A group of over 850 professional footballers have threatened legal action against several betting, data sharing and entertainment companies regarding how players’ personal data is collected and shared. The players’ group coordinating the legal action is the Global Sports Data and Technology Group. It is led by former Cardiff City, Leyton Orient and Yeovil Town manager, Russel Slade who calls the action “Project Red Card”. Should the case succeed, it could have a significant impact on how the sports industry handles the processing of personal data either in the UK, Europe or globally.
The players’ group argues that information such as a player’s height, weight or the average number of goals scored amounts to personal data. It says that this is being unlawfully processed by numerous betting, data sharing and entertainment companies. Formal letters before action have now been issued to 17 such companies.
The players are seeking compensation for the dissemination of their performance data over the past six years. The group is also calling for annual fees to be paid to players by those companies commercialising their data in future.
As per Article 4 paragraph (1) of the GDPR personal data, any information relating to an identified or identifiable natural person, where the latter can be identified, directly or indirectly, in particular by reference to an identifier (i.e., amongst another name or to one or more factors specific to the physical, physiological or social identity of that natural person). Where the personal data processing falls under the material scope of Article 2 of GDPR, the rules and principles set in GDPR must be observed.
In the case at hand, for the players to receive compensation for such damages, the same must prove not only that the processing activities performed in relation with their personal data by the betting, data sharing, and entertainment companies have infringed GDPR but also that as a consequence of the infringement, the players have suffered material or non-material damages.
If this initial case is successful, it might create an important precedent for wider legal action against a far broader range of companies which also harvest player data. Indeed, the players’ group says that it has identified some 150 companies unlawfully using players’ personal data.
The group is making the case that using players’ personal data without their consent constitutes a breach of the General Data Protection Regulations, 2018. As mentioned above, it is important to note if the information on the players constitutes personal data under Article 4 paragraph (1) of GDPR. The fact that a goal is scored is not itself personal information, but when it is attributed to an individual in specific contexts then the same can constitute for personal data under GDPR. As for consent, it should be noted that the same is not the only legal ground in case of processing personal data. In fact, GDPR provides for six legal grounds for processing personal data and none of these six has precedent over the others.
Another issue the players have raised is the inaccuracy of some of the personal data that is being processed. Slade recently told the Guardian that “What we would rather do is talk and resolve the matter with these companies that are collecting the data, processing the data and using it without the players’ consent. I want to bring it to the attention of everybody and solve it going forward so the control goes back to the players, so we know that data that is going out is accurate and correct, and a fair reflection of the individual.” It remains to be seen whether an out of court settlement can be agreed. However, the players’ right to get their data rectified cannot be waived.
Thus, should this matter go to court, it is likely to involve some very interesting and complex legal arguments. For example, companies sharing performance data may argue that, by agreeing to play in public, the facts about players’ performance inevitably enter into the public domain and that they have a legitimate interest in processing such information for their purposes. The court might decide that the companies have a legitimate interest in processing the players’ information, and that such interest outweighs the interest of the players in not having their personal data processed.
Indeed, the UK’s Information Commissioners Office (ICO) says that this legitimate interest legal ground “could in principle apply to any type of processing for any reasonable purpose.” However, the ICO also says that “Because it could apply in a wide range of circumstances, it puts the onus on you to balance your legitimate interests and the necessity of processing the personal data against the interests, rights and freedoms of the individual taking into account the particular circumstances.” This can involve a difficult balancing exercise, and this can vary depending on the precise facts of the case.
Nevertheless, depending on the provided arguments, the court might decide that in this case, the fact that the information is in the public domain does not justify the processing of such information by the third parties based on the legitimate interest of the same.
The court might go further in its analysis and see if there are any legally binding agreements concluded by the players pursuant to which their personal data might be processed in a commercial manner. The intricacies of the contractual agreements between the concerned parties, the players, their clubs, the tournaments, the leagues or the broadcasters will make things even more complicated, since various interests may collide, and the court will need to decide which interest takes precedent over another. For example, a club has contracted to sell the television rights to a company, and potentially made commitments regarding players’ personal data, but at the same the players have committed themselves to their clubs.
The court will need to provide an in-depth analysis on the situation at hand starting from the different types of data that are processed, such as match-stats, height, weight, age, or health information and the various agreements concluded in this case. Depending on the precise facts surrounding each type of data and circumstance, a different outcome might be reached.
However, this case holds many unknowns and in the absence of all the details pertaining to this case and it is difficult to assess the final outcome.
Additionally, the subject of the monetisation of personal data is very topical at the moment. The European Data Protection Board (EDPB) makes clear that “considering that data protection is a fundamental right guaranteed by Article 8 of the Charter, and taking into account that one of the main purposes of the GDPR is to provide data subjects with control over personal data relating to them, the EDPB reiterates that personal data cannot be considered as a ‘tradeable commodity’. An important consequence of this is that, even if the data subject can agree to the processing of his or her personal data, he or she cannot waive his or her fundamental rights. As a further consequence, the controller to whom consent has been provided by the data subject to the processing of her or his personal data is not entitled to ‘exchange’ or ‘trade’ personal data (as a so-called ‘commodity’) in a way that would result as not being in accordance with all applicable data protection principles and rules.”
This reasoning implies that each detail of the data processing activities will play a significant role in the assessment of the case. Likewise, the details as to the precise manner in which personal data is commercialised or traded on will be important in determining whether or not the subsequent use of data is lawful. There are likely to be different considerations for the different types of data processed, and for the different companies involved, depending on precisely how they operate. All this suggests that even the initial case involving 17 defendants could yet prove to be very complex indeed, should the matter go to court.
It will be certainly interesting to see how this matter progresses if it goes to court. If the case is successful, it could bring about significant changes to how such data is collected and handled across the entire sports industry. Likewise, it will be also interesting to see how the contractual relationship between the players and the clubs with regards to the players’ personal data will be framed in the future.
This article was originally published in SportBusiness.
Broadcasting rights of major sports competitions is an important source of revenue for their organisers, with media rights being sold for millions of dollars. Sportsmen and sportswomen are not only paid to perform their art, but also to let the public enjoy it from a distance and in different medias.
Competitions organised by the Union of European Football Associations (“UEFA”) are some of the most watched in the world. UEFA monetizes these opportunities by, among others, producing footage of the events and selling media coverage. UEFA owns the media rights to its events based on what the participating regulation football associations adhere to; in their turn, football associations acquire permission to use the images of their players through employment or other contractual arrangements.
However, the extent to which an athlete’s image may be exploited is not always clear-cut. Sometimes, boundaries with other rights, such as the athlete’s right to privacy, can become blurred, especially when the athlete is performing in a competition.
An eloquent example of a borderline situation was the recent incident involving the Danish football player Christian Eriksen, who was filmed for an extensive duration while suffering a cardiac arrest during his team’s match against Finland at the UEFA Euro 2020. The cameras lingered on the suffering footballer, showing not only his suffering, but also that of his distressed partner.
At European level, there is no uniform law to harmonize the rules on broadcasting persons in distress. Still, some countries have adopted specific rules. One example is the Ofcom Broadcasting Code in the UK, where broadcasters are discouraged from taking footage or audio of “people caught up in emergencies, victims of accidents or those suffering a personal tragedy, even in a public place”, unless it is warranted. Such regulation is the reason why the BBC apologised for not cutting the live transmission of the distressing images sooner.
In France, the Law no. 86-1067 dated September 30, 1986, provides that, while communication to the public by electronic means is free, the exercise of this freedom may be restricted to the extent required in respect of the dignity of the person.
In Spain, the Constitutional Court decided, based on a law from 1982 protecting the right to honour and private life, that selling video images depicting a mortally wounded torero in the infirmary outside the arena by a private company infringed the deceased’s and his family’s right to privacy: “in no case can incidences on the health and life of the bullfighter be considered public and part of the show, derived from the injuries received, once he leaves the bullring, since this would certainly mean turning something so personal such as the sufferings and the death of an individual, in clear contradiction with the principle of dignity of the person enshrined in art. 10 of the EC. And this is precisely the case in the present case, since the videotape reflects what happened when Mr. Rivera was taken out of the ring (and therefore, from public view), seriously injured and in a state of evident alteration, despite the demonstrated firmness of character”.
Moreover, European states are signatories of the European Convention on Human Rights, where article 8 enshrines the right to private life and article 10 the right to freedom of expression. According to the jurisprudence of the European Court of Human Rights, sporting issues are matters of public interest, and at least some well-known athletes may be deemed public figures, for whom the expectations of privacy are usually lower than for normal persons. However, such expectations do exist even in public spaces. When a press publication imposes on the privacy of an individual with the aim of simply satisfying public curiosity, it does not contribute to a public debate and is not, therefore, of public interest.
The unfortunate incident at the Euro 2020 Denmark-Finland game represents an instance where competing interests, namely the right of the press to report noteworthy events, and the right of an individual to privacy, clash. In this authors’ view, the right to privacy should prevail. It is true that Mr. Eriksen was on the field in a professional capacity, where he had consented to be filmed and have his image broadcast all over the world. However, the sudden health condition was beyond the scope of the game, and it is reasonable to presume that no prior consent had been given by the player to have his image broadcast while struggling for his life.
While it is undisputed that images of footballers playing are part of the entertainment the public is entitled to receive, the moment when a player becomes unavailable due to illness is both a public event and a private one. Showing the public the cause of the player becoming unavailable may be informative. However, focusing too intently on the agony and suffering of a certain player may be deemed to exceed the sphere of public interest. Moreover, focusing on a person connected to the player, but not a public person herself, can be deemed an even greater interference with that person’s private life.
 Translation from Spanish.