In the past, athletes used to rely solely on their ability in order to succeed. Now, through the developments in and increased use of technology, there is a heavy reliance on performance tracking and data analysis. This has led to privacy concerns with many athletes becoming increasingly concerned that the data gathered in relation to their performance could be used for by third parties for other purposes. As such, athletes are now looking to take back control by limiting who has access to their data and ensuring that their data is only being used for legitimate purposes.
The increased use of technology
The tracking of sports performances is not a recent development. Tracking has been used in sports for numerous years. For example, in sports such as football and basketball, the number of passes made before a goal or basket was scored would be counted. More generally, athletes were often, and still are, subject to fitness tests whereby their performance and data would be recorded and analysed.
However, there has been significant developments in technology over the years, including the use of wearables, which has led to sports clubs being able to gather vast amounts of data in a more efficient manner.
Wearables are electronic products which are incorporated into clothes and accessories. These are used widely in sports; for example, runners tend to have monitors in their shoes during races, footballers often have monitors in their sports vest during matches and training, and many athletes use smart watches. These devices can all be used when training, when in a match, or even when resting and recovering. As such, the amount of data which can be gathered and compiled is vast and the ability to gather and share this data is easier than ever before. The ultimate goal of gathering this data is to improve overall performance, however this also gives rise to data protection concerns.
It is also worth noting that these privacy concerns are not limited to sports athletes. The issue equally applies to Esports, an area which is continually growing in popularity. Everyday video gamers will use their personal information which can be collected and used by developers. Moreover, the number of professional Esports organisations continue to grow and players participating in such organisations are likely to experience similar data protection concerns to athletes as their information and performance can be tracked and analysed.
Data protection implications
The majority of the data collected from athletes in relation to their performance will fall under the category of ‘personal data relating to health’. Health data is considered a form of sensitive personal data under UK GDPR. As such, special protection is required for this type of data which sports club and Esports organisations need to comply with. In particular, clubs and organisations should consider the following issues:
Legal grounds for processing
In order to process personal data, a legal basis is required. For clubs and organisations, the most likely grounds for processing are consent and legitimate interest. If the club or organisation is relying on consent, it is important that athletes and players provide informed consent, meaning that they should be informed as to how their data is being processed, who the data is being shared with, and their rights.
Lack of transparency on sharing with third parties
Perhaps the biggest issue in sports analysis currently is the sharing of personal data with third parties such as betting companies and video game companies. Betting companies have a significant interest in such data as it can be exploited to predict players’ performances which can influence odds. However, it is likely that when consenting, athletes are unaware that their data could be shared with such companies. In addition, clubs and organisations may themselves be unaware that the data could be shared with such companies if the correct diligence is not carried out when contracting with third parties’ such as reviewing privacy policies and terms relating to data sharing. As such, clubs and organisations need to ensure that: (a) their privacy policies and contracts set out clearly who data is shared with, and (b) ensure that the correct diligence is carried out when entering into any contracts with third parties.
Private v public information
Clubs and organisations need to be aware that whilst certain information may be available through the televised broadcasting of games and events, or more recently online streaming, much of the data which clubs and organisations gather will be private and sensitive data. As such, organisations need to have safeguards in place for this data both in relation to the processing of the data but also the storage of the data. Clubs and organisations also need to have clear policies in place in relation to data retention. In sports, athletes frequently transfer to other teams and when this occurs, clubs and organisations need to ensure that the data they hold on the athletes is not kept for longer than necessary or shared with others unless agreements are in place.
Looking forward
Clubs and organisations must ensure that the above issues are considered as well as ensuring overall compliance with data protection legislation. The recent legal action for compensation threatened by over 850 footballers, led by Russell Slade, previous manager of Cardiff City, Leyton Orient and Yeovil Town, against gaming, betting and data-processing companies should serve as a warning to clubs and organisations that this issue is not going to go away anytime soon. Currently, no formal action has been raised but should this initial claim be successful, it could result in a wave of claims being brought by footballers and other sports athletes for the misuse of their personal data.
Going forward, players should have an awareness of data protection law and any rights which they may have. In particular, players need to ensure that all policies relating to data protection are provided by clubs and organisations and read carefully. If players are unsure about certain policies or provisions including in the policies, legal advice should be sought before consenting to avoid any potential misuse of data. Moreover, players should also consider filing data subject access requests (DSARs) as a way of being able to know what data companies hold on them and how it is shared.
Players may also look to adopt the approach taken with imagery rights as a way of controlling their data. In previous years, players protested against the inclusion of their names in video games without their consent resulting in a licence fee by video game developers for use of Premier League player’s names. In a similar manner, athletes may look to take greater control over their data by requiring licences for the processing of their data with royalties being paid to the players. Whilst this would provide protection, there still requires to be clear and unambiguous drafting in the licence agreements, which must be clearly understood by players, to ensure that informed consent is granted.
For clubs and organisations, a review of the current policies and contracts should be undertaken to ensure that the processing of players’ personal data is fair, transparent, and based on one of the legal grounds for processing. This will ensure that they avoid any enforcement action being taken against them by data protection authorities such as the ICO as well as avoid potential actions being brought by players.
How we can help
Our specialist Data Protection team can assist athletes with understanding their data protection rights and options if they feel their club or organisation have not complied with data protection legislation. Moreover, our team can assist clubs and organisations ensure they comply with data protection legislation to avoid any action or enforcement being brought against them.
