Sports Data: Legal Protection and Commercial Exploitation
By Dr Estelle Ivanova, Counsel, VALLONI Attorneys at Law, Zurich, Switzerland
We live in an increasingly digital world, in which the legal protection and commercial exploitation of data, in particular, sports data, has become a central issue in the modern sports economy.
Artificial Intelligence (AI) is also playing an increasingly important role in the generation, circulation and monetisation of vast amounts of personal, behavioural and performance data relating to sports persons, teams, clubs, fans, federations and commercial partners, including sponsors.
This evolving ecosystem raises complex legal and governance challenges across the management of the sports sector, which has become a multi-billion US dollar global business in its own right.
The legal protection of sports data is grounded in European human rights law. In particular, the right to respect for private and family life, guaranteed under Article 8 of the European Convention on Human Rights of 1950, which has long been interpreted as encompassing the protection of personal data.
This basic law is reinforced by the Council of Europe Convention 108+ of 2018, which establishes core principles governing the lawful and fair processing of personal data across several sectors, including sport.
In practice, reliance on consent as a legal basis for the commercial exploitation of sports persons’ data remains particularly problematic in professional sport, given the structural imbalance inherent in employment and contractual relationships. Whilst alternative legal bases may be available under data protection law, they do not displace the fundamental obligation of transparency, nor do they resolve broader questions of control and fair value allocation.
Against this backdrop, the exponential growth of data-driven technologies, including AI, is transforming sports persons’ performance metrics, biometric indicators and health information into highly valuable commercial assets, particularly for betting companies, media operators and data analytics providers.
This is particularly true in association football, which provides a sensitive illustration of such legal challenges, given the volume, granularity and economic value of data relating to football players, which are collected and commercially exploited on a continuing basis.
In this context, much of the data collected in professional football—ranging from performance statistics to medical and biometric information—qualifies as personal data, and, in many cases, as sensitive health data. Its processing, therefore, falls clearly within the scope of the European Union (EU) General Data Protection Regulation (GDPR) of 2018, which imposes strict requirements relating to its lawful processing, transparency, purpose limitation, data minimisation and security. Everyone involved in sport must carefully assess their respective roles as data controllers or processors; ensure the existence of a valid legal basis for processing; and implement the robust governance frameworks.
It should be noted that the GDPR applies irrespective of the geographical location of the parties involved, to the extent that sports data relating to individuals in the EU is processed, an issue of particular relevance in an increasingly globalised sports data market. This regulatory framework is underpinned by a robust enforcement regime, reinforcing the strategic importance of proactive compliance and accountability for all stakeholders in sport.
Beyond lawfulness, inadequate security measures may expose sports organisations to significant regulatory, reputational and contractual risks, particularly where large volumes of fan or player data are processed through digital platforms. This regulatory landscape is further shaped, as mentioned, by the growing use of AI-driven systems in sport, which introduce additional requirements of risk management, transparency and human oversight under the EU Artificial Intelligence Act of 2024, particularly where biometric analysis and surveillance technologies are involved.
These governance challenges become especially apparent in high-risk segments of the sports data economy. The large-scale aggregation and commercialisation of footballers’ real-time performance data by betting companies—often in the absence of direct contractual relationships with players—has attracted increasing legal scrutiny. In parallel, the deployment of surveillance technologies in stadiums illustrates the tension between legitimate security objectives and the requirement that data processing must remain necessary, proportionate and transparent.
For example, these concerns are at the heart of the Project Red Card initiative in the UK, through which professional footballers are challenging the unauthorised commercial exploitation of their performance data by third parties. Beyond the dispute itself, the initiative reflects a broader structural shift: sports persons are increasingly invoking data protection legal frameworks to assert control over their personal data and to claim a fair share of the economic value generated from its commercialisation.
In response to these various developments, FIFPro, the worldwide organisation which represents some 65,000 professional football players, has issued guidelines in 2022 on the storage, control and sharing of footballers’ personal data. These guidelines advocate for enhanced player transparency, informed consent, and contractual clarity regarding data ownership and commercialisation. They also encourage stakeholders to adopt governance models that respect players’ rights, whilst enabling legitimate sporting and commercial objectives.
As regulatory enforcement intensifies and litigation risks increase, stakeholders across the sports ecosystem must, therefore, reassess their data strategies.
Ensuring compliance with data protection law is no longer sufficient; a broader, forward-looking approach is required, one that balances innovation, commercial exploitation and the fundamental rights of sports persons.
In that sense, personal data governance in sport increasingly operates not only as a matter of regulatory compliance, but also as an ethical framework shaping trust, legitimacy and long-term sustainability.
Dr Estelle Ivanova may be contacted by e-mail at ‘
