SPORTS DATA: ITS LEGAL PROTECTION AND COMMERCIAL EXPLOITATION
Living, as we do, in a digital world, the legal protection and commercial exploitation of sports data, in particular, has become a central issue in the modern sports economy.
Thus, in an increasingly data-driven and technological environment, including AI, sports persons, teams, clubs, fans, federations and commercial partners are all involved in the generation, circulation and monetisation of vast amounts of personal, behavioural and performance data.
This evolving ecosystem operates at the intersection of fundamental rights, regulatory compliance and economic value creation, raising complex legal and governance challenges across the management of the sports sector. These data-driven asymmetries manifest themselves differently for those involved in sport, each facing distinct legal risks and expectations in terms of control, transparency and accountability.
At a more fundamental level, the protection of sports data is rooted in European human rights law. The right to respect for private life, as guaranteed under Article 8 of the European Convention on Human Rights of 1950, has long been interpreted as encompassing the protection of personal data. This foundation is reinforced by the Council of Europe Convention 108+ of 2018, which establishes core principles governing the lawful and fair processing of personal data across sectors, including sport.
In practice, reliance on consent as a legal basis for the commercial exploitation of sports persons’ data remains particularly problematic in a professional sporting context, given the structural imbalance inherent in employment and contractual relationships. Whilst alternative legal bases may be available under data protection law, they do not displace the fundamental obligation of transparency, nor do they resolve broader questions of control and fair value allocation.
Against this backdrop, the exponential growth of data-driven technologies has transformed sports persons’ performance metrics, biometric indicators and health information into highly valuable commercial assets, particularly for betting companies, media operators and data analytics providers. These tensions are particularly acute in association football, which provides a sensitive illustration of such legal challenges, given the volume, granularity and economic value of data relating to sports persons, which are collected on a continuous basis.
In this context, much of the data collected in professional football—ranging from performance statistics to medical and biometric information—qualifies as personal data, and, in many cases, as sensitive health data. Its processing, therefore, falls squarely within the scope of the EU General Data Protection Regulation (GDPR) of 2018, which imposes strict requirements relating to its lawful processing, transparency, purpose limitation, data minimisation and security. Everyone involved in sport must carefully assess their respective roles as data controllers or processors; ensure the existence of a valid legal basis for processing; and implemen thet robust governance frameworks.
Moreover, the GDPR applies irrespective of the geographical location of the entities involved, to the extent that sports data relating to individuals in the EU is processed, an issue of particular relevance in an increasingly globalised sports data market. This regulatory framework is underpinned by a robust enforcement regime, reinforcing the strategic importance of proactive compliance and accountability for all stakeholders.
Beyond lawfulness, inadequate security measures may expose sports organisations to significant regulatory, reputational and contractual risks, particularly where large volumes of fan or player data are processed through digital platforms. This regulatory landscape is further shaped by the growing use of AI-driven systems in sport, which introduce additional requirements of risk management, transparency and human oversight under the EU Artificial Intelligence Act of 2024, particularly where biometric analysis and surveillance technologies are involved.
These governance challenges become especially apparent in high-risk segments of the sports data economy. The large-scale aggregation and commercialisation of footballers’ real-time performance data by betting companies—often in the absence of direct contractual relationships with players—has attracted increasing legal scrutiny. In parallel, the deployment of surveillance technologies in stadiums illustrates the tension between legitimate security objectives and the requirement that data processing remain necessary, proportionate and transparent.
These concerns lie at the heart of the Project Red Card initiative in the UK, through which professional footballers are challenging the unauthorised commercial exploitation of their performance data by third parties. Beyond the dispute itself, the initiative reflects a broader structural shift: sports persons are increasingly invoking data protection frameworks to assert control over their personal data and to claim a fair share of the economic value generated from its commercial use.
In response to these various developments, FIFPro, the worldwide organisation which represents some 65,000 professional football players, has issued guidelines in 2022 on the storage, control and sharing of footballers’ personal data. These guidelines advocate for enhanced player transparency, informed consent, and contractual clarity regarding data ownership and commercial use. They also encourage stakeholders to adopt governance models that respect players’ rights, whilst enabling legitimate sporting and commercial objectives.
As regulatory enforcement intensifies and litigation risks increase, stakeholders across the sports ecosystem must reassess their data strategies. Ensuring compliance with data protection law is no longer sufficient; a broader, forward-looking approach is required, one that balances innovation, commercial exploitation and the fundamental rights of sports persons. In this sense, data governance in sport increasingly operates not only as a matter of regulatory compliance, but also as an ethical framework shaping trust, legitimacy and long-term sustainability.
We provide legal advice and representation in all aspects of sports data protection and commercialisation, including disputes, and further information is available from either Dr Estelle Ivanova or Dr Lucien Valloni by e-maling them at ivanova@valloni.ch or valloni@valloni.ch respectively.