Guidance

Euro 2020 Events Research Programme matches: Privacy Notice

Published 8 June 2021

Who is collecting my data?

The Department for Digital, Culture, Media & Sport (DCMS) acting as overall controller of your personal data..

Why are we collecting your data and what happens to my data?

We are collecting your data to reduce the risks associated with coronavirus transmission for spectators attending mass events. Your personal data is collected by the tournament organiser (UEFA) to allow them to permit you entry to the event. As described below, evidence of vaccination (both doses) through trailing of the NHS app technology, or a negative Lateral Flow Test result for Covid-19 is required to enter the event. This will be shown on entry on your mobile device. The event stewards may use a scanning device or will otherwise carry out a visual check to confirm that the evidence you provide satisfies the requirements for entry to the event.

Events Research Programme

The government’s publication of 22 February, ‘COVID-19 Response – Spring 2021’ (‘the roadmap’), describes plans to explore when and how events with larger crowd sizes, less social distancing, or in settings ](where transmission is more likely, will be able to return safely.

The Events Research Programme will oversee this work, bringing findings from across different settings and different sectors to determine a consistent approach to lifting restrictions on events to inform Step 4 of the roadmap. In Step 4, which will take place no earlier than 21 June, the government hopes to be in a position to remove all legal limits on social contact, and to reopen remaining premises, including nightclubs, and ease restrictions on large events, performances, weddings and other life events.

The Events Research Programme will use pilot events incorporating research studies in April, May and June 2021 to build evidence on the risks associated with coronavirus transmission, the characteristics of events and surrounding activities, and the most effective steps for reducing these risks. The evidence from these studies will be used to inform the government's decision around Step 4 of the roadmap and will shape government policy to bring about the phased return of fuller audiences to venues and events up and down England.

The pilot events will examine a range of factors, including but not limited to: indoor and outdoor settings; small and large venues; seated and standing events; different forms of audience participation; transport to and from events; duration; and ventilation.

Your event

You will be attending the event you are interested in as a spectator. Your personal data may be used for the purposes of research studies within the Events Research Programme. As part of the work within the Events Research Programme the event will be monitored and recorded to better understand ventilation and human behaviours at large events. To the extent that any recording footage constitutes personal data, this Privacy Notice will apply. The Secretary of State has the power to designate such an event as being permitted for research purposes and therefore not subject to the legal restrictions which would apply to other events under Step 2 of the government’s roadmap. Although steps are being taken to reduce the additional risk of COVID infection this might introduce, you should make sure you are comfortable with the risk set out below.

This event is the UEFA EURO 2020 group matches taking place on the 13 June (England v Croatia) & 18 June (England v Scotland) at Wembley Stadium. The capacity of the venue will be capped at 22,500 attendees.

Testing

All spectators attending the event will be subject to evidence of:

• a negative Lateral Flow Test result for Covid-19 carried out at home or in person at an Asymptomatic Test Site close to where you live or work and which has been taken no more than 48 hours before attending the match; OR

• vaccination status as demonstrated via the NHS app.

If you are unable to access or use the NHS app, you will be required to evidence a negative Lateral Flow test result.

A negative Lateral Flow test result means the test did not find signs of coronavirus but does not guarantee that you or other participants do not have coronavirus, so you must keep following all social distancing advice before and after your participation in the event.

A positive result from a Lateral Flow test means it’s likely you had coronavirus when the test was done. You and anyone you live with must not attend the event and self-isolate immediately. You are then advised to get a PCR test (a test that is sent to a lab) to confirm your result as soon as possible.

It is a condition of entry to the event that the spectators can demonstrate a negative lateral flow test result or have the relevant vaccine status. If a spectator is unable to provide such evidence, entry to the event will be refused.

About you

Attendance at this event is at your own risk; you are liable should you test positive for COVID-19 following the event. It is your responsibility to decide whether or not it is appropriate for you to attend this event. This decision should be based upon your own health status and susceptibility to infection, and that of members of your family, social bubble or, where applicable, your support bubble, together with an assessment of your own attitude to the potential risks.

You must respect the social distancing needs of others and avoid acting in any way that might risk the health of fellow spectators and staff working at the venue. For example, if the tournament organiser requires you to wear a face covering at all times in the venue, or in certain sections, you should adhere to this requirement. At the same time, the tournament organiser and fellow spectators should be aware that some disabled people may not be able to follow all the social distancing and other measures put in place, including the wearing of face coverings.

What is the legal basis for processing my data?

For the purposes of the Events Research Programme, DCMS do not directly collect or see any personal data, however we are defined as the controller under UK. GDPR Art. 4, ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

To process this personal data, our legal reason for collecting or processing this data is: Article 6(1) e; processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Admission to the venues implies that you have had a negative Lateral Flow Test result, or are fully vaccinated, all of which are classed as health data. The DCMS relies on the UK.GDPR Art. 9 (2) h. processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law or pursuant to contract with a health professional and subject to the conditions and safeguards.

The lawful basis that we rely on to process your personal data will determine which of the following rights are available to you. Much of the processing we do in DCMS will be necessary to meet our legal obligations or to perform a public task. If we hold personal data about you in different parts of DCMS for different purposes, then the legal basis we rely on in each case may not be the same.

What personal data do we collect?

DCMS does not directly collect any of your data. As explained above, the event will be recorded by a third party, Movement Strategies, to better understand ventilation and human behaviours at large events. To the extent that such footage constitutes personal data, DCMS will not have access to any underlying footage.If a visual check is carried out to verify the evidence you provide to enter the event, we will not collect or process your personal data. If the 2D barcode on your NHS app is scanned by a steward, your personal data is collected by the ticketing agent for the purpose of entering the event. When you take a lateral flow test, are immunised against COVID-19 or test positive for Covid-19, the data will remain with NHS Test and Trace. You can find out more about what data is collected by NHS Test and Test by viewing their Privacy Notice at: Test and Trace Privacy Notice.

What is personal data?

Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject’. A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.

How secure is your information with third party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes unless they are data controllers in their own right in relation to your personal data. Where they operate as our “data processors” (ie they process your personal data on our behalf and acting only on our instructions), we only permit them to process your personal data for specified purposes and in accordance with our instructions.

What will happen if I do not provide this data?

If you do not show the evidence required to enter the event, you will not be permitted entry to the event.

We will not use your data for any automated decision making.

We will not be sending your personal data outside the U.K.

What are your data protection rights?

You have the right to request:

• information about how your personal data is processed

• a copy of that personal data

• that anything inaccurate in your personal data is corrected immediately

You can also:

• raise an objection about how your personal data is processed

• request that your personal data is erased if there is no longer a justification for it

• ask that the processing of your personal data is restricted in certain circumstances

If you have any of these requests, get in contact with our Privacy Team.

Contact details for the data controller’s Data Protection Officer (DPO)

Data Protection Officer

The Department for Digital, Culture, Media & Sport

100 Parliament Street

London

SW1A 2BQ

Email: DPO@dcms.gov.uk

If you’re unhappy with the way we have handled your personal data and want to make a complaint, please write to the department’s Data Protection Officer or the Data Protection Manager at the relevant agency. You can contact the department’s Data Protection Officer using the details above.

You have rights over your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The Information Commissioner’s Office (ICO) is the supervisory authority for data protection legislation, and maintains a full explanation of these rights on its website

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Airborne Infection Reduction through Building Operation and Design for SARS-CoV-2 (AIRBODS)

AIRBODS is a joint research programme between Loughborough University, University College London, the University of Cambridge, the University of Nottingham, the University of Sheffield and London South Bank University. AIRBODS is a UKRI-funded project which aims to quantify the risk of transmission of SARS-CoV-2 in buildings, and thereby offer guidance on the ventilation operation and future design of non-domestic buildings.

The team’s role in the Events Research Programme is to collect environmental data around the venu. We will do this by monitoring indoor air quality (measuring and recording CO~2~ levels, air temperature and relative humidity - moisture content) in the air at different locations around the venue, and relating this to the number of people present and microbiological analysis of surfaces around the venue. This data will be used to determine a Relative Exposure Index. This is not an absolute measure of the risk of transmission, but a measure of exposure relative to a benchmark case.

Movement Strategies

Movement Strategies will be undertaking observations at and around the venue to categorise the behaviour of attendees in response to the event itself and also the operational overlay implemented as part of the pilot programme.

Data will be collected via camera and manual observations and will focus on attendees conducting routine (‘public’) activities typically monitored at such events as part of standard safety and security measures.  During these observations, the team will not be interacting with or asking anyone to do anything beyond their normal attendance.

The team will also analyse various data sources post-event (e.g. CCTV footage) to measure different behaviours that may influence the risk of transmission within different settings. Any data captured will be stored, analysed and disposed of in a secure manner, consistent with legal requirements and industry best practice.

A small sample of attendees may be asked to wear tracking devices for a period of time during their attendance. The wearing of this device is entirely voluntary. These attendees will be asked for their consent giving permission for them to wear this device. This device enables their movement (paths, locations, etc.) to be tracked within the event. No other information is generated. The data will not be associated with the individual’s identity. At any point, the participant can return the device and stop being tracked in this way.