Connected devices and data analysis are now utilised by clubs and other key stakeholders across many sports to achieve better results and enhance athlete performance. As technology advances, so do the risks. In modern professional sport a vast amount of data may be retained and analysed. For example, it is anticipated that a typical 90-minute football match can produce approximately 15 million datasets. There are several legal issues that may arise with the use of technology to monitor athlete performance.
Where are we with technology in sport for analytical purposes?
Sports clubs can monitor athlete performance thanks to wearable technology embedded in clothing. Speed, distance, heart rate, fatigue and hydration are among the many metrics that clubs can track during training sessions or game days.
The advancement of technology is positive for performance improvement, and most big choices made in sport now involve an element of data analysis. Monitoring may also prevent injury or advise the best course of treatment required. Clubs' use of third-parties to provide data analysis are becoming increasingly popular. Other than analysing athlete performance they also offer talent scouting, fan engagement and predictive analysis by way of automated decision making.
General Data Protection Regulation (GDPR): Overview
The GDPR regulates the processing of personal data in the EU and imposes harsh penalties for non-compliance.
There must be a legal basis for processing personal data. Sports teams, as data controllers, may obtain consent as a legal basis through player contracts. If any provision on consent is absent, clubs will find that analysis is either "necessary for the performance of the contract", or in their "legitimate interests".
Much of the data being analysed is about the player's health, genetic and biometric data. This is special category data and explicit consent is required in order to process it.
If there is a legal basis for sports analysis, what is the concern?
Consent must be freely given. In an employer/employee relationship, the imbalance of power can mean that consent is never freely given. The European Data Protection Board has also commented in its 2019 Guidelines:
"Where a sports club takes the initiative to monitor a whole team…consent will often not be valid, as the individual athletes may feel pressured into giving consent so that their refusal of consent does not adversely affect teammates".
There may be little to no impact on the athlete being profiled. But, if such sensitive data is illicitly obtained, the repercussions are high – financial penalties can reach a maximum of €20 million. Clubs should ensure they have adequate safeguards in place to protect their players' data and avoid any breaches, which could ultimately cause reputational damage. Anonymisation of data and encryption are highly important.
Utilisation of third-party processing also raises concerns: does the processor operate in a country that does not have adequate safeguards in national law to protect players? The Advocate General to the Court of Justice of the European Union has expressed in an Opinion that the Privacy Shield agreement for transfers from the EU to the US may not provide adequate protection for data subjects as the recourse available is not effective.
Other legal issues
There is a requirement to store data for no longer than necessary. This means that when a player retires, or transfers to another club, all data about them should be deleted.
Players have various other rights, not limited to but including:
- Access – the right to access all personal data held. Requests must be dealt with in one month and can often be time consuming and burdensome on the controller/processor.
- Automated decision making/profiling – if decisions are made about players without any human involvement, or if profiling takes places, there are additional rules. Players must have information about the automated decisions/profiling and regular checks must be carried out on systems.
It will be interesting to see what new technological innovations in sport come to play in the new decade, and what legal challenges they bring.
To find out more about how to implement best practices in sports analysis, please contact Andy Nolan, or your usual Brodies contact.
Contributor
Partner
