal of consent will not invalidate our initial publication of the Report up to that point and it will not be possible to amend hard copy or electronic versions already in circulation.

How is data shared, where and when?

Where your data has been published as part of the Report, this data will be made available on The FA’s website, where it will be accessible to the public and the media, and in hard copy form. All personal data processed in connection with the Review may be shared with legal advisers, government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of the parties’ legal or legitimate interests in compliance with applicable laws. We may also share data in accordance with our Safeguarding Privacy Policy where necessary and appropriate to ensure that The FA meets its safeguarding obligations.

Personal data will also be shared with our third-party service providers, who will process it on behalf of The FA for the purposes identified above. These third parties include the providers of software and archiving services used by The FA to maintain safeguarding records and to store information on behalf of The FA.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not considered adequate under UK law, data is adequately protected by EU Commission approved standard contractual clauses, or a vendor's Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review – you can ask for this using the contact details below.

What rights do I have? 

You have the right to ask The FA for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us in a structured, machine readable format. Where you have consented to The FA’s inclusion of your personal data in the Report, you are also entitled to withdraw any consent you have given to The FA. As explained above, any withdrawal of your consent will not invalidate our initial publication of the Report, however, The FA will endeavour to have changes made to any current online version of the Report made available to the public.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where one of the data controllers doesn’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.

How long will you retain my data?

The FA will retain your personal data as follows:

• The data contained in the Report will be retained for a period of 2 (two) years, forming part of the record of the Report, following which The FA will continue to review on a periodic basis if the Report should continue to be made available to the public.
• Data received and held by The FA in connection with the Review, including as part of the Report and other evidence passed to The FA, will be retained for a period of 2 (two) years, forming part of the record of the Report for FA purposes only, following which The FA will continue to review on a periodic basis if the underlying data held by The FA need to be retained.
• To the extent data is received by The FA’s Safeguarding team as a result of publication of the Report, or any personal data is shared with or already held by The FA’s Safeguarding team and processed for ongoing safeguarding purposes, this will be retained as described in our Safeguarding Privacy Policy.