The Norwegian Data Protection Authority (Datatilsynet) published its response to the Norwegian Ministry of Culture and Equality’s proposal for an Act on the processing of sensitive personal data in sport (the Act). The Act includes provisions allowing organizations associated with the Norwegian Sports Confederation to process personal information related to criminal convictions and previous offenses to prevent, detect, and respond to sexual abuse, harassment, and violence in sports.
The Datatilsynet emphasized the need for a thorough assessment of the proposal’s impact on privacy, given the highly sensitive nature of the personal data involved. They highlighted that processing such data could pose a significant risk to the rights and freedoms of individuals.
In its response, the Datatilsynet suggested several key elements that should be included in the Act:
-
a separate section outlining the requirement for a legal basis for processing personal data;
-
provisions ensuring strict access control and maintaining confidentiality;
-
clear definitions to address the current vagueness regarding exceptions to the duty of confidentiality.
These recommendations aim to strengthen the protection of personal data and ensure that the processing of sensitive information in sports is conducted responsibly and ethically.