Who Owns an Athlete's Data?

A club buys a monitoring system to answer performance questions. Within a season or two it discovers it has also acquired a data-governance problem: a longitudinal, health-adjacent record of identifiable individuals, held in a third-party system, of interest to the athlete, their representation, the league, prospective employers and insurers.

This note sets out the questions we think every club should be able to answer before deployment, and how we have designed around them. It is written from the perspective of a vendor with an obvious interest, so read it accordingly — but the questions are the right ones regardless of who you buy from.

The legal frame, briefly

Under the GDPR and the UK equivalent, most athlete monitoring data is personal data, and a meaningful portion of it — heart rate, HRV, injury status, anything from which health can be inferred — falls into the special category that attracts additional protection under Article 9. In the United States the picture is more fragmented: HIPAA applies to covered entities and their business associates rather than to employers generally, so a club's monitoring programme may sit outside it entirely while the club's medical provider sits inside it. State privacy statutes are adding requirements on top.

Practically, this means a club cannot rely on athlete consent as its only footing. Consent obtained from an employee by an employer is of questionable freeness — the power imbalance is exactly the situation regulators are sceptical about — and consent that can be withdrawn is a fragile basis for a system the club depends on. Most clubs end up relying on a combination of contractual necessity, legitimate interests with a documented balancing assessment, and explicit consent for the specific processing that genuinely warrants it, such as broadcasting an athlete's heart rate.

Six questions to settle before deployment

1. Who is the controller? In almost every club deployment the club is the data controller and the vendor is a processor acting on documented instructions. If a vendor's terms let them use your athletes' data for their own product development or commercial purposes, they are acting as a controller too, and you have a materially different arrangement than you think.
2. What may each role see? Coaching, S&C, medical, analysis and academy staff should not have identical visibility. Medical notes in particular should not be visible to selection decision-makers, and that separation has to be enforced technically rather than by convention.
3. Where does the data live? Regional residency is a contractual choice with real consequences for transfer mechanisms. If your vendor cannot tell you which jurisdiction holds the primary and backup copies, you cannot complete a transfer impact assessment.
4. What happens when the athlete transfers? The most under-specified moment in the whole lifecycle. Does the record go with the athlete? Is it shared with the receiving club? Is it retained by the selling club, and on what basis?
5. What happens at retirement or release? A retention period has to exist, be documented, and be enforced automatically. “We keep it indefinitely in case it is useful” is not a retention policy.
6. Can the athlete get a copy? In a format they or their next employer's staff can actually use, within the statutory window, without it being a manual project for your analyst.

Transfer: the hard one

An athlete moves clubs. Their four-year monitoring history contains information both clubs value: baseline outputs, injury history, individual load tolerances, response patterns. The selling club has commercial reasons to keep it, the buying club has performance reasons to want it, and the athlete has an interest in the parts that describe their own body.

Our view is that the athlete's own record should follow the athlete, as an export they can take and provide, while the club's derived analysis — comparisons against squad, tactical context, internal notes — is the club's. That distinction is not always clean, and it is a matter for the athlete's contract and the league's regulations rather than for a vendor to decide unilaterally. What a vendor can do is make the export technically trivial so the negotiation is about principle rather than feasibility.

Collective bargaining is catching up

Player associations across several major sports have taken increasingly firm positions on wearable data: limits on mandatory participation, restrictions on the use of monitoring data in contract negotiations, and requirements around retention and access. Clubs deploying monitoring systems should assume this direction of travel continues and design for a future where athletes have more control rather than less. A system that makes granular consent and clean deletion difficult is a system that will need replacing.

What we do

• The club is the controller; we are a processor and our terms say so. We do not use client data for our own product development, aggregate benchmarking or commercial purposes.
• Role-scoped access is enforced server-side and configurable per field, with medical fields separated from performance fields by default.
• Data residency in an EU, US or Australian tenancy, selected at contract, with backup residency in the same region.
• Encryption with AES-256 at rest and TLS 1.3 in transit, plus field-level encryption for health-adjacent data.
• An exportable audit log of access to individual athlete records — the answer to “who has been looking at my data”.
• One-click per-athlete export in open formats, and a documented erasure process that removes the record from primary storage and backups within the stated window.
• Per-field, per-athlete consent for anything that leaves the club, enforced at the publisher — see live broadcast data feeds for how that works in practice.

The underlying position

An athlete monitoring programme is a relationship with the people being monitored, and relationships survive on the terms being clear before anything goes wrong. Clubs that write a plain-language data pack for their squad, explain what is collected and why, and can demonstrate the controls, encounter far less resistance than clubs that treat monitoring as a condition of employment and explain nothing.

That is not primarily a legal argument. It is a practical one: compliance with a monitoring programme is voluntary in every way that matters, and athletes who understand and trust the arrangement produce better data than athletes who do not.