May my sports club post match photos on website?

Sports clubs often publish match photos online — club life + sponsor promotion. GDPR aspect: recognisable players = personal data. Two basis options: (1) Legitimate interest (Art. 6(1)(f)) — clubs argue "public club function + member knew they belonged". BUT balancing test: the younger the members, the more specific the privacy impact. For minors almost never sufficient. (2) Consent (Art. 6(1)(a) + 7) — separately at registration + withdrawable. Safer. For minors: UAVG Art. 5 — under 16 parental consent required. Not "parent came along, so implicit". Practical model: (1) At registration explicit checkbox per platform (website / Instagram / club WhatsApp / yearbook). (2) Sign at match: "Photos are being taken for club website. Prefer not? Notify referee." (3) Per-person opt-out + remove within 14 days of request. (4) Privacy statement with DPO contact. For individual profile photos: separate consent always — cannot be derived from "match-photo consent". AP enforcement: 2024 sports federation fined for child photos without consent — €40k. WBTR: board personally liable.