Comments of the President of the Personal Data Protection Office on the amendment to the Sports Act

The regulations governing the rules for collecting, storing, and sharing students’ data in the ‘Assessment of Students’ Motor Skills’ register require verification of the proportionality and purposefulness of the scope of their processing

This concerns the ‘Sports Talents’ register, renamed in the amended act as ‘Assessment of Students’ Motor Skills’, created under the amendment to the Public Health Act of 7 August 2023, in the drafting of which the supervisory authority was not involved. An even greater amount of data will be processed in the register — it will include data of students covered by early childhood education, i.e., pupils in grades I–III of primary schools.

Currently, the register contains data of students from primary schools (grades IV–VIII) and secondary schools, obtained from the education information system and entered into the register by the school the student attends. To a specified extent, these data may be made available to sports clubs and associations, as well as to public entities and other entities performing scientific-research, teaching, educational, or statistical tasks.

The adopted model for maintaining the register raises serious concerns of the President of the Personal Data Protection Office, who, in the context of the work on the amendment to the Sports Act, points out that:

• The database (register) contains detailed data about students (including special-category data), and the scope of their processing is not justified by the intended purpose of the register’s functioning, namely the systemic monitoring of the physical fitness of children and adolescents and the ability to identify sports talents.
• The processing of special-category data requires meeting one of the conditions that legitimise such processing as set out in Article 9(2) of the GDPR. The manner and purpose of collecting these categories of data under the current wording of the regulations do not allow reliance on any of the grounds listed in that provision.
• The disclosure of data from a public database requires verification of the purpose and scope of the data sharing, the provision of security safeguards, and the precise indication of the entities to which the data may be disclosed.

• It is necessary to shorten the retention period of data collected in the register to ensure compliance with the principle of storage limitation set out in Article 5(1)(e) of the GDPR, according to which personal data must be kept in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data are processed.

DPNT.401.425.2025