Sports Q&A - Can I share the club’s marketing database with our sponsors?

Can I share the club’s marketing database with our sponsors?

A club’s marketing database is an asset that can potentially be leveraged not only by the club but also by the club’s sponsors. Since the introduction of the GDPR there has been a great deal of nervousness about sharing personal data with sponsors. However, having the ability to share your database with sponsors can be mutually beneficial and, as we explain below, is not completely ruled out by the current law.

Of course, before deciding whether to share the database with sponsors, clubs need to be mindful of their data protection obligations, but clubs should avoid taking an overly restrictive approach as data protection law is not intended to stifle the legitimate and proportionate sharing of personal data.

Here we take a look at some of the key considerations that clubs should take into account. Sponsors should also be mindful that other considerations may apply in respect of the use that they make of the database once it has been shared.

Why does the club want to share the marketing database?

The purpose for which personal data is intended to be shared sits at the heart of any decision to share personal data.

For example:

• does the club want to share its database with its kit sponsor so that the sponsor can cross-reference the club’s database with its own database and target a selection of its existing customers with offers for the club’s shirt (i.e. the club and sponsor are ‘customer matching’)?
• or will the kit manufacturer go further and target new / prospective customers (not on the sponsor’s pre-existing database) with offers for the club’s shirt?

This fundamental question underpins all of the other considerations set out below.

Does the club need to obtain consent to share the marketing database?

Not quite. It is a misconception that consent is required to share personal data. The club might be able to rely on its (and/or the sponsor’s) ‘legitimate interests’ to share the marketing database (see below).

However, if the sponsor intends to send its own electronic (e.g. email and SMS) marketing communications to persons who are ‘new’ to the sponsor (i.e. people who are on the club’s database but who are not already members of the sponsor’s pre-existing marketing database), e-privacy law does require consent to have been obtained from those new persons in respect of the e-marketing communications that are sent by the sponsor.

In other words, consent is required to send e-marketing communications but not to share the personal data. The practical upshot is:

• the club will not need consent from its customers if the club and the sponsor are ‘customer matching’ their respective databases, and the sponsor will rely on consents (or other marketing permissions) that it has already obtained.
• if the sponsor does not have a pre-existing relationship with the customer, the club will need to ensure that it collects consent that authorises the sponsor to send e-marketing communications. This consent will need to be unambiguous and specific.

The sponsor will only use our database to ‘match’ its customers with ours - is the club free to share the marketing database with the sponsor?

While consent isn’t necessary in respect of the sharing of the database, the club still needs to establish a ‘lawful basis’ for sharing personal data.

Consent is one of a number of lawful bases that a club could rely on but there may be difficulties with establishing valid consent and, even if consent has been validly obtained, individuals can withdraw their consent at any time.

For this reason, the club will likely need to rely on its (and/or the sponsor’s) ‘legitimate interests’ - which can include commercial interests - to lawfully share the personal data.

Before relying on legitimate interests, the club should conduct a ‘legitimate interest assessment’ to determine whether the ground can be properly established. A key element of any such assessment is a balancing test - do the interests and fundamental rights of the individual outweigh the legitimate interest of the club and/or sponsor?

Many factors contribute to such a balancing test, but a key consideration is whether individuals would reasonably expect their personal data to be shared for the purpose that has been identified. Clubs should therefore ensure that they are transparent (e.g. via the club’s privacy policy) with individuals about why their personal data is shared, and who it is shared with.

Ethical considerations are also a factor. If the purpose for which the data is shared does not feel ‘right’, it will be difficult to establish a legitimate interest. Consider whether you would be comfortable to sit in front of a regulator and justify the reason for sharing the database with the sponsor!

If the club hasn’t obtained consent for the sponsor’s marketing, can the sponsor email the ‘new’ customers to request their consent?

No - this communication in itself would be treated as a marketing communication, so this would breach the e-marketing rules.

Is it enough for the club to get fans’ / customers’ consent to receive marketing from ‘select third party partners’?

Unfortunately this won’t be enough. Consent for the sponsor’s marketing activity will only be valid if, at the time that the club collected the marketing permission, the sponsor was specifically mentioned (by name) as a party that will send marketing to the individual.

How much of the database needs to be shared?

Clubs should not share any more personal data than is necessary in order to achieve the purpose. For example, does the club only need to share a list of names and/or email addresses to achieve the purpose, or does it also need to share a more detailed profile of the individuals concerned?

This consideration also interplays with the previous consideration; if the club is sharing more personal data than it needs to, it will be difficult to demonstrate that it has a lawful basis for the sharing.

Final thoughts

As we have indicated, there are many factors that need to be considered before reaching a conclusion that a marketing database can be lawfully shared with a sponsor. The factors set out above are a few of many, and each situation needs to be carefully considered on its own facts.

Once a positive decision to share the database has been taken, the club should document the reasoning behind the decision and make sure that it has a written contract in place with the sponsor to ensure that the personal data is protected and used in accordance with agreed parameters. Do get in touch if you would like any help with this.