Tag: football

Footballers’ Objections to Data Processing: Red Card or Red Herring? 

“They play for us, not for the odds, 
They’re not just names for betting gods, 
If you want stats, you best be fair — 
Cos we stand with the players, everywhere!” 

Could this become a popular chant in football stadiums? It could, if a group of football players get their way.  

In the era of data-driven sports and digital fan engagement, betting and gaming companies increasingly rely on detailed player data to power their platforms.
From setting betting odds to fuelling fantasy leagues and live-match experiences, this data is central to the user experience. The data ranges from average goals-per-game for an outfield player to height, weight and passes during a game. Some of this data may be sold to the companies by clubs whilst other data may be collected by using public sources or by attending matches.  

Back in 2021, Ibrahim Hasan was interviewed by BBC Radio 4 when football players were threatening legal action against companies for the trade in their personal data. The players, led by former Cardiff City manager Russell Slade, sought compensation for the trading of their performance data over the past six years by various companies as well as an annual fee for any future use.  We were sceptical, at the time, about legal basis of any potential claim and its likelihood of success (blog post here).   

The GDPR does give players rights over their personal data which allow them to exercise some element of control including the right to see what data is held about them, to object to its processing and to ask for it to be deleted. Last month, Computer Weekly reported that the Global Sports Data and Technology Group, of which Russell Slade is a director, has submitted objection requests, on behalf of the players they represent, to gaming, betting and data-processing companies over the use of their data. They are citing ethical concerns with how the data distribution can affect the players’ career prospects.  

Article 21 of the UK GDPR states: 

“The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.” 

Clearly one of the legal basis upon which betting and gaming companies process players’ personal data is legitimate interests (Article 6(1)(f)) of the UK GDPR, and so Article 21 is engaged.  However, the second paragraph of Article 21 provides a reason for the companies to refuse the objection requests: 

“The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.” 

What could be “compelling legitimate grounds for the processing”?  The companies might argue that their use of player data contributes to a larger economic ecosystem that ultimately benefits all stakeholders in football, including the players themselves. Their case could rest on the idea that engaging fans through betting and interactive gaming drives up interest in football. Increased viewership, in turn, boosts broadcasting revenues, club sponsorship deals, and the market value of football competitions; benefits that indirectly lead to higher wages and endorsement deals for the players. By providing platforms that stimulate engagement, betting companies help sustain and expand the financial health of the sport, from which players also profit. 

Let’s see where this goes. If court action follows, not only will the result have a big impact on the sports data industry but it could also lead to data protection themed chants on the terraces!  

This and other GDPR developments will be discussed in detail on our upcoming GDPR Update workshop. We have a few places left on our next 
GDPR Practitioner Certificate course starting on 29th May. 

Ronaldo’s Data and GDPR: Who said data protection is boring?

There is an interesting story this morning on the BBC website about a group of footballers threatening legal action and seeking compensation for the trade in their personal data. The use of data is widespread in every sport. It is not just used by clubs to manage player performance but by others such as betting companies to help them set match odds. Some of the information may be sold by clubs whilst other information may be collected by companies using public sources including the media.  

Now 850 players (Ed – I don’t know if Ronaldo is one of them but I could not miss the chance to mention my favourite footballer!), led by former Cardiff City manager Russell Slade, want compensation for the trading of their performance data over the past six years by various companies. They also want an annual fee from the companies for any future use. The data ranges from average goals-per-game for an outfield player to height, weight and passes during a game. 

BBC News says that an initial 17 major betting, entertainment and data collection firms have been targeted, but Slade’s Global Sports Data and Technology Group has highlighted more than 150 targets it believes have “misused” data. His legal team claim that the fact players receive no payment for the unlicensed use of their data contravenes the General Data Protection Regulation (GDPR). However, the precise legal basis of their claim is unclear. 

In an interview with the BBC, Slade said:

“There are companies that are taking that data and processing that data without the individual consent of that player.”

This suggests a claim for breach of the First Data Protection Principle (Lawfulness and Transparency). However, if the players’ personal data is provided by their clubs e.g., height, weight, performance at training sessions etc. then it may be that players have already consented (and been recompensed for this) as part of their player contract. In any event, Data Protection professionals will know that consent is only one way in which a Data Controller can justify the processing of personal data under Article 6 of GDPR. Article 6(1)(f) allows processing where it:

“is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data… .”

Of course, this requires a balancing exercise considering the interests pursued by the clubs and data companies and the impact on individual players’ privacy. Some would argue that as far as public domain information is concerned, the impact on players’ privacy is minimal. However, “the interests or fundamental rights and freedoms of the data subject’ also include reputational damage, loss of control and financial loss, all of which it could be argued result from the alleged unauthorised use of data.

The BBC article quotes former Wales international Dave Edwards, one of the players behind the move:

“The more I’ve looked into it and you see how our data is used, the amount of channels its passed through, all the different organisations which use it, I feel as a player we should have a say on who is allowed to use it.”

The above seems to suggest that the players’ argument is also about control of their personal data. The GDPR does give players rights over their data which allow them to exercise some element of control including the right to see what data is held about them, to object to its processing and to ask for it to be deleted. It may be that players are exercising or attempting to exercise these rights in order to exert pressure on the companies to compensate them.

Without seeing the paperwork, including the letters before action which have been served on the companies, we can only speculate about the basis of the claim at this stage. Nonetheless, this is an interesting case and one to watch. If the claim is successful, the implications could have far-reaching effects beyond football. Whatever happens it will get data protection being talked about on the terraces!

Ibrahim Hasan, solicitor and director of Act Now Training, has given an interview to BBC Radio 4’s (PM programme) about this story. You can listen again here (from 39) minutes onwards.

This and other GDPR developments will be discussed in detail on our forthcoming GDPR Update workshop. We have a few places left on our Advanced Certificate in GDPR Practice course starting in November.