A group of over 850 professional footballers have threatened legal action against several betting, data sharing and entertainment companies regarding how players’ personal data is collected and shared. The players’ group coordinating the legal action is the Global Sports Data and Technology Group. It is led by former Cardiff City, Leyton Orient and Yeovil Town manager, Russel Slade who calls the action “Project Red Card”. Should the case succeed, it could have a significant impact on how the sports industry handles the processing of personal data either in the UK, Europe or globally.
The players’ group argues that information such as a player’s height, weight or the average number of goals scored amounts to personal data. It says that this is being unlawfully processed by numerous betting, data sharing and entertainment companies. Formal letters before action have now been issued to 17 such companies.
The players are seeking compensation for the dissemination of their performance data over the past six years. The group is also calling for annual fees to be paid to players by those companies commercialising their data in future.
As per Article 4 paragraph (1) of the GDPR personal data, any information relating to an identified or identifiable natural person, where the latter can be identified, directly or indirectly, in particular by reference to an identifier (i.e., amongst another name or to one or more factors specific to the physical, physiological or social identity of that natural person). Where the personal data processing falls under the material scope of Article 2 of GDPR, the rules and principles set in GDPR must be observed.
In the case at hand, for the players to receive compensation for such damages, the same must prove not only that the processing activities performed in relation with their personal data by the betting, data sharing, and entertainment companies have infringed GDPR but also that as a consequence of the infringement, the players have suffered material or non-material damages.
If this initial case is successful, it might create an important precedent for wider legal action against a far broader range of companies which also harvest player data. Indeed, the players’ group says that it has identified some 150 companies unlawfully using players’ personal data.
The group is making the case that using players’ personal data without their consent constitutes a breach of the General Data Protection Regulations, 2018. As mentioned above, it is important to note if the information on the players constitutes personal data under Article 4 paragraph (1) of GDPR. The fact that a goal is scored is not itself personal information, but when it is attributed to an individual in specific contexts then the same can constitute for personal data under GDPR. As for consent, it should be noted that the same is not the only legal ground in case of processing personal data. In fact, GDPR provides for six legal grounds for processing personal data and none of these six has precedent over the others.
Another issue the players have raised is the inaccuracy of some of the personal data that is being processed. Slade recently told the Guardian that “What we would rather do is talk and resolve the matter with these companies that are collecting the data, processing the data and using it without the players’ consent. I want to bring it to the attention of everybody and solve it going forward so the control goes back to the players, so we know that data that is going out is accurate and correct, and a fair reflection of the individual.” It remains to be seen whether an out of court settlement can be agreed. However, the players’ right to get their data rectified cannot be waived.
Thus, should this matter go to court, it is likely to involve some very interesting and complex legal arguments. For example, companies sharing performance data may argue that, by agreeing to play in public, the facts about players’ performance inevitably enter into the public domain and that they have a legitimate interest in processing such information for their purposes. The court might decide that the companies have a legitimate interest in processing the players’ information, and that such interest outweighs the interest of the players in not having their personal data processed.
Indeed, the UK’s Information Commissioners Office (ICO) says that this legitimate interest legal ground “could in principle apply to any type of processing for any reasonable purpose.” However, the ICO also says that “Because it could apply in a wide range of circumstances, it puts the onus on you to balance your legitimate interests and the necessity of processing the personal data against the interests, rights and freedoms of the individual taking into account the particular circumstances.” This can involve a difficult balancing exercise, and this can vary depending on the precise facts of the case.
Nevertheless, depending on the provided arguments, the court might decide that in this case, the fact that the information is in the public domain does not justify the processing of such information by the third parties based on the legitimate interest of the same.
The court might go further in its analysis and see if there are any legally binding agreements concluded by the players pursuant to which their personal data might be processed in a commercial manner. The intricacies of the contractual agreements between the concerned parties, the players, their clubs, the tournaments, the leagues or the broadcasters will make things even more complicated, since various interests may collide, and the court will need to decide which interest takes precedent over another. For example, a club has contracted to sell the television rights to a company, and potentially made commitments regarding players’ personal data, but at the same the players have committed themselves to their clubs.
The court will need to provide an in-depth analysis on the situation at hand starting from the different types of data that are processed, such as match-stats, height, weight, age, or health information and the various agreements concluded in this case. Depending on the precise facts surrounding each type of data and circumstance, a different outcome might be reached.
However, this case holds many unknowns and in the absence of all the details pertaining to this case and it is difficult to assess the final outcome.
Additionally, the subject of the monetisation of personal data is very topical at the moment. The European Data Protection Board (EDPB) makes clear that “considering that data protection is a fundamental right guaranteed by Article 8 of the Charter, and taking into account that one of the main purposes of the GDPR is to provide data subjects with control over personal data relating to them, the EDPB reiterates that personal data cannot be considered as a ‘tradeable commodity’. An important consequence of this is that, even if the data subject can agree to the processing of his or her personal data, he or she cannot waive his or her fundamental rights. As a further consequence, the controller to whom consent has been provided by the data subject to the processing of her or his personal data is not entitled to ‘exchange’ or ‘trade’ personal data (as a so-called ‘commodity’) in a way that would result as not being in accordance with all applicable data protection principles and rules.”
This reasoning implies that each detail of the data processing activities will play a significant role in the assessment of the case. Likewise, the details as to the precise manner in which personal data is commercialised or traded on will be important in determining whether or not the subsequent use of data is lawful. There are likely to be different considerations for the different types of data processed, and for the different companies involved, depending on precisely how they operate. All this suggests that even the initial case involving 17 defendants could yet prove to be very complex indeed, should the matter go to court.
It will be certainly interesting to see how this matter progresses if it goes to court. If the case is successful, it could bring about significant changes to how such data is collected and handled across the entire sports industry. Likewise, it will be also interesting to see how the contractual relationship between the players and the clubs with regards to the players’ personal data will be framed in the future.
