Data Privacy in Sports: Key Takeaways

Sports teams, leagues, agents and venues collecting personal information from athletes, fans and sponsors must comply with evolving privacy regulations. Here are key takeaways from a conversation Orrick recently hosted with the New York City Bar Association Sports Law Committee and IP Subcommittee.

1. Sports teams must navigate overlapping privacy regimes. Sports teams must navigate a complex network of privacy laws that govern athlete health data, which may include heightened protection under the Health Insurance Portability and Accountability Act (HIPAA) and state laws. Oftentimes, though, the health data is released to the team pursuant to a HIPAA authorization (i.e., with player consent), allowing the team to treat such data as part of the player’s employment record. Of course, an employee’s health information is subject to the ADA’s confidentiality provisions and potentially governed by the state’s breach notification law.
   
   
2. The rise of biometric data brings new risks. From heart rate monitors to biometric gloves that measure blood oxygen levels, teams are using increasingly sophisticated tools to measure biometric information, analyze performance, and monitor athlete health. Simultaneously, state regulators are increasingly concerned about biometric data privacy, and state laws that grant private rights of action present significant risk for this type of sensitive information.
   
   
3. The modern fan experience is data-driven. Stadiums employ cutting-edge technologies that gather a significant amount of fan data. While facial recognition and fingerprint scanning streamline stadium entry and AI is being used to promote stadium safety, they also raise concerns about transparency. Stadium operators need to consider the need for appropriate signage and other disclosures.
   
   
4. An international fanbase leads to cross-jurisdictional concerns. Many teams are playing overseas and expanding their international footprint. This expansion may bring the teams under the jurisdiction of international privacy regimes, which may impose additional requirements on collecting, storing and securing personal information. Sports organizations should be thoughtful in how they engage and market to international audiences.
   
   
5. Emerging technologies and trends will mean even more privacy and cybersecurity risk. Current trends suggest that sports organizations’ privacy challenges will continue to increase. Innovative technologies, like brain health and function tracking, are introducing new privacy concerns, and some states have already identified neurological data for special protection. Mandatory genetic testing, under consideration by several sports governing bodies, would add genetic data to the list of athlete information organizations must manage. With cyberattacks occurring at a greater frequency and level of sophistication each year, organizations should maintain robust privacy and cybersecurity programs to ensure that their teams can minimize risk while remaining ready to rapidly adopt new technologies.