A red card for those exploiting players’ data?
Hand of referee with red card and whistle in the soccer stadium.
‘Project Red Card’, a group of more than 850 current and former footballers from England and Scotland, has threatened legal action against 150 gaming, betting and data processing companies. Project Red Card claims these companies have been trading the footballers’ personal data and performance statistics without consent or remuneration.
The argument presented by Project Red Card draws from the General Data Protection Regulation (‘GDPR’) and the Data Protection (‘DP’) Act 2018. GDPR sets out the legal bases which any organisation collecting and utilising personal data must demonstrate.
This data, whether it is a player’s height, or the amount of goals they scored, falls within the definition of personal data under GDPR and consequently DP laws apply to any institution collecting and using this personal data. Some of these companies, such as broadcasters and news-outlets, exercise the journalistic exemption that exists under DP laws. However, Project Red Card believes the majority of these institutions have not demonstrated the legal basis for which they are processing this data.
There are two key legal processing grounds in this scenario – ‘legitimate interests’ and ‘consent’ – which are both set out in Article 6 of the GDPR.
Legitimate Interests
Organisations can rely on this as a legal foundation for processing personal data. To succeed here, they must perform a three-part test:
- The interest must be legitimate
- The processing must be necessary for that interest
- The question of whether this interest is more important than a player’s right must also be assessed.
There is potential for the companies using this data to rely on this key point as one component of their defence; arguing the interest of football fans to be able to see this data is an uncontroversial and legitimate interest.
Consent
In the absence of legitimate interests as a basis, defendants may look to rely on consent.
Similar to ‘image rights’, players could offer their consent in the future to the use and analysis of data, in return for a ‘licence fee’. Nevertheless, despite ‘image rights’ deals being typical in the last 30 years, the bulk of contracts do not currently set out terms around performance data, which has provided an opportunity for organisations to reap the commercial benefits of using this data.
It isn’t being purported that footballers are unhappy with their stats being accessed, traded and capitalised, if it is lawful. The crux is that these organisations haven’t requested permission in line with the legal framework, or offered some form of fee for information that carries heavy commercial value.
The defendants could counter the above, on the basis that players consent to their data being used, through contracts, sponsorship or endorsement deals. Nevertheless, under UK GDPR, consent in terms of ‘data processing’ needs to be express and implied consent is not sufficient.
Implications
Whatever the outcome of this case, which concerns relatively untested legal issues, it is likely to have a significant impact on the wider sports sector. If the legal bases set out above cannot be proved, this will be a breach of the DP laws.
There is an existing Court of Appeal judgement- Lloyd v Google - that a claim for ‘damages’ under DP laws can include claims for ‘loss of control of data’, even if no distress or pecuniary loss is present. This ruling is currently on appeal in the Supreme Court.
The outcome of the Supreme Court’s judgement will be pivotal in how the issue of compensation and damages, for which Project Red Card is claiming, dating back six years, and for any future use of their data, will play out in any claim they do bring. Through demonstrating the various companies collected player statistics for their own objectives, the players could potentially maintain that they lost individual control over their own data.
If Project Red Card’s claim is successful, the ramifications for the sporting industry will be widespread. Data users may be compelled to enter negotiations for commercial agreements around the use of such data (giving players a right similar to ‘image rights’), with consent of sportspeople being the only viable legal basis.
Hamlins’ Media Disputes team has extensive experience in dealing with both data protection and privacy claims. If you have any queries, please contact Christopher Hutchings.