That isn't completely right, DSARs can be submitted to anyone, the role of data controller is there to make it easy to identify who should be doing it and for accountability. Individuals can be subject to GDPR, the only real exceptions that would protect an individual are where the data relates to personal / household activities, law enforcement and national security. There's an article covering GDPR and individuals below.DSARs can only be submitted to Data Controllers. An individual referee is not a Data Controller any more than a person taking photos of players with their names on their shirts is.
If footage from a body cam is submitted to a CFA (or the police) for disciplinary purposes then a DSAR could be issued to them and I'm sure they have processes in place to accommodate them.
Veo (and all the clubs using them) seem to have managed these issues without fuss.
Veo have a publicly accessible privacy policy that covers, amongst other things, disclosure and transfer of personal data, erasure and retention of personal data, and data subject rights. A referee is going to have none of this, and that is my point, does that mean that the FA or CFAs would need to take on that responsibility.
Don't get me wrong, I can't see there being many situations where a player or club would demand copies of video and images showing them. But they could, and I can't see the FA endorsing and putting their name behind a body cam pilot unless they are absolutely watertight.
Does GDPR Apply to Individuals?
Does GDPR Apply to Individuals? How GDPR Relates to you Personally. Blog by Information Security Awareness Training provider Hut Six Security
www.hutsix.io