Could footballers score an annual payment for their personal data?

In what has already been a lively month for data protection and privacy rights in the UK, a collective of football players have made things even more interesting by launching a legal challenge, announced to the media as ‘Project Red Card’, that seeks greater control over their personal data. The group are claiming that they should be entitled to compensation for the trading of their performance data and are seeking annual fees for such use of their data moving forward.

In effect, it’s a challenge that aims to give public sporting figures the right to commercialise statistical data that relates to them, in much the same way as they can already commercialise the right to display their physical likeness.

The type of data in question includes information such as the heights of players, how many goals they score in particular games, and their individual average running speeds. Precisely the sort of data that you would want to know if you were looking to analyse and benchmark individual performances over a season. The basis of the action is that use of that data, obtained without individual consent of the players in question, is a breach of their rights over their personal data which contravenes the UK General Data Protection Regulation (“the GDPR”).

While it might be tempting to dismiss the attempt as a long-shot, it’s one that could have far-reaching implications for both sports rights generally and for a range of other industries which rely on consumer, user and audience data to operate.

If the challenge is successful and it is found that footballers are entitled to compensation and annual fees in return for the right to compile data relating to them into databases, then it’s fair to anticipate that principle would be extended to any other database of individuals that a data controller might compile. For some businesses, the financial strain of paying that kind of annual fee could have a devastating impact.

It’s fair to say that the final whistle has not yet blown for Project Red Card’s challenge, and it is not yet clear how it intends to deal with database operators who assert a prevailing ‘legitimate interest’ in processing player data irrespective of the lack of consent, or what it might have to say about the GDPR’s Article 89 derogation that provides a fairly broad exemption for “archiving purposes in the public interest… or statistical purposes”, but it’s one to keep an eye as it is likely to have genuine significance in divining the limits of an individual’s right to commercialise their own persona.

If you would like to discuss GDPR or any aspect of this article, please email Raoul Lumb.