How must we keep players' photos secure, and what if our account is hacked or a phone is lost?

Security (s19): the club must take appropriate, reasonable technical and organisational measures to prevent loss, damage or unauthorised destruction of photos, and unlawful access to them. That means it must:

• identify reasonably foreseeable internal and external risks (for example shared passwords on the club's social media or photo storage);
• put appropriate safeguards in place against those risks;
• regularly check the safeguards are working; and
• update them as new risks appear.

Security compromise (s22): if there are reasonable grounds to believe someone unauthorised has accessed or acquired the personal information (a hacked account, a lost unlocked phone with player photos), the club must notify:

• the Information Regulator; and
• the affected data subjects (for children, in practice their parents or guardians), unless their identity can't be established.

Notice must be given as soon as reasonably possible, in writing (by post, email, a prominent notice on the club's website, the news media, or as the Regulator directs). It must describe the possible consequences, what the club is doing about it, what the recipient can do to protect themselves, and, if known, who accessed the information.

Source: POPIA (Act 4 of 2013) ss 19, 22.