A look at Project Red Card

Answer

This article was originally published on 6 June 2023.

Data has become the business world’s most valuable commodity and the world of sport is no different. Performance data is becoming more of a focal point, especially in football. This has raised questions around the ownership of performance data in football, fundamentally, who owns this data? Project Red Card seeks clarity on these questions.  

Who typically owns performance data?

A helpful starting point to determine who owns and has the right to performance data, is whether the individual to whom the performance data relates has consented to the processing of that data. Another useful reference point is the contractual basis upon which a footballer’s performance data is processed. As an example, a club may have a contract in place with the player authorising the collection and use of the player’s performance data. The purpose of the processing is also likely to be built into that contract, this in practice defines clear parameters around why and how the performance data is to be used. The performance data in such an instance can be seen to be owned by both the player and the club.

However, what happens to ownership when performance data is processed in the absence of any direct consent or contract and is used for other purposes such as gaming and betting? This is where Project Red Card comes in.  

What’s Project Red Card?

Project Red Card is the name of the claims being brought by more than 850 current and former Premier League, English Football League, National League and Scottish Premier League players over the allegedly unlawful collection and use of their performance data by gaming, betting and data processing companies.  

Who’s involved?

Under the stewardship of former Cardiff City Manager Russel Slade, the claim is being brought against several gaming, betting and data processing companies.  

How much is the claim worth?

The claim is expected to be worth hundreds of millions of pounds and seeks to recover lost income going back six years. The amount of compensation each player is owed is expected to be determined by the amount of exposure they’ve attained as well as the level of football the player has competed at, although this is subject to a final decision.  

What’s the claim?

The claim alleges a violation of UK Data Protection Law on the grounds that the performance data was processed unlawfully.

Data Protection Law in the UK is governed by the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018 (the DPA).

The UK GDPR is an adaptation of the EU General Data Protection Regulation. It establishes the rules relating to the processing of personal data. The DPA is UK legislation that implements and supplements the UK GDPR. Together they form the basis of Data Protection Law in the UK.  

Personal data is defined by the UK GDPR as, “any information relating to an identified or identifiable natural personas”. The claimants argue that the personal data in this case is the performance data belonging to each of the individuals bringing the claim. Performance data includes statistics such as goals scored, passing accuracy and distance covered.

The UK GDPR also sets out limited lawful bases that govern when an organisation can legitimately process personal data, these are: 

• with the consent of the individual;
• to meet a contractual obligation;
• to meet a legal obligation;
• for the performance of a task in the public interest;
• to protect the vital interests of an individual; and
• for the organisation’s legitimate interests.

The claim alleges that the organisations responsible didn’t have any lawful basis to process the performance. There have also been suggestions that the performance data includes health data. Health data under the UK GDPR is categorised as “special category data” and to be lawfully processed must also satisfy a separate condition under Article 9 of the UK GDPR. 

The claim has a particular focus on the absence of consent, alleging that the organisations responsible failed to obtain the consent of the individuals prior to processing any of the performance data.  

Invisible processing

Project Red Card also raises some interesting points around ‘invisible processing’.

‘Invisible processing’ occurs when an organisation obtains personal data from a source other than directly from the individual themselves and the organisation doesn’t provide the individual with privacy information regarding the processing of that data. The processing is therefore ‘invisible’ because the individual is unaware of the collection and use of their personal data. In the absence of any privacy information, the individual is unable to exercise their data protection rights because they’re unaware of the processing taking place.

Data Protection Law in the UK adheres to fairness and transparency principles as contained in the UK GDPR. There’s a risk with invisible processing, that it breaches these principles unless there’s a lawful exemption in place.

Project Red Card claims that the claimants were unaware of any processing taking place and may claim on the grounds of invisible processing. It’ll be interesting to see how this particular element plays out.

How did the claimants access the performance data that the defendants were processing?

Under the UK GDPR, individuals have the right to access and receive a copy of their personal data that’s processed by an organisation. To facilitate this right, individuals can submit to the organisation in question, a Data Subject Access Request (DSAR) to request their personal data that is held by the organisation.

To help build the claim, it’s reported that the claimants submitted DSARs to suspected companies to help determine what performance data and how much of their performance data was being processed.  
What’s the status of the claim?

The claim was initially reported in 2020 and entered pre-litigation stage in 2021. The case was due to be heard last year but confirmation of a hearing has yet to be made publicly available.

What effect could Project Red Card have on data collection in sport?

The impact of a successful claim would not only be felt domestically, but would also have an effect across the world, in numerous sports and leagues. It’d represent a huge shift in athletes taking ownership of their performance data. It could transform the way athletes can exploit and use their performance data.    

Practically, this could mean that any third party seeking to lawfully process an athlete’s performance data may need to obtain the consent of the athlete prior to the processing or enter into a contract with the athlete for the purpose of processing the performance data. Athletes could also seek exclusivity rights and payment in return for their performance data. This could be significant for organisations such as gaming and betting companies, seeking to process athletes’ performance data for profit.

Conclusion

Due to the widespread implications of Project Red Card, this case will be followed closely by many. For now, as we await the outcome, organisations might want to consider the lawful basis that they're relying on to process personal data and their approach to data protection compliance in general. 

Sam Foley is a fourth-seat trainee at TLT LLP.