"In an age where information technology governs virtually every aspect of our lives, the task before the Court is to impart constitutional meaning to individual liberty in an interconnected world." — Justice K S Puttaswamy (Retd.), and Anr. versus Union of India and Ors.

Introduction

The issue of privacy rights of sports personalities has always been a contentious one. Privacy invasions, generally unjustified and excessive are carried out across the world often under the garb of ‘news’ serving the commercial interest of media houses, encouraged by audiences’ curiosity which eventually sets the standards for public acceptability. The Hon’ble Supreme Court of India in Justice K S Puttaswamy (Retd.), and Anr. versus Union of India and Ors., (“Puttaswamy Judgment”) which declared privacy as a fundamental right under part III of the Indian Constitution, referred to an article published on 15 December 1890 in the Harvard Law Review which still holds for the impact of technology on the right to be let alone. The relevant part is produced hereunder as follow:

“Recent inventions and business methods call attention to the next step which must be taken for the protection of the person, and for securing to the individual what Judge Cooley calls the right “to be let alone”. Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life; and numerous mechanical devices threaten to make good the prediction that “what is whispered in the closet shall be proclaimed from the house-tops.”

As mentioned above, the private life of a sports personality is often laden with myriad commercial and public scrutiny. As a result, the privacy of a sports personality is frequently compromised.

Technology has become all-pervasive to make people’s lives easier, however, this convenience comes at a cost i.e. privacy. Wearables are devices that can be worn. Wearable devices have lately become an important part of sports personalities’ lives, supporting them with various parameters they are designed to control. There is a rapid increase in the wearable device and technology market day by day which will take the number of connected wearable devices worldwide to over 1.1 Billion by 2022.

Increase in the number of such devices increases the data points resulting in large scale accumulation of information which is vulnerable to newer forms of attacks. The increasing trend of using wearable devices by the sports personalities puts their privacy in a rather sorry state. The infamous alleged use of biometric trackers by NBA player DeAndre Jordan brought into limelight the issue of privacy and related consequences. Moreover, National Football League Players Association (“NFLPA”), a major player’s association for the very first time in the history of professional sports, associated itself with a wearable technology company, ‘WHOOP’ providing NFL players easy access to, ownership of, and the option to commercialize their health data. As a result, several issues surrounding privacy have arisen including the use of such devices by sports personalities.

Privacy Implications Of Using Wearable Devices And Biometric Trackers

Privacy Implications Of Using Wearable Devices And Biometric Trackers (Image: vpnoverview.com)

Biometric data, in simple terms, are data of or related to a biological organism.Such data reveals much more than merely identifying an individual, as a result, they are termed as Sensitive Personal Data. These devices and trackers are used to analyse the performance of a player. They can collect and analyse wealth of data viz. athlete’s heart rate, the level of glucose, gait, breathing, fatigue or strain etc. These data are collected to plan and analyse the performance of players accordingly. The collection of these data using technology has become a crucial part of athletes lives which keeps them in their desired shape. However, breach of any of these data exposes them to public raising questions of using the negative data received from such wearables and trackers against the players itself during contract negotiation. The data generated by these devices can be commercially and publicly used by broadcasting for fans over television or social media. The same can also be used for several monetary purposes by providing products and services: for augmented reality and virtual games, fantasy sports, mobile apps, use by social media companies, betting and for engagement of fans in the stadium and similar experiences etc.

Moreover, the privacy implications also pose peculiar problems such as negative consequences of finding out that a particular player is not good at recovering from any injury from sports which as a result, could severely impact his market price. What is paramount is the fact that as a result of the use of such devices it creates a situation where some stakeholders have access to such data while some do not which creates a non-level playing field.

Furthermore, the other major problem is the unfair advantage created by other teams by gaining illicit access to any insider knowledge about the opposing teams in the transfer market. Lastly, it also raises several questions about whereabouts of the data collected such how and where the data is stored, in what circumstances it will be used and disclosed, who all have access to it and the safeguards put in place to ensure its protection.

How Does Indian Data Protection Framework Resolve Privacy Concerns Under Sports?

How Does Indian Data Protection Framework Resolve Privacy Concerns Under Sports? (Image: financialexpress.com)

India currently lacks any robust data protection framework. The current law which governs such issues is the Information Technology Act, 2000 (“IT Act”). The IT Act, however, is not well equipped to deal with newer challenges created by new technologies, as a result, it creates a void. The Hon’ble Supreme Court of India under Puttaswamy Judgment observed that there is a need to examine and put into place a robust regime for data protection. Finally, the Government of India after the recommendations from the expert committee under the chairmanship of Retd. Justice B N Srikrishna introduced the Personal Data Protection Bill, 2019 (“2019 Bill”) to create a robust data protection framework and fill the void created by the IT Act.

2019 Bill And Privacy Under Sports

2019 Bill And Privacy Under Sports (Image: parliament.uk)

The 2019 Bill is a landmark beginning to protect individual autonomy and informational privacy. Though the Bill is completely lopsided towards government by providing excessive powers in the hands of government to bypass the provisions of the Bill, it is indeed a good start to establish a robust data protection framework. The Bill defines three types of data which are Personal Data (“PD”), Sensitive Personal Data (“SPD”) and Critical Personal Data (“CPD”). PD is defined as relating to a natural person who is directly or indirectly identifiable. The SPD includes (i) financial data; (ii) health data; (iii) official identifier; (iv) sex life; (v) sexual orientation; (vi) biometric data; (vii) genetic data; (viii) transgender status; (ix) intersex status; (x) caste or tribe; (xi) religious or political belief or affiliation etc. The CPD is defined as any data which may be notified by the Government from time to time. Now the data collected by the wearables and tackers will be categorised as per the above-mentioned categories of data. As a result, the health data of sports personalities will be considered as an SPD and the provisions governing SPD will apply on the same.

As per the 2019 Bill, a data principal is one to which the personal data relates. A data fiduciary is one who determines the purpose and means of processing of personal data while a data processor is one who processes personal data on behalf of a data fiduciary. A sports personality whose data is being collected will be considered as a data principal and any sports team or organization which collects such data will be considered as data fiduciaries in the 2019 Bill.

Moreover, one of the significant provisions of the 2019 Bill includes “explicit consent requirement”. As per Section 11, consent of any sports personality will not be valid unless such consent is free, informed, specific, clear, and capable of being withdrawn. Thus, it puts a positive obligation on the part of any sports organization, team or club in India which is collecting personal data of its players to adhere to the explicit consent requirement.

The 2019 Bill also provides a mechanism for processing of personal data without the consent requirement. However, it is pertinent to mention that the significant amount of personal data is required for sports integrity and anti-doping functions which is bound to raise several issues concerning privacy. Sensing the same, the recital 112 of the General Data Protection Rights expressly included the use of personal data for eliminating doping under sports as one of the derogation for public interest, unlike the 2019 Bill.

Further, the 2019 Bill also provides certain crucial rights to a sports player as a data principal which he can exercise to protect and decide how his data should be used. These rights include (i) Right to confirmation and access of personal data and its summary thereof;(ii) the right to correction and erasure of any inaccurate and misleading data including the erasure of any data which is no longer necessary for the purpose for which it was processed etc. For an instance, if an organization or club requires its players to use wearable devices or biometric trackers for the limited purpose of training session and analysis thereof, then the player has the right to get his SPD deleted once that purpose is achieved; (iii) the Right to data portability; and (iv) the Right to be forgotten which restricts and prevents the continuing disclosure of the personal data.

Apart from the transparency, compliances and accountability measures that a sports organization or club or team is bound to follow, the 2019 Bill also provides for actions to be taken by the Data Protection Authority for violation of any provision thereto. As a result, a sports player can certainly approach the authority for any action of the club or organization or team which violates the provisions of the Bill.

Conclusion

The recognition of privacy as a fundamental right under the Constitution of India as well as the introduction of the Personal Data Protection Bill, 2019 will significantly change the way privacy was being regulated over the years. However, due to the rapid increase in the technological advancements and as a result, the increasing use of wearable and trackers under sports will certainly pose unique challenges in identifying and resolving privacy concerns arising out of the same. Hopefully, the 2019 Bill will act as a fundamental instrument in protecting privacy under sports.

Also Read: The menace of age fraud in Indian sports and how it can be checked

Also Read: Who governs sports in India and what’s its legal status?