The client
Exeter Rugby Club, (more commonly known as Exeter Chiefs), is a professional rugby union club based in Exeter, Devon. The club competes in the English premiership, which is the top-tier league, in English rugby. The Exeter Chiefs are one of the most successful and prominent rugby clubs in recent years, and have established themselves as a significant force in English and European rugby. Having been established way back in 1871, Exeter Chiefs have since made history by becoming the only club to win the top four tiers of English rugby. In recent years, the club has seen more success than ever. They enjoyed their most accomplished season in 2020, during which they won a double in their triumph over the Wasps.
What did they need?
Athletes, like all individuals, have a right to privacy, especially where their personal information is concerned. Sporting clubs capture an enormous amount of special category data, that data being paramount to the ongoing performance of that athlete or team. The UK GDPR, and The Data Protection Act 2018, dictate that athletes’ personal data, such as contact details, medical information, performance data, and financial information is handled securely and only used where there is a lawful reason for doing so.
The club wanted some additional subject matter expertise to help them update their Record of Processing Activities (RoPA) and help them determine their lawful basis for processing each category of data processed within the club. They also wanted support with remediating any risks that were highlighted as part of the RoPA project, and help them to navigate completing complex Data Protection Impact Assessments (DPIAs).
Additional areas of consideration for clubs, similar to Exeter Chiefs, are the collection of fans’ data for marketing purposes, ticket sales, and targeted promotions. Ensuring that consent, where applicable, is fairly given and data subjects are aware of how the club is handling their data. Complying with data protection legislation, and ensuring the correct technical and organisational measures have been embedded across the club, helps to ensure that data is protected at all times.
How did we help?
Data Privacy Advisory Service has supported Exeter Chiefs for over 2 years, providing ad-hoc subject matter expertise on various projects across the club.
We’ve supported them in:
- Policy drafting
- Completion of compliance documentation, such as DPIAs and their Record of Processing Activity (RoPA)
- Support with advice required
- Surveillance compliance (DPIA / policies)
- Data Champion training and bespoke GDPR training
Having the flexibility to use our ad-hoc services has worked well for the club, as they can scale up or back depending on their requirements, making it more affordable.
What the client had to say:
‘As a professional rugby club, the role of data protection plays a crucial role. In an era where technology and analytics have become integral parts of the game, safeguarding sensitive information has become a paramount concern for athletes, teams, and other clubs alike. Having DPAS support us throughout the season with ad-hoc consultancy services, and working with us off-season, to help us in addressing our compliance, has been an invaluable source of support and reassurance.’
Natasha Pavis – Exeter Rugby Club
