Registration of participants at events: how does this affect personal data protection?

The Decision of the Minister of Health of 15 June 2020 on the prerequisites for the organisation of cultural, entertainment and other events and gatherings No V-1462 (hereinafter – the “Decision”), as of 1 September 2020, introduced an obligation for event organisers to register the spectators/participants of events in certain circumstances.

First of all, it is important to note that the registration of spectators/participants is not always required for events. Registration is required when the event will be attended by more than 300 spectators/participants or when it is not possible to ensure electronic ticketing. If the event is ticketed electronically or the number of participants is known to be less than 300, no registration of spectators/participants is required. It should also be noted that if tickets for an event are distributed electronically, although registration of spectators/participants is not compulsory, it is possible.

The Decision states that the following personal data must be collected when registering spectators/participants:

• name;
• a telephone number;
• address of permanent residence – street name, house number, apartment number, city, municipality, country.
• It should be noted that the Decision specifies that these personal data are to be kept for 21 calendar days from the date of the event and are to be destroyed at the end of that period.

So, how does this Decision correlate with the protection of personal data and the General Data Protection Regulation (‘GDPR‘)? First of all, as personal data is collected directly from natural persons, it is mandatory to inform them about how their personal data will be processed, in accordance with Article 13 of the GDPR. Thus, such information notice must contain the following information:

• the identity and contact details of the controller (name of the event organiser, telephone number and/or email address);
• the contact details of the data protection officer, if appointed;
• the purpose of the processing is the implementation of measures for the prevention and control of COVID-19 disease (coronavirus infection);
• the legal basis for the processing is the performance of a legal obligation (Article 6(1)(c) GDPR);
• the recipients of the personal data to whom the data of spectators/participants of the events may be transferred;
• recipients of personal data in third countries to whom this data of spectators/participants of events may be transferred;
• a data retention period of 21 calendar days from the date of the event;
• the rights of individuals in the field of personal data protection, including the right to lodge a complaint with the State Data Protection Inspectorate;
• the fact that the provision of personal data is a legal requirement, i.e. that personal data is collected in accordance with the Decision of the Minister of Health of 15 June 2020 on the prerequisites for the organisation of cultural, entertainment and other events and gatherings, No V-1462.

In addition to informing the audience/participants, it is also worth bearing in mind the general principles of personal data protection:

• Personal data collected for the purpose of the implementation of measures for the prevention and control of the COVID-19 disease (coronavirus infection) should not be processed for any other purpose;
• no more personal data should be collected from the spectators/participants of the event than specified in the Decision;
• the personal data collected should be destroyed after a retention period of 21 calendar days;
• appropriate security and confidentiality of the personal data collected for this purpose should be ensured – the personal data collected should not be accessible to employees who do not need the personal data for the performance of their job functions. It should also be ensured that spectators/participants of an event, when providing information about themselves, are not able to access information about other spectators/participants of the event. It is recommended that information is collected online or by electronic means to avoid any possible breach of confidentiality.