Disclosure rules in relation to grants to sports associations need improvement

The Regulation by the Minister of Sports and Tourism on the rules for the distribution of public money to sports associations needs to be amended and adapted to the GDPR, writes Mirosław Wróblewski, President of the Personal Data Protection Office, to the Minister of Sports and Tourism. - Transparency of the operation of entities participating in grant programmes is not an overriding value that can be realised without ensuring the right to privacy to a certain extent.

The attention of the President of the Personal Data Protection Office to Regulation No. 19 by the Minister of Sports and Tourism of 24 October 2024, introducing principles of transparency in the distribution of public money to sports associations, was drawn by the sports associations: Polish Biathlon Association, Polish Ski Association and Polish Football Association. They were concerned that the Regulation obliges them to publish documents containing personal data on their websites.

According to the ‘Criteria to be applied in the programmes of the Minister of Sports and Tourism regarding transparency and operation of organisations receiving grants’ set out in the annex to Regulation No. 19, sports organisations wishing to receive grants from the state budget should publish, inter alia, the following

• minutes of meetings,
• an up-to-date list of all the organisation's members (the extent of the data required is not indicated),
• a register of concluded contracts (including designation of the parties to the contract, definition of its subject and value)
• as well as a list of remuneration and all other benefits provided to members of the organisation's statutory bodies.

The President of the Personal Data protection Office notes that adopting a model of such universal disclosure of documentation exceeds the need to ensure transparency of their functioning. It leads to excessive interference with the right to protection of personal data and privacy of individuals whose personal data are disclosed.

The Regulation lacks a proper legal basis for the obligation to publish the data, as well as a proper demonstration of the purpose for which the personal data would be disclosed in full scope. The data retention period (time of publication of data on the website, after which the data are deleted) is also not specified. The adopted solutions thus breach a number of data protection principles.

However, the obligation under the Regulation to publish documentation involves the disclosure of personal data of a wide range of persons, not only players and members of the statutory bodies of the organisation, but also employees and other persons connected with the activities of the sports association. The scope of the data to be published is also not precisely indicated, while point II of the criteria in question requires that ‘the information published on the website should represent the actual state of play’.

This wording of the Regulation justifies the conclusion that the solutions adopted need to be re-examined through the prism of national law, i.e. constitutional standards and the Act on sport and GDPR.

It needs to be emphasised that all solutions imposing on certain entities rights and obligations related to the processing of personal data, including their disclosure, should result from a legal act of statutory rank, as required by the Constitution of the Republic of Poland (Article 31(3), Article 51(1) and Article 87(1)), and not from a ministerial regulation.

The legislator, when regulating the matter concerning the processing of personal data, e.g. creating the obligation to process personal data in a specific way, should introduce in the statutory provisions a properly structured legal basis, in particular, it should determine the purpose and scope of data necessary to perform a specific purpose, taking into account the conditions resulting from Article 6 GDPR.

Such provisions should specify:

• the methods of data processing appropriate to the purposes of the processing and attribute the performance of operations on personal data to well-defined authorities and/or bodies, in accordance with their competences under generally applicable law,
• the periods and retention of data and other elements necessary to regulate the processing comprehensively in order to achieve the purposes of the legislator, taking into account Article 6(3) RODO.

Consequently, a systemic approach to the processing of personal data is necessary. Due to the nature of the data processing, i.e. disclosure of personal data on a publicly accessible website, it is also necessary to conduct a privacy test as required by the GDPR. Conducting a data protection impact assessment is a tool to assist in the development of legislation for the processing of personal data, given the nature, scope, scale and means of processing personal data that may result in a high risk to the rights and freedoms of data subjects.

DPNT.413.4.2025