The Data Left Behind: Players’ Performance Data And The Rights To Access And Portability On Transfer

This article was published in LawInSport on September 11, 2026.

Summary

Football clubs collect vast amounts of biometric performance data on players (heart rate, GPS, sprint speed, sleep and recovery metrics), yet when a player transfers, this valuable dataset typically stays with the selling club rather than moving with them. Performance data qualifies as personal data under the GDPR, and often as special category health data under Article 9, which complicates portability: clubs usually process it on employment-law or occupational-medicine grounds, not on consent or contract, the two lawful bases that trigger Article 20 portability. However, the position is nuanced, since many clubs incorporate wearable monitoring as a contractual obligation in the playing contract, which would engage in Article 20; clubs should therefore audit their actual lawful basis.