Project Red Card: UK soccer players call foul on the use of their personal data

Although UK soccer fans are currently consigned to watching their team virtually, they can now access more detailed data on player performance than ever before. However, those players are now fighting back. On July 26, 2020, it was reported that over 400 UK soccer players are taking to the courts over the use of their “performance and tracking data”, in a programme they call Project Red Card (the Project). The outcome of the Project, and its interaction with the relevant data protection legislation, holds the potential to impact the use of player data across the sport and beyond.

Project Red Card

Led by former Cardiff City Manager, Russell Slade, the Project is the vehicle by which professional soccer players from the English Premier League, English Football League, National League and Scottish Premiership join together in bringing claims against gambling, betting and data processing companies. The cohesive effort alleges that the professional soccer players did not consent to their performance and personal data being used for the profitable benefit of such companies. The players’ concerns are not necessarily that the information is being used, but that the players were not involved in prior negotiations, discussions or arrangements put in place for the use of such data. The Project is taking on the arduous task of delineating data that is deemed to be within the public sphere (such as a player scoring in a particular game) and more complex data (such as a detailed breakdown of the areas of the pitch a player’s future goals may come from) to which the players may have a stronger claim.

Data protection legislation

Those involved with the Project argue that player performance data represents “personal data” and is being used without the relevant consents from those players under UK and EU data protection laws.

As such, two pieces of data protection legislation are likely to be relevant:

• The General Data Protection Regulation (the GDPR), a broader piece of EU legislation that provides a single set of rules “for all companies operating in the EU, wherever they are based.” Among other things, the GDPR establishes rules relating to “the protection of natural persons with regard to the processing of personal data and…to the free movement of personal data”; and
• The Data Protection Act 2018 (the DPA), the UK’s domestic data protection legislation, which, among other things, implements the GDPR in the UK. The DPA provides that most processing of personal data is subject to the GDPR. However, it also supplements the GDPR, applying a similar regime to some types of processing to which the GDPR does not apply, and makes provisions about certain types of data processing by various entities.

Both pieces of legislation define “personal data” as any information relating to an identified or identifiable “natural person” (per the GDPR) or “living individual” (per the DPA). Among other things, such individuals have the right under both pieces of legislation to obtain access to their personal data, to object to its processing for marketing purposes or in other certain circumstances, as well as to request it (under specific situations) to be corrected, erased, or restricted, and to data portability (i.e. getting and reusing their data for different services). As such, if any of the soccer players’ data falls under “personal data”, then gambling, betting and other data processing companies may have certain obligations imposed on them regarding the use of such data.

If the Project is successful, some of the players involved could be compensated for up to six years (the limitation period under UK law) of use of their data without their consent.

Potential impacts on soccer and beyond

The legal arguments put forward by those behind the Project are as of yet largely untested in the UK. There will likely be a sharp focus on the use of player data by betting companies; specific players may object to the use of their performance data by betting companies to help calculate their odds for any number of reasons. Subject to how the Project progresses, it will likely have a wide-ranging effect on how athletes exploit their own performance data in the future; we could end up in a scenario whereby athletes contract with third parties for the exclusive right to exploit and use their performance data in a similar way as to how exploitation of a player’s image rights are negotiated.

If successful, the Project may see many current and former soccer players bring forward claims for compensation. The impact would be considerable given the sheer scope of players and clubs affected. Additionally, this issue transcends soccer and may become a more common area of discussion for athletes across the globe, in various sports and leagues. Just recently, in American football, the National Football League Players Association joined a partnership with a wearable technology company that would give players the ownership of all data coming from the product they wear. Perhaps this development not only sheds light on the importance of data collection in the sporting industry, but also represents a shift towards an emphasis on athletes’ rights to the data and information that they produce.

We will continue to closely monitor developments around the Project, and the implications it has in sports and beyond.

The authors would like to thank David Mancini and Rebecca Brown, summer students, for their assistance in preparing this blog post.