DATA PROTECTION OF ATHLETES IN SWITZERLAND

Data is, nowadays, a highly valuable commodity, not least in sport.

Athletes’ performances can be tracked, measured and analysed through a wide range of personal data.

In Switzerland, the processing of such data is governed primarily by the revised Federal Act on Data Protection (“FADP”), which entered into force on 1 September 2023. The FADP strengthened data protection in Switzerland and aligned Swiss law more closely with the European Union General Data Protection Regulation.

In sport, athletes’ data may include:

• Biometric data: heart-rate data, sleep data and other information generated by wearable devices, such as smartwatches;
• Location data: GPS tracking and movement data;
• Medical records: injury history, diagnoses and rehabilitation data;
• Performance data: training results, match statistics and physiological measurements;
• Anti-doping data: testing, biological and disciplinary information; and
• Basic personal data: name, address, date of birth and contact details.

Scope of the FADP

Under the FADP, the law applies to natural persons whose personal data is processed. It also has an extraterritorial element: the FADP applies to circumstances that have an effect in Switzerland, although initiated abroad. Accordingly, Swiss data-protection law is not limited to processing data which is physically carried out in Switzerland.

Athletes’ data and sensitive personal data

In sport, athletes’ data will often qualify as sensitive personal data under Swiss law, in particular where it concerns health data, genetic data or biometric data uniquely identifying a natural person. This is especially relevant where sports bodies process injury reports; diagnoses; rehabilitation plans; fitness assessments; certain anti-doping materials and certain biometric identification data.

By contrast, not every item of performance or tracking data is automatically sensitive under the FADP; this depends upon whether it reveals protected health information or otherwise falls within another protected category.

Core obligations

The FADP requires sports bodies to process personal data in a lawful, transparent and proportionate manner.

They must inform athletes of the identity of the controller, the purpose of processing and, where applicable, the recipients of the data.

They must also ensure appropriate technical and organisational data security.

The FADP also introduced or strengthened several compliance obligations, including:

• keeping a record of processing activities (Art. 12 FADP);
• carrying out a data protection impact assessment where processing may entail a high risk (Art. 22 et seq. FADP);
• complying with rules on cross-border disclosure of personal data (Art. 16 FADP); and
• notifying certain data-security breaches to the competent authority (Art. 24 FADP).

In practical terms, this is particularly relevant for clubs, federations and other sports bodies using athlete-management platforms, wearable technologies, cloud storage, medical databases or international competition systems.

Swiss law also requires that personal data be destroyed or anonymised as soon as it is no longer required for the purpose of processing.

Rights of athletes

Athletes, as data subjects, have rights under the FADP, including the right to request information about the processing of their personal data, the right to seek correction of inaccurate data and, in certain cases, the right to data portability.

These rights may become particularly relevant in disputes involving medical records, disciplinary matters or performance-related data.

Enforcement

The FADP strengthened the powers of the Federal Data Protection and Information Commissioner (FDPIC).

The FDPIC may investigate infringements and order data processing to be modified, suspended or terminated. In addition, the FADP provides for fines of up to CHF 250,000 for certain willful violations by private persons. Swiss law, therefore, creates not only regulatory risk, but also potential personal liability for responsible individuals.

For sports bodies, failure to comply may lead to investigations by the FDPIC, criminal fines, imposed by the Cantonal authorities, in certain cases, reputational damage and disputes with athletes whose personal data has not been handled lawfully.

We advise athletes and sports bodies on sports data matters in Switzerland and further information is available by emailing Kim Gamboni at gamboni@valloni.ch.