Back to school and personal data protection

September marks the start of a new school year for children and teenagers, and is often accompanied by registrations for various extracurricular activities.

This is an opportunity for the CNIL (French National Commission for Information Technology and Civil Liberties) to remind everyone of the importance of good practices in personal data protection, especially when faced with the many forms that need to be filled out.

The French Data Protection Act and the GDPR require companies and entities to comply, but it is important to remember that the primary goal of these regulations is to ensure the protection of individuals’ data.

Leisure organizations, sports clubs, and associations should only collect information that is strictly necessary for registration. For example, data such as nationality, social security number, or marital status of the parents are irrelevant when enrolling a child in an activity like a music class.

On the other hand, information such as the child’s name and surname, the legal guardians’ names, their address, and phone number are essential for proper management of the registration.

In accordance with legal rules on personal data, organizations are required to clearly inform you about the following:

• The identity of the data controller,
• The purpose of the form,
• Whether the requested information is mandatory or optional,
• The recipients of the collected data,
• The ways to access, rectify, and delete the data.

The data retention period should not exceed the registration period, except for legal exceptions such as billing data. You also have the right to refuse the sharing of your contact details with other members of the association.

If you encounter difficulties with an organization, you can file a complaint with the CNIL by clicking here.

– Eléonore DAUPHANT, Trademark Attorney and Partner at Mark & Law

Source (in French): https://www.cnil.fr/fr/les-inscriptions-aux-activites-extrascolaires-dans-le-respect-de-la-vie-privee