Significant volumes of physiological data are generated each year in global professional sports. Jurisdictions apply different data protection regimes that generally do not establish ownership of physiological data. The athlete produces this data with their body; the club collects it with its sensors. The effect of an acquisition on contracts and data depends on the structure of the transaction, applicable law, and contractual clauses.
The essentials
- Professional athletes’ physiological data serves analysis of health, performance, and tactics. Some collective agreements, such as the NBA convention, prohibit their use in transactions or transfer negotiations. Their commercial reuse remains without defined legal ownership at the international level.
- Physiological data are generated regularly in worldwide sport without clear legal attribution.
- The General Data Protection Regulation frames sports applications, but certain factual qualifications and legal bases must be assessed case by case. Biometric data fall under special categories only when processed for the purposes of identifying a natural person uniquely. In an employment relationship, processing must be based on a legal basis under Articles 6 and 9 of the GDPR.
- The NBA convention contains specific protections for wearable-derived data, including voluntariness, written information, player access to their data, usage limits, and cybersecurity requirements, without necessarily employing the legal term “biometric data.”
- The consolidation of clubs into portfolios by sovereign wealth funds raises new issues. Intra-group sharing requires a legal basis, information for the individuals concerned, and where applicable, compliance with international transfer rules; explicit consent is not systematically the only possible basis.
The athlete measures everything, owns nothing
Physiological data has growing value for performance analysis, but its legal ownership remains undetermined.
A modern professional football player typically wears around seven sensors during training. His sleep is monitored. His heart rate variability is recorded. His muscle load is calculated at each session. This data serves injury prediction, performance optimization, and in some cases, transfer evaluations.
The value of this data is measured in transactions. A club selling a midfielder for 40 million euros now includes in the file several years of physiological metrics, maximum aerobic power evolution, recovery history, GPS data over five seasons. This file can weigh on the final price as much as a standard medical report. The performance analysts that major clubs employ full-time process these flows in real time to adjust training loads and prevent injuries. The sports performance analytics market weighed approximately 4 billion dollars in 2023 according to industry estimates, and continues to grow.
The athlete generally has no legal rights defining ownership of this data. Many employment contracts include rights assignment clauses covering data without explicitly qualifying them. The distinction between commercial image data and sensitive physiological data appears in almost none of them.
The limits of the GDPR regarding sports physiological data
The GDPR classifies as special categories biometric data processed for the purposes of identifying a natural person uniquely. In theory, their processing requires explicit consent or an enhanced legal basis. In practice, application in professional sports remains interpreted differently depending on jurisdictions and clubs.
The European Data Protection Board has produced general guidelines on biometric data without covering the professional sports context. European clubs operate in distinct national legal spaces: a Spanish club, a German club, and a French club process the same physiological data under different interpretation regimes.
An athlete under contract with a European club falls under the GDPR when their data is processed in the context of that establishment’s activities, even if this processing occurs outside the Union. A transfer to a server or partner outside the EU remains subject to GDPR protection and must respect the conditions applicable to international transfers and processing.
Consumer sports applications pose an adjacent problem. Smartwatches, sleep-tracking applications, and load-analysis platforms that athletes often use on their own initiative collect data that ends up in commercial databases unconnected to their employer. The confusion is twofold: neither the club nor the athlete fully controls this flow.
The NBA as an imperfect reference
The NBA collective bargaining agreement is often cited as the most advanced model of data governance in professional sports. It effectively frames the collection and use of player performance data. It limits what clubs can publish or commercialize. It provides mechanisms for consultation with the players’ association.
What it does not contain: a legal definition of biometric data ownership. The agreement distinguishes visible performance data—game statistics, play metrics—from internal physiological data. For the latter, it establishes safeguards without settling the ownership question. The agreement does not explicitly resolve all multi-club portfolio scenarios, but it already restricts access to and purposes of use for wearable-collected data.
European players’ unions are structurally weaker than the NBA Players Association. In football, FIFPro, the worldwide federation of professional players’ associations, has documented for several years the absence of specific protections in standard contracts. Many transfer contracts include general rights assignment clauses covering data without naming them.
Middle Eastern sovereign wealth funds accelerate the problem
The Middle East has established itself as a major player in global professional sports. Saudi Arabia’s Public Investment Fund now controls four Saudi Premier League clubs, several golf franchises, and stakes in European clubs via investment structures. Qatar Sports Investments has owned Paris Saint-Germain since 2011. Abu Dhabi United Group transformed Manchester City into the head of a multi-club portfolio spanning multiple continents.
This consolidation movement creates a new situation. In internal transfers between clubs of the same portfolio, the athlete’s physiological data are often retained within the same group’s infrastructure. Standard transfer contracts generally do not provide for explicit athlete consent for this intra-portfolio reuse.
The strategic value is obvious. A fund holding ten clubs possesses a comparative database on hundreds of athletes at different levels, different nationalities, different physiques. This data serves talent detection and recruitment at portfolio scale.
Law protects and frames data processing without establishing a sui generis ownership of physiological data.
This dynamic connects to a broader tension over data ownership in the digital economy. When actors like sovereign wealth funds adopt technologies without having formed corresponding legal frameworks, regulation always lags behind, and gains accumulate for those who acted first.
Who regulates before the market consolidates
Two trajectories open toward 2030-2035, depending on whether regulation precedes or follows portfolio consolidation.
In the first scenario, a binding international legal framework is adopted, led by world federations, supported by governments, before sovereign wealth funds complete their takeover of world football. This framework would define physiological data as personal data alienable only with explicit, compensated consent from the athlete. Collective agreements, modeled on the NBA but with explicit biometric protection, would incorporate a right of portability: the athlete could take their data from one club to another, make it available to a new club at the end of contract, withdraw it from commercial analysis. In this scenario, athletes would have real leverage in transfer negotiations.
In the second scenario, consolidation completes first. Contracts already signed, including their implicit rights assignment clauses, become the de facto norm. Data is captured each year by private entities under contracts predating regulation. Retroactive regulation would be politically difficult: the funds in question weigh hundreds of billions of dollars and operate from jurisdictions that do not necessarily recognize European law. It would also be legally fragile: calling into question contracts signed in good faith requires lengthy and uncertain procedures.
The history of digital law argues rather for the second scenario. The GDPR itself took twenty years to move from idea to implementation. American platforms captured billions of users and data before European regulation reached them, and they continue to circumvent its effects via subsidiaries and data transfers to accommodating jurisdictions. The window for preventive regulation of sports physiological data is narrow.
A few signals will allow assessment of which of the two trajectories is emerging. First: the number of jurisdictions that adopt a specific legal definition of athletes’ physiological data, distinct from general data protection law. Currently, few jurisdictions have adopted one. Second: the proportion of transfer contracts between clubs of the same portfolio including an explicit clause for athlete consent on data reuse. Play the Game reports on global sports governance document the evolution of these practices year after year.
FIFPro and the NBA players’ association are the two actors best positioned to push regulation in collective negotiations. UEFA and FIFA each have financial governance frameworks that could be extended to data; UEFA Club Financial Control already oversees financial flows between related clubs, a logic that could apply to data flows. It would be a natural extension, not an institutional rupture. Legal fragmentation in the data economy follows the same fault lines as in other sectors subject to rapid concentration: those who hold data before the rule often define the rule itself.
The potential gains of collective action by athletes
Progress is possible, and some paths do not require international regulation. Players’ unions can act in collective bargaining negotiations at the next cycle. Integrating a clause of shared data ownership between club and athlete, with a right of portability and compensation on commercial reuse, in conventions of the five major European leagues would create a de facto standard that transfer contracts would have to respect.
Several national players’ associations have begun documenting their clubs’ data practices. This mapping work is a prerequisite for any negotiation: you cannot protect what you cannot measure. FIFPro regularly publishes reports on professional players’ working conditions; the logical next step is to integrate an audit of data clauses in standard contracts.
On the sports institutions side, UEFA already has a lever: clubs participating in European competitions are subject to financial governance requirements. Extending these requirements to data practices, requiring a club to disclose how it collects, stores, and transfers its players’ physiological data, would be feasible within the existing regulatory framework. It would not resolve the ownership question, but would create transparency making abuses visible and contestable.
Informed consent remains difficult to obtain given the pronounced power imbalance. A 19-year-old player signing his first professional contract with a Qatari or Saudi club is not in a position to negotiate biometric data protection clauses. Regulation must compensate for this structural imbalance, as it has done, imperfectly but genuinely, for other forms of personal data. Data concentration in private portfolios follows logic similar to that observed in other digital industries: the gains of information asymmetry benefit those who master the infrastructure, not those who make it work with their bodies.
Sources
- Play the Game, Governance Reports 2024-2026
- European Data Protection Board (EDPB), Guidelines on Biometric Data (available at edpb.europa.eu)
- UEFA Club Financial Control, Financial Governance Framework for Clubs (available at uefa.com)
- FIFPro, Annual Reports on Professional Players’ Working Conditions (available at fifpro.org)
- NBA Collective Bargaining Agreement, provisions relating to performance data (available at nbpa.com)
