GDPR and consent

1. Must the processor take the consent off all participating athletes in every game they give?
2. Must the processor take the consent of their parents in every game their kids are participating in the game?
3. Does the processor has any legal basis for recording this actions?

Answers:

Just to clarify, the academy will be acting as a data controller and not a data processor. Regarding the CCTV system, if the system was set up for security reasons then it is quite unlikely that it can be used to record the games because of the different positioning of the cameras. However, if there is another CCTV system meant to record the games then everyone that is going to be filmed should be made aware about the presence of the CCTV and the purposes for which it is installed and this is usually done via a Privacy Notice.

I will start answering your question with the last one as it is the most relevant.

3. You can rely on Legitimate Interest for the CCTV system but in this case, you would need to perform a Legitimate Interest Assessment;

1. If you decide to rely on legitimate interest then consent is not needed. However, you need to make sure that everyone knows about the CCTV and its purpose;

2. The same applies to minors although in this case, you need to ensure that the parents are aware of the CCTV;

If you want to learn more about Privacy Notices check out this free webinar Privacy Notices under the EU GDPR (https://advisera.com/eugdpracademy/webinar/privacy-notices-under-the-eu-gdpr-free-webinar-on-demand/)