France: CNIL publishes guidance on the collection of data relating to an athlete’s disability (14 May 2024)
Published Date
May 30, 2024
Related people
With the 2024 Paris Olympics approximately two months away, and with the Paralympic Games to follow shortly after, on 14 May 2024, the French supervisory authority (CNIL) published guidance on the processing of athlete disability data.
The CNIL highlights that under Article 9(1) GDPR, the collection of health data, including any information on disability, is considered “sensitive data” (also known as “special category data”).
The CNIL clarified that, in addition to having a legal basis for the processing of data concerning an athletes’ disability (under Article 6 GDPR), two further conditions must also be met:
- data concerning the disability of an athlete must only be collected if it is strictly necessary to meet a specific use, for example renewing a sports licence. This must be assessed on a case-by-case basis, depending on the purpose and extent of personal data collection; and
- a sensitive data processing condition must be identified pursuant to Article 9(2) GDPR. The CNIL notes that in most cases, this will involve obtaining the athlete’s consent (which must be freely given), to reveal the nature of his disability.
The CNIL also clarified that while a data protection impact assessment is not always required in order to collect and use data concerning disability, it is good practice to carry one out.
The guidance is available here (in French only).
Related capabilities
