How performance data is transforming the business of sport

Snapshot

Performance data is now consistently used in many sports
While performance data can be insightful and lucrative, its use is not without legal risks. Cyber risks and data protection breaches are potentially the most significant
Those collecting sports performance data will need to carefully consider the impact of the data they are collecting, using and sharing

Sports data has become big business. During the 2022 Giro d'Italia, Eurosport broadcast live the heartbeats of the two leading cyclists via a WHOOP strap – a wearable sensor. This enabled viewers to better predict the race outcome, while providing unprecedented insight into the small margins in elite level sport. Ten years ago, such a public display of data analytics would have been largely unthinkable – but now, performance data is being tracked, scrutinised, analysed, and monetised in almost all sports.

But, inevitably, the monetisation of performance data has led to questions as to who owns it, who is entitled to exploit such data, and who has the obligation to secure it.

Further Osborne Clarke Insights

> Raising the stakes: the UK landscape is changing for sports and betting

> Will AI be a game changer for the sports industry?

> Global sport gets ready to demonstrate sustainability leadership

> The sports industry: Laundering more than dirty kit?

The benefits of tracking

There are now many examples to illustrate how valuable sports performance data has become and how sports data is being analysed not just by players and their back-room staff, but by pundits and fans.

Tracking performance data can deliver performance optimisation. During the 2022 Football World Cup, FIFA's Player App was used for the first time. Based on input from professional players and FIFPRO (the global representative of professional footballers) the Player App enabled players to access their own match performance data, while also providing match photos and statistics, directly from the Player App.

As sport becomes increasingly commercialised, tracking performance data can be the difference between success or failure. Professional teams are, therefore, increasingly investing in data analysts and tracking facilities. Individual players are also using data facilities. In 2021, footballer Kevin De Bruyne used Analytics FC to produce a report on his "contribution value" based on past, present and future performances, as part of his Manchester City contract negotiations.

Carolina Marín, the Spanish three-time badminton world champion, has been harnessing the power of data since 2006. Marín not only analyses her own data but also those of her rivals, in order to come up with a game plan for every opponent.

Clubs, leagues and broadcasters are also waking up to the commercial possibilities within the data itself, while data is increasingly being used by video game developers and gambling firms to create consumer products for profit. In Spanish football, the two top leagues use a proprietary video motion analysis tool to record each match. Each match has eight perimeter cameras, capturing every type of performance data: players' physical data and technical data (such as the speed and power of a shot). The data from each of the last four games is then provided to all 42 clubs in a 24-page report.

Data can be a hugely valuable asset for commercial entities and the athletes themselves. But of course, the use of data is not without its risks.

Hacking risks

The principal threat facing any organisation which gathers large amounts of personal data is that of a potentially ruinous cyberattack. When the personal data relates to sports professionals, the risk is particularly pronounced. Sports' global appeal means that this data might be of huge value to those looking to unlawfully obtain it. A notable example of this was in 2016 when medical information relating to two of Britain's elite cyclists – Sir Bradley Wiggins and Chris Froome – was exposed following a hack of the World Anti-Doping Agency by the Russian group Fancy Bears.

A recent report by the UK's National Cyber Security Centre highlighted that sports organisations (many of which are on the global stage) are at risk from hostile nation-state sponsored hackers. Of those sporting organisations surveyed, around 70% mentioned that they experience at least one cyberattack annually. This is significantly higher than the UK business average (32%). Furthermore, only 33% of respondents strongly agreed that they had the right software and hardware in place to help prevent cyberattacks.

Cyberattack prevention

A major cyberattack could have severe financial, operational and reputational consequences. Regulators will not be sympathetic to organisations who cannot demonstrate that they had appropriate measures in place to protect the data they hold and to seek to prevent cyberattacks from occurring. As well as taking steps to prevent cyberattacks, controllers of personal data must also ensure they are compliant with the relevant data protection regulation and ensure that their data processing partners and suppliers are too.

Data subjects are now increasingly aware of their rights, and it would appear that sports professionals are no different – with Project Red Card an example of potential legal action being contemplated in relation to player data. The claimants (over 400 professional current and ex-footballers) are threatening legal action against various companies that are said to gather and use their personal performance data in the betting and gaming sector.

It is alleged that the processing of the players' personal data contravenes data protection law. While Project Red Card is still in the pre-litigation stages, should the players prevail, it could change the sports data industry.

In the meantime, those collecting performance data may wish to consider the impact of the data they are collecting, using and sharing, whether they need to retain it, whose responsibility it is to protect it, and whether they have the necessary consents and contractual rights to process and exploit it.

Not all performance data will be personal data and there is a big distinction between ordinary performance data (for example, number of yards run) and health data (injury records). It is only a matter of time before the courts start poring over these nuances in a sporting context.