1.1. Background

The revolution in data analytics described in Part One of this article happened in tandem with a considerable development in data privacy law in the EU, which contains some of football’s most commercially and technologically developed markets. Where intellectual property law provides little in the way of empowerment to the players on whom the data analytics industry is built, the data protection law landscape is quite different, conferring rights upon players and adding considerable compliance burden to data analysts. Part Two will analyse the prevailing data privacy landscape and its considerable impact on analytics in football.

At a sports governing body (SGB) level, there has also been some movement to recognise the complexities of data usage within the modern game in the form of the Fédération Internationale de Football Association (FIFA) Data Protection Regulations, introduced in October 2019.¹ The scope and impact of the FIFA Data Protection Regulations is considered in section 1.10.

Section 2 of Part Two will go on to examine at a high level some of the other legal issues faced by the use of data in football, such as competition law and the forthcoming regulation of artificial intelligence (AI) at the EU level.

Data privacy is deeply enshrined in EU and UK law. The right to ‘protection of personal data’ is found at Article 8 of the EU Charter of Fundamental Rights, which was given the force of law by the Treaty of Lisbon (albeit subject to a UK opt out). The principal legal instrument for data protection in the EU is the General Data Protection Regulation² (GDPR). As an EU regulation pre-Brexit, the GDPR had direct effect in UK law (subject to certain limited derogations), although certain aspects of the GDPR required domestic implementation akin to an EU Directive (Lloyd, 2020: 37) and the GDPR was thus further enshrined in domestic law in the form of the Data Protection Act 2018 (the DPA 2018). These instruments replaced the Data Protection Directive (Directive 95/46/EC) and the Data Protection Act 1998 (each now repealed) in the EU and UK, respectively.

The GDPR ‘aimed to build a stronger and more coherent data protection framework in the EU, backed by strong enforcement’ (Kuschewsky, 2016, Chapter 1.1), significantly modernising the data protection framework by introducing a number of changes to the existing data protection framework, including an increase to the severity of the available sanctions, a broadening of the scope of personal data caught, an augmentation of data subject rights, a widening of territorial scope, development of the requirements for processing and for transferring data, changes to the respective responsibilities of ‘controllers’ and ‘processors’ (terms of art in data protection law), and more.

In general, EU and UK data protection law seeks to strike a balance between individuals’ rights to privacy and the free flow of personal data. Data protection is a highly developed and regulated area of law.

Article 51 of the GDPR requires Member States to provide for an appropriate national competent authority for data protection. In the UK, this function is performed by the Information Commissioner’s Office (ICO). One of the functions of the ICO is to provide guidance on data protection law compliance, which it has done extensively. At EU level, guidance is also issued by the European Data Protection Board (established under Article 68 GDPR).

1.2. What is personal data?

The GDPR and the DPA 2018 primarily govern ‘personal data’. This is an important preliminary point in the context of football data analytics, as data analysts are likely to manipulate both personal and non-personal data in the course of their work. Personal data is defined in Article 4 of the GDPR as being ‘any information relating to an identified or identifiable natural person’, otherwise referred to as ‘data subjects’. The concept of an ‘identifiable’ person is an important one. Article 4 states that a person is identifiable if they:

can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Consequently, some more advanced performance data fields which do not directly identify a player may nevertheless constitute personal data within the ambit of the GDPR. Consider, for example, the data analytics insights from the article ‘Running Stats Explained: Pace, intensity and the Premier League “Plodders”’ in the Athletic (Worville, 2021):

• ‘Aston Villa’s Trezeguet is…topping over 80 high-intensity runs and sprints’. This is personal data. It contains information which directly identifies and concerns a natural person.

• ‘a sprint is anything above 25.2 km/h, which is seven metres per second’. This is not personal data. It does not and cannot identify a natural person.

• ‘the level of high-intensity running done by Leeds is clear and, as a group, unmatched by any other team’. This may constitute personal data. Leeds United Football Club is not a natural person; however, its team is, of course, composed of a narrow class of natural persons, i.e., those players in the Leeds squad who are selected to play. If, whether alone or in combination with other information available to a data processor, this team-level data could be reverse-engineered to reveal data concerning individual players, then the data may relate to an ‘identifiable’ natural person and thus constitute personal data. This illustrates the fact that information may be personal data when processed by one party (for example Leeds, being in possession of more granular data, may be able to use this statistic to identify information about individual players) whereas it may not be when processed by another party.

• ‘The band before a sprint is a ‘high-intensity run’, which is where a player moves at between 19.2 km/h and 25.2 km/h…roughly how fast a grey squirrel can travel at top speed’. This is not personal data as a squirrel is not a natural person.

1.3. Categories of data and legitimacy of processing

Within the concept of personal data there is a distinction made in respect of ‘special category data’, which are:

personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership…genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation (Article 9, GDPR).

The processing of any personal data (whether or not special category) must only be performed where there is a lawful basis to do so (Article 6, GDPR). These lawful bases are broad: the consent of the data subject; necessity for the performance of a contract to which the data subject is a party; necessity for complying with a legal obligation; necessity to protect someone’s vital interests; necessity for tasks carried out in the public interest or the exercise of official authority; and where necessary for the legitimate interests of the controller. The basis on which personal data are processed in sport can be complicated. See for example Viret’s assessment of the conflicts that arise in an antidoping context (Viret, 2019), Patel and Varley on the impact of data protection law on genetic testing (Patel and Varley, 2019), Hessert’s analysis on data protection in sports regulatory investigations (Hessert, 2020a), and the impact of data protection in arbitration, Barnsley Football Club Limited v Hull City Tigers, EFL (Ch Nicholas Stewart QC), 16 February 2021 (see paragraph 297).³

In the specific case of data analytics, the basis on which football’s data analysts are able to process personal data will vary dependent on the particular facts. For example, a club may be able to rely on the ‘performance of a contract’ basis given the direct contractual relationship with its players.⁴ However, the fact that data controllers are able to rely on their own legitimate interests in their use of player data will mean that there is a wide scope for data analytics organisations to legally process personal data, even where those organisations do not have a direct (or even an indirect) relationship with the data subjects in question (i.e., the players). ‘Legitimate interests’ are therefore a widely adopted basis for processing of personal data.

For proper data protection compliance, though, reliance on a data controller’s legitimate interests is somewhat more complicated. As a starting point, data controllers must perform a ‘careful assessment’ (Recital 47, GDPR) as to whether relying on their legitimate interests is appropriate—it will not always be so. The recitals to the GDPR state that legitimate interests as a basis for processing can be relied upon: ‘provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller’ (Recital 47).

The legitimate interests of the data controller can be commercial. Recital 47 specifically gives direct marketing as an example of a data controller’s legitimate interests, and ICO guidance states that:

A wide range of interests may be legitimate interests. They can be your own interests or the interests of third parties, and commercial interests as well as wider societal benefits. They may be compelling or trivial, but trivial interests may be more easily overridden in the balancing test. (ICO, 2021a).

ICO guidance on data controllers’ legitimate interests (ICO, 2021a) suggests that data controllers should perform a three-part test:

1. The purpose test: determining whether a legitimate interest is being pursued.

2. The necessity test: determining whether the processing of the data in question is necessary for that purpose.

3. The balancing test: weighing the data subjects’ interests against the interests of the data controller.

In the case of data analytics, the first two tests can likely be satisfied. Performing statistical analysis in football has benefits, be they sporting, scientific, or commercial; and it is inherent to the act of data analytics that data are processed. Therefore, whether the legitimate interests of data analysts can be relied upon will depend on a balancing assessment between the data analysts and the data subject players. The ICO gives guidance on the sort of questions that a prospective data controller may ask of itself in determining whether it is appropriate to rely on its legitimate interests, which include: ‘Is any of the data particularly sensitive or private? Would people expect you to use their data in this way? Are some people likely to object or find it intrusive?’ (ICO, 2021a). The ICO alludes here to the ‘reasonable expectations’ of the data subject, a factor mentioned in Recital 47 of the GDPR, which Kamara and de Hert (2018) suggest ‘will be a significant element of the balancing test.’ Given the public nature and scrutiny in respect of nearly all aspects of footballers’ performance, these factors are likely to weigh in favour of data analysts, and players’ reasonable expectations will surely be that the public may observe and analyse their playing performances, including in statistical format (after all, what is a league table or a top goalscorers chart if not a manifestation of statistics).

However, further questions asked by the ICO may fall more in favour of the players’ overriding interests: What is the possible impact on the individual? How big an impact might it have on them? Are you processing children’s data? Can you offer an opt-out?’ (ICO, 2021a). Given factors such as the fact that data analytics may be used in player recruitment or player selection (thus having an influence on players’ career opportunities), and that data sets may include information about children,⁵ and that it would be difficult to offer a practicable opt-out to those players whose personal data are processed, the balancing act is clearly not a foregone conclusion in the analysts’ favour.

So, where a legitimate interest can be relied upon will be subjective, requiring careful deliberation, and should be kept ‘under review and [refreshed] if there is a significant change in the purpose, nature or context of the processing’ (ICO, 2021a).

To complicate matters further, the bases on which special category data can be processed diverge from the bases on which other personal data can be processed. There is a restriction on the processing of special category data except where certain exceptions apply and, critically, the legitimate interests of the data controller are not a basis for processing special category data (Article 9, GDPR). This is a challenge for football data analytics given ‘data concerning health’ is classified as ‘special category’. The GDPR defines data concerning health as ‘personal data related to the physical or mental health of a natural person…which reveal information about his or her health status’; the ICO construes this as including ‘any related data which reveals anything about the state of someone’s health’ (ICO, 2021b). The nature of data analytics in football is such that there is an inherent risk that health information may be processed (or inferred) where players’ physical performance is analysed.

The restriction on processing special category data does not apply, however, where ‘processing relates to personal data which are manifestly made public by the data subject’ (Article 9 (1) (e), GDPR). This is likely to square off many instances of data processing in the football analytics industry. Third party participants have access to data which, whether or not special category, are manifestly made public by players in their performances in matches; data relating to non-public player data, such as data relating to performances in training, will generally only be capable of being collected by parties with a direct relationship with the players, such as clubs, and thus may be processed on the basis of consent. Clearly, though, third party data analytics firms should be cautious in the receipt of personal data from other parties, and should seek appropriate contractual reassurance that any data transferred are received and capable of being processed in accordance with data protection law (further analysis on data transfers is set out below at section 1.7, below).

Where a direct player-analyst relationship exists, the reliance on consent as a legal basis for processing is no less complicated. Consent is defined in the GDPR as being ‘freely given, specific, informed and unambiguous’ (Article 4 (11)). This is difficult to establish where uneven power dynamics between data controllers (for example clubs or SGBs) and data subjects (players) are at hand. Recital 43 to the GDPR clarifies that consent cannot be a valid legal ground for processing where there is a clear imbalance between the data subject and the data controller. In some circumstances, this will make consent a troublesome basis for legitimising data processing. Gilchrist and Phelops (2017) suggest that ‘data protection regulators, in certain jurisdictions, have formed the view that consent can never be validly given, for the purposes of data protection law, in the traditional employer/employee relationship (such as the one that normally exists between a football club and its squad).’ Hessert (2020b) argues that the need for consent to be freely given is ‘problematic in the sporting context, bearing in mind that sports events are often organised by monopolistic sports governing bodies’. This is a well observed point, and of course it has been a prevailing recent theme of sports law that the balance between what is consented to and what is unilaterally imposed have been keenly debated at the CAS, in the courts, and in the literature (see Duval, 2017).

Despite the tensions set out above, what can be taken from the assessment of the categories and legitimacy of processing in football data analytics is that there will generally be a legal basis for performing statistical analytics on players available to analysts, but participants in the data analytics ecosystem will need to carefully reflect on the basis and extent of the work they do, as compliance with applicable data protection law is unlikely to be straight-forward even where permissible.

1.4. Thresholds and territory

The GDPR, being an EU regulation, is directly effective in the 27 Member States, with its principles also incorporated into UK law by the DPA 2018. Its territorial scope, however, can effectively extend worldwide as the GDPR applies where processing of personal data:

• – emanates from an EU established organisation, regardless of whether the processing takes place in the EU or elsewhere (Article 3(1), GDPR).

• – relates to the personal data of data subjects in the EU where the data processor is outside of the EU, but either offers services (or goods) into the EU (Article 3(2)(a), GDPR), or the data processor monitors the behaviour of data subjects in the EU (Article 3(2)(b), GDPR).

These provisions are effectively replicated by section 207 of the DPA 2018,⁶ supplanting ‘the EU’ with ‘the UK’.

This wide territorial scope is important when you consider the global structures of the data analytics industry. Consider, for example, Arsenal’s purchase of US-based data analytics company StatDNA (Hynter, 2014) (now known as Arsenal Data Analytics)⁷—whilst incorporated outside of the UK/EU, this US-based company may be construed as relating to the activities of a UK organisation (i.e., Arsenal), and/or relating to the provision of services into the UK (providing statistical analysis services to Arsenal) and/or may involve the monitoring of the (workplace performance) behaviour of UK and/or EU citizens (i.e., players), each of which would serve to bring its activities within the scope of the DPA 2018 (or as the case may be GDPR, or both).

Clearly, the focus of many analysts’ data processing will be the EU and the UK, given Europe’s place in the football ecosystem. This means that from a territorial perspective, the principles enshrined in the GDPR are likely to apply. There is an additional consequence to this in that, subject to limited exceptions, those parties outside the UK or EU who provide services into the EU and/or monitor the behaviour of EU data subjects must appoint a representative in the UK or EU (each as the case may be) (Article 27, GDPR).⁸

On the face of it, this is likely to bring nearly all football data analytics work into the scope of the GDPR. This may be of concern to some of those who participate in football data analytics, which is in many respects a nascent industry, with a strong culture of DIY ‘fanalysts’ and significant movement from fanalytics into professional data analyst positions.⁹ Clearly, compliance with the full extent of the GDPR would be a near impossible burden for the typical fanalyst, and significant impediment to the development of data analytics. Mercifully, for those involved, in data analytics on an amateur basis, there are threshold criteria and (partial) exemptions that will take most fanalysts out of scope.

As a starting point, the principles of the GDPR will apply where data processing has some degree of automation or where the data will form a part of a ‘filing system’, which is to say the data in question are structured in some coherent way (Article 2(1), GDPR; Article 4(6) GDPR). It suffices to say that most professional data analytics participants will satisfy these criteria—but casual, manual, ad hoc data analytics performed will not, and will thus not fall within the ambit of data protection law.

Even more systematic analytics work performed by non-professionals is likely to materially fall outside of the scope of the GDPR. The GDPR makes clear that it does not apply to the processing of personal data for ‘purely personal or household activity’ (Article 2(2)(c) and Recital 18, GDPR), and there are partial exemptions which apply to data processing for academic or journalistic purposes (Article 85, GDPR, incorporated in UK law under a ‘special purposes’ exemption under sections 174–176 DPA 2018). Where those exemptions do not apply, there is also a limited exemption (Article 30(5), GDPR) for organisations of 250 persons or fewer whose data processing is occasional, does not include special category data, and is unlikely to result in a risk to the rights and freedoms of data subjects. Once data analytics becomes systematised and professionalised, it is unlikely that these exemptions will apply.

1.5. Principles of data protection

Where the GDPR (or DPA 2018) applies to the data controlled by a participant in the data analytics ecosystem, that data controller will be responsible for ensuring the core data protection principles are applied. The principles, set out in Article 5 of the GDPR, go to the heart of the EU and UK data protection regime, and state that data must only be processed:

1. lawfully, fairly and transparently

2. only for specified, explicit and legitimate purposes

3. in accordance with the principles of data minimisation

4. accurately and kept up to date

5. for no longer than is necessary; and

6. with integrity and confidentiality.

Compliance with these requirements is a fundamental obligation for the systematised manipulation and exploitation of player performance data, and should therefore form an integral part of any data analyst’s processing. It is important to note that these principles extend beyond merely what one does with personal data—they apply to ‘the whole continuum of data processing, from the stage when data is first acquired….to the time when it is permanently and irretrievably destroyed’ (Lloyd, 2020, p. 71). Consider, for example, the obligation to process personal data with integrity and confidentiality. This necessitates putting in place appropriate information security provisions. This applies against the background of the football industry as a whole having experienced several data leaks: Consider ‘Footy Leaks’ and its impact on the Manchester City Financial Fair Play dispute (Flanagan, 2020), the Liverpool and Manchester City hacking dispute referred to in Part One, section 2.2.4.1 of this article, leaks of supporter personal data by West Ham (Collins, 2021), or the cyber attack on Manchester United (Guardian, 2020). The National Cyber Security Centre has produced a report on the cyber risk threat to sports organisations (National Cyber Security Centre, 2020).

Beyond the specific case of sports data, the GDPR’s data protection principles are sometimes depicted as being antithetical to data analytics. Consider, for example, the intersection of the data minimisation principle with the necessity for large data sets on which data analytics is dependent; however, as Stalla-Bourdillon and Knight (2018) argue, ‘the GDPR is also intended to be a trust creator and a data sharing enabler for the purposes of innovation fostering…through promoting context-driven risk analyses, which in turn requires organisations to be more transparent about their personal data processing practices’.

1.6. Controllers and processors

In recognition of the differing roles played by actors in data ecosystems, UK and EU law compartmentalises parties into categories of ‘controllers’ and ‘processors’.¹⁰ Risks, roles and responsibilities under data protection law vary dependent on whether a party using personal data does so as a controller or a processor.

A controller is a ‘body which, alone or jointly with others, determines the purposes and means of the processing of personal data’ (Article 4(7), GDPR). Data can be controlled by one party, by multiple parties separately, or by multiple parties jointly (where for example there is a common data set, Article 26, GDPR; for further exploration see Tran and Adde, 2019). By contrast, a processor is a ‘body which processes personal data on behalf of the controller’ (Article 4(8), GDPR). In practice, these distinctions are not as clinical as their definitions seem, and a typical data sharing arrangement will (and often should)¹¹ involve an assessment as to the roles the relevant parties play in the relevant data ecosystem. This is important for two particular reasons: firstly, to ensure that each party performs in accordance with the data protection law as it applies respectively to controllers and processors, as the obligations diverge; and secondly, to ensure that data are shared lawfully, as data must only be processed by a data processor on a controller’s behalf pursuant to contract (or ‘other legal act’ under EU or Member State law), in which the contract must contain certain prescribed obligations (Article 28(3), GDPR). There is no absolute legal obligation for data controllers to share data between one another pursuant to a contract,¹² although to cover this lacuna, the ICO has published a data sharing code of practice which makes clear that it is good practice to have in place a data sharing agreement in place (ICO, 2020a).

The risks presented by this taxonomical approach to data protection law are of course not idiosyncratic to sports data analytics, but the underlying distinctions are central themes to data protection compliance where there are multiple participants in a data ecosystem, such as where a dedicated data analytics firm produces data insights based on data collected by a club (on general issues outside of data analytics see for example Oastler, 2018; de la Cruz, 2020).

1.7. International data transfers

It is not only the transfer of personal data between controllers and processers that is subject to specific legal obligations under data protection law. There are also detailed requirements in respect of international transfers (of personal data rather than players—although international player transfers will usually entail some international personal data transfers, for example via the FIFA TMS system). This is important for many facets of sport (see for example Kornbeck, 2017; Kornbeck, 2020), and particularly for present purposes in the context of football’s data analytics movement, which, like the industry it serves, is globally distributed.

The GDPR states that personal data may only be transferred to a third country—that is any country other than a Member State or the three additional European Economic Area states which have adopted the GDPR—where certain conditions are satisfied. This position is further complicated by Brexit, which, but for transitional measures,¹³ rendered the UK a third country for GDPR purposes; and recent case law, which imposes additional impediments on personal data transfers to third countries. Conversely, for exports from the UK, any country outside the UK will be a third country.¹⁴

A transfer of personal data to a third country is only permissible where certain criteria are met. The first such is where an adequacy decision has been made in respect of that third country by the European Commission or the UK Secretary of State for Digital, Culture, Media and Sport (as applicable), although a limited number of such decisions have been made (European Commission, 2021). In the absence of an adequacy decision, transfers must generally¹⁵ only be made where prescribed ‘appropriate safeguards’ are put in place (Article 46, GDPR) and provided that ‘enforceable data subject rights and effective legal remedies for data subjects are available’ in the recipient state (Article 46(1), GDPR). A number of appropriate safeguards are set out in the GDPR, with the most commonly used in a commercial context being ‘standard contractual clauses’ (a form of contractual clauses in the exact form specified by the European Commission, UK Secretary of State, or ICO as applicable), less commonly,¹⁶ ‘binding corporate rules’ (a set of binding policies which govern data transfers within a corporate group (Article 4(20), GDPR)).

This compliance burden is complicated further by the decision in Data Protection Commissioner v Facebook Ireland Ltd (C-311/18) [2020] 7 WLUK 245 (ECJ (Grand Chamber)), commonly referred to as ‘Schrems II’. The headline findings of the ECJ in Schrems II were the invalidity of the ‘Privacy Shield’—an adequacy framework for EU-US data flows approved by the European Commission—and the validity in abstract terms of the Commission’s standard contractual clauses (SCCs). However, exporters of personal data to third countries ‘must ensure that the rights of the persons whose data are transferred benefit…from a level of protection essentially equivalent to that which follows from the GDPR’ (paragraph 115, Schrems II) and cannot rely on the SCCs alone in ensuring this. Consequently, for data exporters ‘not only must the terms of the SCCs themselves be taken into account but also the general legal environment in the destination State’ (Woods, 2020). Despite the existence of the Privacy Shield, the position as regards data transfers from the EU to the US was found to insufficiently protect data subjects’ rights. Woods (2020) states that this also ‘has consequences for the operations of SCCs in practice at least as regards transfers to the US because it implies a negative assessment of the US data protection standards’. So, the export of personal data to the US is challenging per se; however, the consequences of the decision in Schrems II go beyond the flow of data to the US. The assessment of local law in the data importer’s jurisdiction will apply where the SCCs are relied upon. This results in ‘the imposition of a form of due diligence obligation on those controllers no matter the destination to which the data are transferred’ (Woods, 2020).

In the global world of football data analytics, this means that data collected by a club or league in the UK or EEA cannot be transferred to (say) a data analytics company in a third country, such as the US, in reliance on the SCCs without also performing an assessment of that country’s prevailing privacy law framework—which in the specific case of the US has already been viewed unfavourably by the ECJ. Moreover, data analytics firms who post information and insights online will in likelihood be construed as transferring data to third countries (see Lindqvist v Aklagarkammaren i Jonkoping (Case C-101/01) EU:C:2003:596) unless they can do so in reliance on the partial exemption for journalistic or academic purposes described in section 1.4, above.

1.8. Data subject rights

The fundamental purpose of the restrictions on data transfers to third countries is to protect data subjects’ privacy rights by ensuring that data are not transferred to territories with lower data protection standards (see Schrems II).

The rights of data subjects are further protected by specific data subject rights, which may affect those who wish to monitor and manipulate data relating to football players’ performances. Data subjects’ rights are set out in Chapter 3 of the GDPR and the DPA 2018 respectively. These rights can be split into two loose categories: 1. rights to information in respect of personal data usage; 2. rights of personal agency in respect of third parties’ use of data concerning that individual.

1.9. Accountability and governance

In addition to establishing the specific rights and obligations of the participants in a data ecosystem, the GDPR also establishes high level accountability and governance obligations. In addition to being accountable for ensuring compliance with the six data protection principles set out in section 1.5 above, the GDPR requires data controllers to ensure that data privacy is embedded by ‘design and by default’ (Article 25, GDPR). The European Data Protection Board makes clear that this obligation arises ‘early on…before processing, and also continually at the time of processing’ (European Data Protection Board, 2020).

The obligation for data controllers to self-reflect in this way is hard-wired into the GDPR. Article 35 of the GDPR requires controllers to perform data protection impact assessments (DPIAs) where processing activities precipitate a high risk to the rights and freedoms of data subjects. In particular, this should be performed where the processing in question involves ‘processing on a large scale of special categories of data’ (Article 35(3)(b), GDPR), such as player health information, or involves ‘a systematic monitoring of a publicly accessible area on a large scale’ (Article 35(3)(c), GDPR). Given the nature of data analytics, it is likely that a significant amount of data analytics work will necessitate a DPIA being performed. In R (Bridges) v Chief Constable of South Wales Police (Respondent) and others [2020] Civ 1058, a case in which automated facial recognition technology was found to have been deployed by police in breach of human rights and data protection law, defects in the police’s DPIA were pivotal to the relevant breaches of law (paragraph 153, R (Bridges)).

In order to ensure proper data privacy governance, certain organisations are under an obligation to appoint a data protection officer (DPO), who must be appropriately qualified with an ‘expert knowledge of data protection law and practices’ (Article 37(5), GDPR), and who must report to the ‘highest management level’ (Article 38(3), GDPR) of the organisation. The DPO is charged with advising on, and monitoring compliance with, data protection law. The obligation to appoint a DPO is not absolute, but organisations must do so where their ‘core activities…by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale’ (Article 37(1)(b), GDPR). Given the nature of data analytics, this is likely to encompass many organisations at which data analytics occurs.

Failures to comply with data protection law have the potential to create both civil and administrative liabilities. From a civil liability perspective, Article 82(1) of the GDPR states that ‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’. In English law, the position regarding what constitutes ‘damage’ on the one hand (see Roughton, 2019; Janeček, 2020), and a rise in class action data litigation on the other (Hopkins, 2019; Chapaneri, 2020; Castro-Edwards, 2021) has rendered the position uncertain for data controllers and processors.²⁰ Where breach and damage are established, the position in respect of quantum of damages is also presently somewhat uncertain.²¹

Irrespective of the uncertainty around civil liability, the position in respect of administrative fines is clear: sanctions for breaches can be severe—up to the greater of €20m or 4% of worldwide turnover in the prior year (Article 83, GDPR)—and in the UK, the ICO has, at the time of writing, already issued several multi-million pound notices of intent to fine for breaches of the GDPR (Hasan, 2020).

1.10. FIFA’s Data Protection Regulations

In 2019, FIFA adopted its own Data Protection Regulations (FIFA DPRs, FIFA 2019). The FIFA DPRs have considerable conceptual overlap with the GDPR, with many of the GDPR’s main themes—on data protection principles, on data subject rights, on data privacy information—ostensibly adopted from the GDPR, albeit with some minor deviations and in a considerably more slimline format.

In contrast to the GDPR, the scope of the FIFA DPRs is quite narrow, relating only to personal data processed by, on behalf of, or with FIFA; where exchanged with FIFA or a FIFA Member Association; or where relying on infrastructure provided by FIFA. It expressly does not include personal data processed by Member Associations or their members ‘using their own infrastructure; for their own purposes; and in their own right’ (Regulation 3, FIFA DPRs).

The FIFA DPRs are interesting in that they incorporate data protection principles directly into the lex sportiva,²² reflecting Weatherill’s (2021) observation that: ‘the economic centrality of Europe to many, if not all, sports means that in practice the need to adjust practices to comply with EU law sometimes entails that adjustment operates more widely. EU’s norms become global norms.’ However, for the purposes of data analytics, the impact of the FIFA DPRs is likely to be minimal, given the necessary nexus with FIFA in order for the FIFA DPRs to apply.

For more detailed analysis of the FIFA DPRs and its distinguishing features from the GDPR, see Bellamy (2020).

1.11. Data protection law and sports data – conclusions

In basic terms, there is scope for data analysts to use and manipulate player performance data. In many circumstances this will not entail seeking the permission of the player in question. However, data analysts will only be able to perform their activities where they do so in compliance with data protection law. This will entail the navigation of a dense network of law and regulatory guidance. For UK based analysts who monitor the data activities of EU data subjects, or vice versa, this may entail compliance with both UK and EU data protection law as it bifurcates post-Brexit. This is a complex task which requires careful consideration, and in likelihood some compliance costs, which may act as an impediment to new market entrants in the data analytics space.

Inversely to the position in respect of intellectual property rights in data analytics, the legal rights associated with the exploitation of player data lie primarily with the players rather than the data analysts. Notwithstanding the prima facie rights that analysts may have as data controllers, rights of objection, restriction, and erasure present potential problems for data controllers who rely on their own legitimate interests to process that data, whereas controllers who rely on consent are prone to that consent being withdrawn.

In that regard, Project Red Card presents an issue on two levels: Firstly, it highlights the autonomy players have if they choose to exercise their rights over their personal data on a systematised basis; secondly, it presents a potentially significant liability for any users of player personal data who have done so without adhering to the detailed obligations set forth in the GDPR.

Hessert (2020b) highlights the fact that athletes, as data subjects, have a right to compensation under Article 82(1) of the GDPR, in circumstances whereby their personal data are exploited without an appropriate legal basis. This is by no means a fait accomplis vis-à-vis data analytics, as participants in the football data analytics community do have scope to utilise player performance data, even in circumstances where they are pursuing their own commercial interests, without the consent of players. However, this can only be done in compliance with the prevailing data protection law and regulation, which is a complex activity requiring detailed and ongoing consideration and self-reflection. In a nascent analytics market, this will necessitate a degree of organisational maturation in order to ensure that players’ data rights are not infringed.

2.1. Competition Law

Competition law has been a central theme of the regulation of the football industry. Gardiner et al. (2012: 64) describe it as ‘the most significant aspect of EU law germane to the sporting context’. Given the structure of sport, and the potential for monopoly rights to be exerted in the collection of data (see section 2.2.4.2 of Part One of this article describing the ‘house right’), or the potential for competitors to be excluded from data markets by agreements or conduct, there is scope for breaches of each of Articles 101 and 102 of the Treaty on the Functioning of the European Union (or their closely aligned domestic counterparts in UK law, Chapters 1 and 2 of the Competition Act 1998), which govern agreements restrictive of competition and abuses of dominant positions respectively.

In the specific case of sports data, competition law issues may arise in several key risk areas. Firstly, information sharing. Where confidential sports data are exchanged between competitors and those data give an indication as to future strategy. For example, a systematised sharing of player training data between leading clubs would warrant additional consideration from a competition law perspective. Secondly, harmonisation. Where a majority of competitors take data from a single source, or rely on the same data processing mechanism (say, a specific algorithmic process), this may impact the competitive functioning of the market and will warrant vigilance for competition law compliance. And thirdly, discrimination. Any agreement to exclude certain competitors from access to data sets or data-derived sporting advantage should be treated with caution. This issue may arise, for example, in exclusivity arrangements between data analytics organisations and their club clients–particularly if the analytics firm has a dominant market position, or access to data that become critical to enable clubs to compete.

Indeed, competition law has already become a point of contention in the sports data market, specifically in respect of the exercise of the ‘house right’ described in section 2.2.4.2 of Part One of this article: The Competition Appeal Tribunal case of Sportradar AG and Sportradar UK Limited v Football DataCo Limited, BetGenius Limited and Genius Sports Group Limited (Case no 1342/5/7/20) concerns a challenge by the claimant sports data group, Sportradar, in respect of contracts concerning ‘official’ data collection and distribution rights between Football DataCo and Genius, a competitor of Sportradar’s, on the basis of both Articles 101 and 102 of the Treaty on the Functioning of the European Union.

2.2. Regulation of Artificial Intelligence

On the horizon for football’s data analytics community should be the EU’s draft AI regulation (the Draft EU AI Regulation), which is proposed to provide a comprehensive risk-based framework for AI, which will act as a ‘uniform legal framework in particular for the development, marketing and use of artificial intelligence in conformity with Union values’ (Recital 1, Draft EU AI Regulation) (European Union, 2021). The Draft EU AI Regulation draws on a broad definition of AI, including ‘machine learning approaches…logic and knowledge-based approaches…[and] statistical approaches’ (Annex 1, Draft EU AI Regulation), and of particular relevance to football data analytics is the designation of certain systems as being ‘high risk’ and thus attracting greater levels of regulatory oversight. This includes ‘AI systems intended to be used for recruitment or selection’ and ‘AI intended to be used for making decisions on promotion and termination of work-related contractual relationships’ (Article 6(2) and Annex III, Draft EU AI Regulation), which are core data analytics use cases. The specific text of the Draft EU AI Regulation is likely to change as it moves through the legislative process; however, it is sure to stress appropriate governance, transparency, and human oversight and accountability in the use of AI which affects employment relationships.

Of course, the use of AI in data analytics, insofar as it involves the processing of personal data, is already subject to data protection law, and indeed the ICO has published Guidance on AI (ICO, 2020b). Much like any complex personal data usage, regulatory compliance when using AI for football data analytics should be considered at an early stage. As Fierens and de Bruyne (2020) conclude: ‘There are several legal and ethical challenges regarding the use of AI-systems in sport’; but good governance and compliance-orientated practice in football data analytics should ensure that AI can continue to be used for the betterment of the sport.

2.3. Other legal issues

A number of other legal issues may arise from data analytics in football. The intersection of human rights and data protection law was touched upon in section 1.9 above, and Article 8 of the European Convention on Human Rights, which protects private and family life, home, and correspondence may be engaged where an employer undertakes systematised surveillance of an employee’s workplace behaviour (see Bărbulescu v Romania, ECHR [2017]); similarly, such monitoring in the context of the power dynamic of an employer-employee relationship such as a typical club-player relationship may give rise to employment law concerns.

Data analysts may concern themselves with issues of product liability, and in an industry which is built upon an ability to derive value through objective insight, analytics-based advice may in particular give rise to issues in tort or contract of negligent misstatement or negligent misrepresentation in circumstances where negligent recommendations on player recruitment are made and those recommendations are relied upon by clubs.

Finally,²³ as with all legal issues in sport, the compulsory system of arbitral dispute resolution under which football operates (as to which, see Duval, 2017) may have legal implications for football data analytics–particularly given those fora are used to determine matters which may be within the purview of data analytics, such as a player’s market value (consider historically, for example, FC Shakhtar Donetsk v. Matuzalem & Real Zaragoza SAD (CAS 2008/A/1519); Udinese Calcio S.p.A. v. de Sanctis & Sevilla FC SAD (CAS 2010/A/2147); Mutu v. Chelsea Football Club Limited (CAS 2008/A/1644). Data protection issues are ‘gradually arising in the CAS proceedings’ (Novak and Kühne, 2020) in the context of anti-doping proceedings, and indeed have arisen in arbitral matters relating to player transfers (Barnsley Football Club Limited v Hull City Tigers). Data protection issues at the CAS may shape data analytics by influencing the approach to data taken by data issues in light of the jurisprudence of the CAS²⁴ and by presenting the data analytics industry with opportunities to provide objective measures to sports disputes, such as in the form of expert witness testimony (as to which, more generally, see Rigozzi and Quinn, 2014; Coleman and Taylor, 2020).