Sports fan database: excessive data storage violates fundamental rights
Together with three affected parties, the GFF filed a complaint against the fan database "EASy Violence and Sport" operated by the Bavarian Ministry of the Interior.
In the summer of 2021, it became public knowledge that the Bavarian State Ministry of the Interior, for Sports and Integration was operating the previously unknown database "EASy Violence and Sports". As a result, 362 people from the fan scene submitted a request for information. Our three complainants also requested comprehensive information about their data stored in the database in accordance with Article 65 (1) of the Bavarian Police Tasks Act (BayPAG). An entry in the database was likely according to the three's own assessment, as it was for many other of the 362 applicants*. Despite this, the vast majority of the applicants received the answer that there was no information about them in the fan database.
Did the Ministry delete personal data in response to requests for information?
An inquiry by the Bavarian State Parliament revealed that a total of 385 entries were deleted from the fan database following the 362 requests for information. In cities where a disproportionate number of requests were made, an equally disproportionate number of entries were deleted. It is reasonable to assume that personal data was deleted as a result of the requests.
The responsible parties justified the deleted data with a "rotational" deletion. However, the standard data retention period provided for by law under Article 54 (2) sentences 3 and 4 BayPAG is ten years for adults - but only if the data demonstrably helps to combat criminal offenses. Accordingly, it can be ruled out that this is a case of deletion on a rotational basis. Rather, it seems to have been data that was deleted ad hoc, as it ought not to have been stored in the first place. Retaining data without a defined purpose violates EU law and the fundamental right to data protection.
Individuals must be able to review their personal data
The right of information ensures that individuals can check the data stored about them by public authorities. This is enshrined in the first sentence of recital 63 to the General Data Protection Regulation and the effective legal protection provided by Article 19(4) of the Basic Law.
If the Ministry of the Interior had indeed simply deleted the data in response to the many requests for information and then issued so-called negative information, it would have violated the complainants' right to information under Article 65 (1) sentences 1 and 2 BayPAG. It is irrelevant whether or not the data was processed lawfully.
In order to have all of this reviewed, the GFF, together with the three affected persons and the Munich lawyer Marco Noli, filed a complaint with the Bavarian State Commissioner for Data Protection with the request to clarify the events and, if necessary, to pronounce legal violations and to issue a warning to the Bavarian Ministry of the Interior.
