A club’s marketing database is an asset that can potentially be leveraged not only by the club but also by the club’s sponsors. Since the introduction of the General Data Protection Regulation (GDPR) there has been a great deal of nervousness about sharing personal data with sponsors. However, having the ability to share your database with sponsors can be mutually beneficial and, as we explain below, is not completely ruled out by the current law.
Of course, before deciding whether to share the database with sponsors, clubs need to be mindful of their data protection obligations, but clubs should avoid taking an overly restrictive approach as data protection law is not intended to stifle the legitimate and proportionate sharing of personal data.
This piece takes a look at some of the key considerations that clubs should take into account. Sponsors should also be mindful that other considerations may apply in respect of the use that they make of the database once it has been shared.
Q: Why does the club want to share the marketing database?
The purpose for which personal data is intended to be shared sits at the heart of any decision to share personal data. For example:
- does the club want to share its database with its kit sponsor so that the sponsor can cross-reference the club’s database with its own database and target a selection of its existing customers with offers for the club’s shirt (i.e. the club and sponsor are “customer matching”)?
- or will the kit manufacturer go further and target new / prospective customers (not on the sponsor’s pre-existing database) with offers for the club’s shirt?
This fundamental question underpins all of the other considerations set out below.
Q: Does the club need to obtain consent to share the marketing database?
Not quite. It is a misconception that consent is required to share personal data. The club might be able to rely on its (and/or the sponsor’s) “legitimate interests” to share the marketing database (see below).
However, if the sponsor intends to send its own electronic (e.g. email and SMS) marketing communications to persons who are “new” to the sponsor (i.e. people who are on the club’s database but who are not already members of the sponsor’s pre-existing marketing database), e-privacy law does require consent to have been obtained from those new persons in respect of the e-marketing communications that are sent by the sponsor.
In other words, consent is required to send e-marketing communications but not to share the personal data. The practical upshot is:
- the club will not need consent from its customers if the club and the sponsor are “customer matching” their respective databases, and the sponsor will rely on consents (or other marketing permissions) that it has already obtained.
- if the sponsor does not have a pre-existing relationship with the customer, the club will need to ensure that it collects consent that authorises the sponsor to send e-marketing communications. This consent will need to be unambiguous and specific.
Q: The sponsor will only use our database to “match” its customers with ours – is the club free to share the marketing database with the sponsor?
While consent isn’t necessary in respect of the sharing of the database, the club still needs to establish a “lawful basis” for sharing personal data.
Consent is one of a number of lawful bases that a club could rely on but there may be difficulties with establishing valid consent and, even if consent has been validly obtained, individuals can withdraw their consent at any time.
For this reason, the club will likely need to rely on its (and/or the sponsor’s) “legitimate interests” – which can include commercial interests – to lawfully share the personal data.
Before relying on legitimate interests, the club should conduct a ‘legitimate interest assessment’ to determine whether the ground can be properly established. A key element of any such assessment is a balancing test – do the interests and fundamental rights of the individual outweigh the legitimate interest of the club and/or sponsor?
Ethical considerations are also a factor. If the purpose for which the data is shared does not feel “right“, it will be difficult to establish a legitimate interest. Consider whether you would be comfortable to sit in front of a regulator and justify the reason for sharing the database with the sponsor!
Q: If the club hasn’t obtained consent for the sponsor’s marketing, can the sponsor email the “new” customers to request their consent?
No – this communication in itself would be treated as a marketing communication, so this would breach the e-marketing rules.
Q: Is it enough for the club to get fans’ / customers’ consent to receive marketing from “select third party partners“?
Unfortunately this won’t be enough. Consent for the sponsor’s marketing activity will only be valid if, at the time that the club collected the marketing permission, the sponsor was specifically mentioned (by name) as a party that will send marketing to the individual.
Q: How much of the database needs to be shared?
Clubs should not share any more personal data than is necessary in order to achieve the purpose. For example, does the club only need to share a list of names and/or email addresses to achieve the purpose, or does it also need to share a more detailed profile of the individuals concerned?
This consideration also interplays with the previous consideration; if the club is sharing more personal data than it needs to, it will be difficult to demonstrate that it has a lawful basis for the sharing.
As we have indicated, there are many factors that need to be considered before reaching a conclusion that a marketing database can be lawfully shared with a sponsor. The factors set out above are a few of many, and each situation needs to be carefully considered on its own facts.
Once a positive decision to share the database has been taken, the club should document the reasoning behind the decision and make sure that it has a written contract in place with the sponsor to ensure that the personal data is protected and used in accordance with agreed parameters. Do get in touch if you would like any help with this.
This work was written for and first published on LawInSport.com (unless otherwise stated) and the copyright is owned by LawInSport Ltd. Permission to make digital or hard copies of this work (or part, or abstracts, of it) for personal use provided copies are not made or distributed for profit or commercial advantage, and provided that all copies bear this notice and full citation on the first page (which should include the URL, company name (LawInSport), article title, author name, date of the publication and date of use) of any copies made. Copyright for components of this work owned by parties other than LawInSport must be honoured.
Author: Mark Hersey Associate, Lewis Silkin LLP
Mark is an Associate in Lewis Silkin’s Commercial, Data Privacy and Brands & IP practice groups. He joined Lewis Silkin in January 2018 and primarily advises clients on commercial contracts and data privacy matters.
He qualified as a solicitor in March 2016 and since then have gained a broad range of non-contentious and contentious experience for a variety of clients. Prior to training as a solicitor I was a compliance officer for a multinational bank and studied law at the University of Nottingham.