Legal Analysis of Project Red Card

An analysis of the legal quagmire ensuing over the processing of player performance data in football.

Introduction

Data analytics has become an important facet of professional football. Data in football is no longer limited to the number of goals scored, assists, tackles and clean sheets. Today, the influx of technology and AI powered technology, has enabled a greater insight into the players’ performance. From a players’ biometric data to live on-filed performance data, the manner in which football is played and viewed today has drastically changed. Data analytics dominates the game and football clubs are constantly looking at sophisticated ways to measure player data to gain an on-field competitive advantage over other clubs. Other stakeholders in football such as leagues, sports broadcasters, gaming companies have also understood the value of data and leverage its uses to gain a profit.

Despite most of the data being generated from the performance of the players themselves, other stakeholders such as football clubs, leagues, broadcasters, gaming companies and data analytic companies have reaped its benefits. Moreover, such data has often been processed with or without the consent of the players involved. This has spurned friction amongst players and other stakeholders in football over the ownership and use of player performance data.

What is Project Red Card?

Motivated by a need to gain a slice of the cake, ‘Project Red Card’ is an initiative led by former footballers in England and Scotland against various stakeholders processing player performance data without their consent. The lawsuit, which is yet to be filed, is based on the premise that player performance data is ‘personal data’ under the General Data Protection Regulations, 2018 (“GDPR”) and the Data Protection Act, 2018 and hence the consent of the players is necessary prior to processing such data. The players claim that as this data is generated on the basis of their performance; they have an intrinsic right over the use of such data. However, data analytic and gaming companies claim that such data is collected and analysed from information available in the public domain, and the players themselves have no control on the collection and analysis of such data. It is therefore the intellectual property of the companies and not the players.

Important legal issues

Project Red Card aims at stepping into unprecedented territory to extend image rights of players to include player performance data by enforcing data privacy laws. In order to do so, the following legal issues will have to be determined by the courts of law:

Whether players can establish rights over data which is freely available in the public domain?

There is no inherent right to use player performance data merely because it is freely available in the public domain. The basis of this is that if personal information is obtained from publicly available sources, the concerned individual has a right to be informed of the manner in which such information is used. As per the clarifications provided by the Information Commissioners’ Office (‘ICO’), the GDPR applies, whether or not data is publicly available or not. As long as data qualifies as personal data under Article 4(1) of the GDPR and is being processed, the GDPR will apply. Furthermore, as per Article 5 of the GDPR, personal data is required to be processed in a fair and transparent manner and for a legitimate purpose. Hence, the processor of the personal data is mandated under the GDPR to keep the person informed of the manner in which the information is being used, the purpose and duration of such usage and also ensure its safety from any breach. This therefore negates the possible arguments of the defendants that player performance data is information freely available in the public and therefore cannot be monopolised by the players. Moreover, as such data is being collected and processed by data analytic companies to profile players for commercial purposes, players do have a legitimate basis under Article 5 of the GDPR to stake a claim on the use and processing of such data and demand compensation for use of such data for commercial purposes.

Whether player performance data can be classified as ‘personal data’ under the GDPR?

Article 4 (1) of the GDPR defines ‘personal data’ as any information relating to a natural person from which the person can either be directly identified from the information or indirectly identified from the information in combination with other information. If the information on its own or in combination with other information can be linked to a living person, it would quality as ‘personal data’ within the ambit of GDPR. As player performance data involves various statistics involving the performance and other biometric data of the player, it will be considered to be ‘personal data’ under the GDPR.

However, there is scope for the defendants to claim that all player performance data may not be considered as personal data as it defeats the purpose of data privacy laws – to protect private data of the individual such as their race, ethnicity, political opinion, sexual orientation, religious or philosophical beliefs, genetic and biometric data. Player performance data primarily involves data which associates a person to a particular sport. It is akin to professional data and essential for determining the value of the player in their respective sport. Such data may include the speed, passing accuracy, shooting, number of goals/assist etc. If players were to stake a claim on even such data, it would defeat the purpose of data privacy laws and be impossible for any person to differentiate a player from another player without compensating the player to access his professional data. Further, it would go against the legitimate interests of the data collectors and also over-complicate players’ contracts with clubs and their respective leagues. It would also lead to players having to negotiate separate contracts with data analytic companies to monitor the collection and processing of such data. While players may monetarily benefit, access to such professional data is key to determining the value of the player to the team.

Courts therefore will have to thread carefully while determining if all player performance data can be considered as ‘personal data’ in consideration of the objectives of the GDPR. While the law is definite as to what constitutes ‘personal data’, courts may have to consider the claim of players on a case-by-case basis to determine if a distinction can be made between the private information and professional information of a player to protect the fundamental right of the player.

Whether player performance data has been processed lawfully as per the GDPR?

The processing of personal data of players passes through multitude of stakeholders and is each stakeholders uses the data for different purposes. On a daily basis, football clubs analyse the performance data of the players contracted with them to find ways to improve the performance of the player and the team. Further, this information is shared to the league and data analytic companies to further process the data. Such data is then sold to third parties such as broadcasters, betting companies, fantasy and gaming companies to profile players for commercial purposes.

In order for such processing to be considered lawful under the GDPR, the stakeholders will have to comply with either of the conditions provided under Article 6 of the GDPR. Broadly, the conditions include as follows:

a. The individual has given his free consent for processing of his personal information, or

b. Processing of the data is necessary for the purposes of the legitimate interests pursued by the collector and processor of data, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual, or

c. Processing of personal data is necessary to comply with the extant law, or

d. Processing of personal data is necessary to protect the vital interests of the individual or other natural person, or

e. Processing of personal data is necessary in the best interest of the public, or

f. Processing of personal data is necessary for the performance of a contract.

The courts therefore will have to analyse the claims against the defendants individually. Football clubs may be able to establish the legitimacy of processing of personal data of the players under contract with them by way of consent of the players to be contracted with the club. However, the remaining stakeholders will have to primarily show that they have a legitimate purpose to process the personal data of the players and this does not override the fundamental rights of the player. Therefore, it will largely depend on the type of data being processed and if it is sensitive personal data such as biometric data (Article 9 of the GDPR), the claim of the players is more likely to succeed.

Concluding remarks

While Project Red Card is still in its nascent stages, it has opened up a pandora’s box on the ownership of player performance data in sports. If the claim of the players is successful, it will drastically change the manner by which data is collected and used in sports. It will also lead to data analytic companies negotiating separate contracts with players to collect and use their player performance data. Separately, other issues may arise, in regard to international transfer of players wherein personal data is transferred to a country outside the EU and other European Economic Area which have lesser privacy safeguards compared to the GDPR.

In the author's opinion, to avoid a multiplicity of legal proceedings, sensitive personal data such as the players’ biometric data, religious beliefs, sexual orientation, ethnicity, political beliefs require protection rather than their professional data which is essential to identify a player to a particular sport. Such sensitive data is what the GDPR ultimately intended to protect and should not unnecessarily extend to protect professional information of a player. Further, it will avoid courts from having to adjudicate upon the murky waters of the interplay between intellectual property rights of the data analytic companies and the privacy rights of the players. This may prove to be an impossible endeavour to establish a clear ownership to one party as a blanket rule. Ultimately, dialogue and policy should guide the way to promote an egalitarian data processing eco-system in sport that ensures that the players’ interest are adequately considered.

Article written by Aditya Shankar, Associate at SAMVĀD: Partners