Athlete Data Checklist: Consent and Collective Agreement Terms, Wearable and Sensor Vendor Rights, League and Competition Data Rules, Medical and Biometric Handling, and Commercial Licensing Controls

By Casey Scott McKay · 2024-12-05

A ten-phase working checklist for athlete data, usable by a club, a league, a sports technology vendor, or an athlete's adviser. Phase one establishes the collective agreement position, which is the operative law in unionised sport. Phases two and three build the data inventory and the separation between clinical and performance records. Phases four and five cover device approval, consent, and the vendor grants that most often exceed what a club can lawfully give. Phase six covers biometric statute compliance, which carries the largest financial exposure in the sector. Phases seven and eight cover commercial supply and the athlete's own rights. Phases nine and ten cover the populations without collective protection and incident response. Each phase ends with a gate.

IP and Technology > Privacy Data Security | Checklist | Published 5 December 2024 - Updated 28 January 2026 | Casey Scott McKay - marksy.us

How to use this checklist

One test governs everything below, and it is worth stating before the items begin.

Would this arrangement survive being described accurately to the athlete being measured? Not in the consent form — out loud, in a sentence, to the person whose body generates the data.

Most arrangements that later become grievances would have failed that test on the day they were signed. Most that pass it turn out to be defensible under every framework in this checklist, because the frameworks are all approximations of the same intuition.

Ten phases, each ending with a gate. Establish first which client is in the chair — a club, a league, a vendor, or an athlete — because the emphasis differs sharply, and whether a collective agreement covers the athletes concerned.

Use alongside Advising a Sports Technology Business or Team and Every Step Recorded. Templates sit in the Sports Technology and Athlete Data Toolkit.

Phase 1 — The collective agreement

[ ] Obtain the current collective bargaining agreement and any side letters.
[ ] Read the data provisions in full rather than relying on a summary.
[ ] Record what may be collected and by which categories of device.
[ ] Record whether participation is voluntary and what anti-retaliation protection applies.
[ ] Record the permitted purposes as a closed list.
[ ] Record whether use in contract negotiation, salary arbitration, or discipline is prohibited.
[ ] Record the permitted access list within the club.
[ ] Record the athlete's own access right and its mechanics.
[ ] Record portability on transfer.
[ ] Record retention periods and deletion obligations on departure.
[ ] Record the commercialisation provisions, including any consent requirement and revenue share.
[ ] Record the joint committee's composition, remit, and process for approving devices.
[ ] Record the grievance procedure and any specified penalties for breach.
[ ] Identify the bargaining round and diary the expiry, since these provisions change.
[ ] Confirm that monitoring is being treated as the mandatory bargaining subject it is under 29 U.S.C. § 158.
[ ] Where no collective agreement exists, record that fact explicitly and treat every downstream item as individually negotiable.

Gate 1. The collective agreement's data provisions are recorded in a one-page summary, the joint committee process is understood, and every subsequent phase is being tested against them rather than against generic privacy standards.

Phase 2 — Data inventory

Streams

[ ] Positional tracking, with sampling rate and derived metrics listed.
[ ] Inertial and load measurement.
[ ] Cardiac monitoring, including heart rate variability and recovery indices.
[ ] Sleep and recovery monitoring, with the collection location recorded.
[ ] Metabolic and biochemical testing.
[ ] Neurocognitive baseline and post-impact assessment.
[ ] Identification biometrics at facilities and venue.
[ ] Video and broadcast footage, and any computer vision derivation from it.
[ ] Any stream collected by a device the athlete owns personally.

Attributes

[ ] Source system and vendor for each.
[ ] Resolution and sampling frequency.
[ ] Storage location, including cloud region.
[ ] Retention setting as configured, not as documented.
[ ] Access list as configured in the system, tested against the policy.
[ ] Onward flows: vendor cloud, league systems, medical providers, insurers, agents, researchers.
[ ] Cross-border transfers and the mechanism relied on for each.
[ ] The collective agreement provision permitting each stream.
[ ] Any stream with no identifiable basis, flagged for cessation.

Assessment

[ ] Record what each stream reveals at its actual resolution rather than what it is called.
[ ] Identify streams that constitute health information regardless of the dashboard label.
[ ] Identify streams that fall within a statutory biometric definition.
[ ] Assess re-identification risk on any dataset described as anonymised, given the small population.
[ ] Produce the inventory as a document that could be shown to a union.

Gate 2. Every stream is inventoried with source, resolution, retention, access, onward flows, and a collective agreement basis; unjustifiable streams have been stopped; and the inventory is presentable.

Phase 3 — Medical and biometric handling

The clinical boundary

[ ] Document the team clinician's role and to whom they owe duties in each capacity.
[ ] Hold the clinical record separately, under clinical control, accessible to treating clinicians and the athlete.
[ ] Hold the performance record separately, without clinical content.
[ ] Write a protocol stating what crosses the boundary — availability status yes, diagnosis no — and who decides.
[ ] Confirm the separation is technical rather than procedural.
[ ] Confirm the medical information is maintained as a confidential record separate from personnel files, as 42 U.S.C. § 12112 requires.
[ ] Confirm medical examinations and inquiries fall within the permitted categories.
[ ] Route agent and insurer requests through the clinician and log each one.
[ ] Where a covered relationship exists, apply the medical privacy rule at 45 C.F.R. § 164.

Genetic firewall

[ ] Confirm no genetic testing is required, requested, or purchased, per 42 U.S.C. § 2000ff.
[ ] Confirm family medical history is not collected, since it is within the statutory definition.
[ ] Close the leak routes: athletes volunteering consumer test results; clinician-ordered tests whose findings reach performance staff; vendor products incorporating genetic markers; academies in permissive jurisdictions.
[ ] Confirm any collective agreement prohibition is reflected in club policy.
[ ] Confirm no injury-prediction analytic incorporates genetic inputs.
[ ] Treat this as a prohibition rather than a risk to be managed.

Injury and health prediction

[ ] Identify every analytic that produces a forecast about an individual's future health.
[ ] Identify who sees the output and what decisions it informs.
[ ] Assess the discrimination exposure where a prediction informs selection, renewal, or compensation.
[ ] Document the athlete's ability to see and challenge the output.

Biometric statute compliance

[ ] Identify every collection point of a statutory biometric identifier — facility access, stadium entry, ticketing, payment, identification cameras.
[ ] Provide written notice of the fact of collection, the specific purpose, and the retention period.
[ ] Obtain a written release before collection.
[ ] Publish a retention and destruction schedule.
[ ] Confirm no sale or profit from the identifiers.
[ ] Confirm reasonable care in storage and transmission.
[ ] Flow every obligation to the technology vendor.
[ ] Provide a non-biometric alternative lane.
[ ] Quantify statutory damages exposure by collection point and volume, noting Rosenbach v. Six Flags Entertainment Corp..
[ ] Analyse per system rather than per programme, since athlete tracking and facial geometry sit differently.
[ ] Work the mechanics through the Biometric Data Checklist.

Gate 3. Clinical and performance records are separated technically, the genetic firewall is absolute, prediction outputs are governed, and every biometric collection point has a compliant written release and published schedule.

Phase 4 — Devices and consent

[ ] Confirm every deployed device is on the approved list.
[ ] Confirm the joint committee approved the specific model and firmware family.
[ ] Confirm approval of a device has not been treated as approval of every use of its output.
[ ] Submit new technologies for approval before deployment, not after.
[ ] Draft the athlete consent as one readable page.
[ ] State what is collected, at what resolution, where, by whom, for what purposes, who can see it, retention, and how to withdraw.
[ ] State the anti-retaliation position explicitly and confirm it is enforced.
[ ] Treat home collection under a separate consent with tighter limits.
[ ] Address capture of family members by home sensors.
[ ] Confirm withdrawal actually stops collection, deletes existing data, and affects derived models — and if it does not, say so.
[ ] Record consent version, date, and what the athlete saw.
[ ] Refresh consent when new technology is introduced mid-contract.
[ ] Confirm consent is separate from the employment contract rather than buried in it.
[ ] Confirm the athlete received a copy.

Gate 4. Every device is approved, consent is readable, separate, versioned, and refreshed, home collection is treated distinctly, and withdrawal has a real effect.

Phase 5 — Vendor and sensor rights

The grant

[ ] Read the data grant before anything else in the agreement.
[ ] Identify any perpetual, irrevocable, or survival language.
[ ] Identify product improvement, research, benchmarking, and model development rights.
[ ] Test each against what the collective agreement permits the club to grant.
[ ] Confirm the club is not purporting to grant rights it does not hold.
[ ] Narrow the grant to an enumerated list with everything else reserved.

Benchmarking

[ ] Define the minimum cohort size for any aggregate output.
[ ] Prohibit outputs attributable to an individual athlete or a single club.
[ ] Require a documented aggregation methodology.
[ ] Reserve an audit right over aggregation practice.
[ ] Require notice before publication of any benchmark study.

Models and derived data

[ ] State expressly who owns models trained on the club's data.
[ ] State whether such models may serve other customers.
[ ] State whether the club receives a licence to models built with its contribution.
[ ] State what happens to models on termination — deletion, aggregation, or continued use.

Controls

[ ] Prohibit onward sale and third-party licensing without express consent.
[ ] Require disclosure and approval of sub-processors, with flow-down.
[ ] Impose security requirements as specific controls rather than a general standard.
[ ] Set breach notification in hours.
[ ] Require support for athlete access requests and deletion on departure.
[ ] Require cooperation and record production for grievances and regulatory enquiries.
[ ] Confirm indemnity and insurance cover athlete medical data exposure.

Exit

[ ] Machine-readable export format, defined and complete.
[ ] Defined timescale for export.
[ ] Deletion of all copies with written certification, including backups.
[ ] Treatment of derived models on exit.
[ ] Transition assistance period at a stated rate.
[ ] Cross-refer to the Data Licensing Checklist.

Gate 5. No vendor grant exceeds what the club may lawfully give, benchmarking is bounded by cohort size and methodology, model ownership is express, and exit terms exist at signature rather than at termination.

Phase 6 — League and competition data rules

[ ] Record the league's data rules and how they bind clubs, athletes, and partners.
[ ] Record who owns or controls the capture technology at the venue.
[ ] Record the official data supply arrangements, their exclusivity, term, and territory.
[ ] Confirm what is actually protected: facts are not, per Feist Publications, Inc. v. Rural Telephone Service Co. and National Basketball Ass'n v. Motorola, Inc..
[ ] Confirm the practical moat is built from venue access control, accreditation terms, ticket conditions, capture control, and exclusive supply.
[ ] Confirm any statutory official data mandate the business relies on, and its durability.
[ ] Record latency and accuracy commitments in supply agreements.
[ ] Record audit rights over the recipient's use.
[ ] Record sub-licensing limits and bet-type scope.
[ ] Record integrity monitoring obligations and the information flows they create.
[ ] Confirm the collective agreement position on player prop markets before agreeing supply.
[ ] Keep tracking-derived market supply separate from event data, since purpose limitations restrict the former.
[ ] Confirm broadcast enhancement licensing is within the consent that permitted collection.
[ ] Address unauthorised collection through venue and accreditation terms, noting the limits of 18 U.S.C. § 1030 after Van Buren v. United States and hiQ Labs, Inc. v. LinkedIn Corp..
[ ] Protect proprietary analytics as trade secret under 18 U.S.C. § 1836 with reasonable measures per Rockwell Graphic Systems, Inc. v. DEV Industries, Inc..
[ ] Confirm the broadcast copyright position under 17 U.S.C. § 102 and 17 U.S.C. § 106.
[ ] Confirm revenue share calculations match the collective agreement and can be evidenced.

Gate 6. The commercial architecture rests on access control and contract rather than on a property claim, prop and tracking-derived supply are consistent with the collective agreement, and revenue share is calculable and evidenced.

Phase 7 — Commercial licensing and likeness

[ ] Identify every product that uses an identifiable athlete: games, fantasy, advertising, trading cards, broadcast graphics, merchandise.
[ ] Confirm name, image, and likeness clearance separately from data rights.
[ ] Confirm the scope of each release: media, territory, term, exclusivity, and approval rights.
[ ] Note that realistic depiction in a game is not protected by a First Amendment defence, per Keller v. Electronic Arts Inc. and Hart v. Electronic Arts, Inc..
[ ] Note the performance appropriation doctrine from Zacchini v. Scripps-Howard Broadcasting Co..
[ ] Screen for false endorsement exposure under 15 U.S.C. § 1125.
[ ] Confirm the state law position for each athlete's domicile, since publicity rights vary.
[ ] Confirm post-mortem treatment where relevant.
[ ] Address digital replicas expressly: whether synthesis is permitted, for which purposes, with per-use approval or a defined scope, for what term, at what compensation, and after death.
[ ] Do not rely on "all media now known or hereafter devised" to cover synthesis; say it or do not do it.
[ ] Work the clearance through the Name, Image, and Likeness Clearance Checklist and Clearing and Licensing Name, Image, and Likeness.
[ ] Confirm sponsorship and event marks are handled under the Event and Sponsorship IP Checklist.

Gate 7. Every likeness use has a clearance separate from the data rights, state law variation is accounted for, and synthesis is addressed expressly in every new agreement.

Phase 8 — The athlete's own rights

[ ] Access to their own data in a usable, machine-readable format on request.
[ ] A defined response time for access requests.
[ ] Portability on departure, with a complete export.
[ ] A prohibition on use in contract negotiation, salary arbitration, or discipline.
[ ] Deletion of physiological data on departure, or a defined retention period.
[ ] Consent required for any commercial licensing identifying them individually.
[ ] A revenue share where their data is commercialised.
[ ] Control over synthesis, expressly stated.
[ ] A route to challenge and correct an inaccurate record.
[ ] Notification where their data is involved in a breach.
[ ] Where no collective agreement applies, confirm these have been raised in individual negotiation rather than assumed.
[ ] For an athlete's adviser: rank the achievable improvements — access, portability, negotiation prohibition, and deletion first.

Gate 8. The athlete can obtain their record, take it with them, prevent its use against them, and control its commercial exploitation — or the adviser has recorded which of these were refused.

Phase 9 — Populations without collective protection

College athletes

[ ] Identify which data may constitute an educational record and the access rights that follow.
[ ] Confirm whether performance data falls within the athlete's name, image, and likeness rights.
[ ] Adopt professional-standard protections voluntarily rather than litigating the question.
[ ] Confirm the institution's consent architecture is separate from the scholarship agreement.

Academy and youth athletes

[ ] Obtain parental consent in the form the jurisdiction requires.
[ ] Apply children's privacy rules where collection occurs through an online service.
[ ] Set a materially shorter retention period than for professionals.
[ ] Delete on departure by default rather than on request.
[ ] Confirm no genetic or predictive profiling of minors.
[ ] Confirm the record created at twelve does not follow the athlete for life.

Non-unionised professional sport

[ ] Treat the standard contract as a starting position, not market practice.
[ ] Negotiate the phase eight items individually.

International and Olympic

[ ] Map anti-doping data flows: whereabouts, samples, therapeutic use exemptions.
[ ] Identify the testing authority, international federation, national body, and event organiser, and the transfers between them.
[ ] Identify the transfer mechanism relied on for each cross-border flow.
[ ] Confirm international federation rules that bind by participation rather than by contract.
[ ] Record where the athlete's rights differ by jurisdiction of play.

Gate 9. The unprotected populations have been identified, minors are handled more strictly than professionals, and every cross-border flow has an identified mechanism.

Phase 10 — Incident response and governance

Before an incident

[ ] Build the notification matrix: state breach statutes, contractual clocks, the collective agreement obligation, insurers, regulators, and any international regime.
[ ] Record each recipient's threshold and clock.
[ ] Identify who decides that a threshold is met.
[ ] Confirm the union is treated as an immediate stakeholder rather than a party to be informed later.
[ ] Confirm counsel is engaged early enough for privilege to attach to the investigation.
[ ] Confirm forensic capability is retained in advance.
[ ] Rehearse once with the people who would actually run it, per Running a Data Breach Response.

During

[ ] Preserve before remediating.
[ ] Determine what categories were affected, since medical and biometric categories change the obligations.
[ ] Determine whether minors or international athletes are affected.
[ ] Notify on the shortest applicable clock rather than the most convenient.
[ ] Prepare for the reputational dimension, which will dominate.

Governance, ongoing

[ ] Name an owner for athlete data governance with authority to stop a deployment.
[ ] Put legal in the technology procurement path, without exception.
[ ] Review access lists quarterly against actual system permissions.
[ ] Review vendor grants annually against the current collective agreement.
[ ] Review the device list against what is actually deployed.
[ ] Train performance and medical staff annually, in person.
[ ] Consult the union before deploying rather than explaining afterwards.
[ ] Ask the athletes once a year what they object to, without their agents in the room.

Gate 10. The notification matrix exists and has been rehearsed, governance has a named owner, legal sits in the procurement path, and the access, vendor, and device reviews are diarised.

Failures that recur

[ ] A technology contract signed without legal review, granting rights the club could not lawfully give.
[ ] Access lists wider in the system than on paper, with employment decision-makers able to see physiological data.
[ ] Medical and performance records in one system, defeating the statutory separation.
[ ] Consent obtained once at signing, never refreshed for technology introduced later.
[ ] Home collection treated identically to training-ground collection.
[ ] Biometric deployment at the venue with no written release — the largest single financial exposure in the sector, and it usually concerns spectators.
[ ] Genetic information reaching a decision-maker through a volunteered consumer test or a clinician's finding.
[ ] Vendor de-identification accepted at face value across a population of a few hundred professionals.
[ ] No exit terms, discovered at supplier change.
[ ] Prop market supply agreed without checking the collective agreement.
[ ] A likeness grant read to permit synthesis, litigated a decade after drafting.
[ ] Youth data retained on the professional schedule.

Client-type variations

The ten phases hold, but the weight shifts sharply with who is in the chair. Run the relevant column rather than the whole matrix.

A club or team

[ ] Weight phases one, three, and five heaviest: the collective agreement, the medical boundary, and the vendor grants.
[ ] Confirm no employment decision-maker can see granular physiological or medical data.
[ ] Confirm every technology contract passed through legal.
[ ] Confirm the biometric position at the training facility as well as the stadium.
[ ] Confirm the club can produce its inventory to a union on request.

A league

[ ] Weight phases six and seven heaviest: commercial supply and likeness.
[ ] Confirm every commercial arrangement is consistent with the agreement the league itself negotiated.
[ ] Confirm the revenue share calculation can be evidenced to the union.
[ ] Confirm prop and tracking-derived market supply have an explicit basis.
[ ] Confirm integrity monitoring flows are documented and proportionate.
[ ] Confirm club-level compliance is monitored rather than assumed.

A sports technology vendor

[ ] Weight phase five heaviest, from the other side: what can be conceded and at what price.
[ ] Recognise that a grant exceeding the customer's authority is a liability, not an asset.
[ ] Build a bounded aggregation right with published methodology as a selling point.
[ ] Confirm the product supports the customer's separation, access, and deletion obligations.
[ ] Confirm biometric obligations are accepted where the product collects identifiers.
[ ] Confirm the product does not incorporate genetic markers where the customer is an employer.

An athlete or their adviser

[ ] Weight phase eight heaviest, then phase seven.
[ ] Establish whether a collective agreement applies, since it changes everything.
[ ] Rank the achievable improvements: access, portability, negotiation prohibition, deletion, consent to commercialisation, revenue share, synthesis control.
[ ] Ask what the club already collects and who sees it, in writing.
[ ] Ask which vendors hold the data and on what terms.
[ ] Address synthesis expressly rather than relying on the club's standard grant.

An institution with college or academy athletes

[ ] Weight phase nine heaviest.
[ ] Adopt professional-standard protections voluntarily.
[ ] Confirm consent is separate from the scholarship or academy agreement.
[ ] Confirm minors are handled more strictly, with default deletion on departure.

Sport-by-sport variations

[ ] Team sports with strong unions. Expect detailed device approval, access restriction, and commercialisation provisions. The joint committee is the real forum and the grievance procedure is the real remedy. Consult before deploying.
[ ] Individual sports. No collective agreement. Sponsors, equipment suppliers, national bodies, and international federations all assert overlapping data rights. Map who has claimed what before negotiating anything.
[ ] Motorsport. Telemetry is the sport. Technical regulations control what may be collected and transmitted. Inter-team confidentiality is intense and the trade secret analysis carries most of the weight.
[ ] Cycling and endurance. Athletes publish power and physiological data voluntarily on consumer platforms, which complicates any claim that the same data is confidential in a team's hands. Address the tension in the athlete agreement.
[ ] Combat sports. Weight management and medical clearance data is safety-critical and supervised by athletic commissions, adding a public regulator to the analysis.
[ ] Esports. Player biometrics, gameplay telemetry, and streaming data combine with publisher licence terms controlling everything downstream. Work the Esports and Streaming Checklist.
[ ] Consumer fitness. The same sensors sold to the public under terms of service rather than collective agreements. The data is frequently more intimate and the protections are weaker. Cross-refer to the Fitness and Wellness IP Checklist.
[ ] Officiating and match officials. Frequently instrumented alongside athletes and almost never covered by the athlete framework. Confirm which agreement applies to them.

Documents that must exist

For each: does it exist, where does it live, who owns it, and can it be produced within three working days?

[ ] The current collective agreement and its data provision summary.
[ ] The joint committee's approved device list, current.
[ ] The data inventory with basis per stream.
[ ] Access lists as configured, with the last audit date.
[ ] The medical boundary protocol, signed by the clinicians.
[ ] The genetic firewall policy and its leak-route assessment.
[ ] Biometric written releases, by collection point.
[ ] The published biometric retention and destruction schedule.
[ ] Athlete consent forms, versioned and dated, with distribution records.
[ ] Separate home-collection consents.
[ ] Every technology and analytics contract, with the data grant flagged.
[ ] The comparison of each grant against the collective agreement.
[ ] Benchmarking methodology documents and audit records.
[ ] Model ownership and termination terms.
[ ] Exit terms with export format and deletion certification.
[ ] Official data supply agreements with latency, audit, and scope terms.
[ ] Prop and tracking-derived market consent basis.
[ ] Likeness clearance files per commercial use.
[ ] Synthesis clauses in current agreements.
[ ] Athlete access request log and response times.
[ ] Portability exports issued on departure.
[ ] Deletion certifications on departure.
[ ] Parental consents and minor retention schedules.
[ ] Cross-border transfer mechanisms per flow.
[ ] Anti-doping data flow map.
[ ] The breach notification matrix and the rehearsal record.
[ ] Insurance policy confirming athlete medical data cover.
[ ] Union consultation records for each deployment.

A ninety-day start

For an organisation with no governance in place, sequenced so each fortnight produces something durable.

[ ] Weeks 1–2. Obtain the collective agreement and summarise its data provisions on one page. Identify the joint committee process. Name an owner for athlete data governance and put legal into the technology procurement path from day one.
[ ] Weeks 3–4. Build the inventory. Expect to find at least one stream nobody can justify; stop it.
[ ] Weeks 5–6. Audit access lists against actual system permissions rather than policy. Remove employment decision-makers from granular data. Implement the separation technically.
[ ] Weeks 7–8. Compare every technology contract's data grant against what the collective agreement permits. Rank by breadth of grant. Open renegotiation on the two worst.
[ ] Weeks 9–10. Audit biometric collection points across facility and venue. Remediate written releases and publish the retention schedule. This is usually the largest financial exposure and it is fixable in weeks.
[ ] Weeks 11–12. Write the medical boundary protocol with the clinicians. Reissue athlete consent in plain language. Build the breach notification matrix and rehearse once.
[ ] Throughout. Add an express synthesis clause to every new agreement from week one. Consult the union before any new deployment. Ask the athletes, once, what they object to.

The three-day test

The quickest diagnostic on any athlete data programme takes three days. Choose one deployed technology and ask for six documents: the joint committee approval for the device, the athlete consent in the version actually signed, the data grant in the vendor contract, the collective agreement provision that permitted that grant, the access list as configured in the system, and the deletion certification for the last athlete who departed.

A programme that produces all six is genuinely in order and will survive a grievance. A programme that produces three is the ordinary case and has a year of unglamorous work ahead. A programme that produces one has a policy rather than a practice, and the gap will surface in a grievance, a class action over a stadium turnstile, or a diligence report — none of which is a good moment to discover it.

A closing note

Every item in this checklist reduces to one relationship: an employer measuring an employee's body, in circumstances where the employer's decisions about that employee are worth a great deal and are made without explanation.

No general body of law was designed for that. What protects the athlete is a collectively bargained agreement, which exists because the athletes concerned had leverage that almost no other measured workforce possesses. Below that level the measurement continues and the protection thins, which means the least protected people in the sector are the youngest.

The technology will keep improving, computer vision will make the wearable optional, and the device-based consent architecture that all of this depends on will look dated within a decade. What will not change is the test at the top of this checklist. Ask it before each deployment, answer it honestly, and most of the rest of the work becomes straightforward.

The consent form, item by item

Where a form has to be drafted from scratch, this is the content that a union, a regulator, and an athlete will each look for.

[ ] A heading that says what it is — not "Player Technology Acknowledgement" but "Consent to Collection of Your Physical and Performance Data".
[ ] What is collected, by category, in ordinary words: where you are on the pitch, how hard you accelerate, your heart rate, how you slept.
[ ] How often, expressed usefully: "about ninety times a minute" rather than "at 1.5 Hz".
[ ] Where, distinguishing training ground, match, and home.
[ ] By which device, named, with a note that it is on the approved list.
[ ] Why, as a closed list of purposes.
[ ] Who can see it, by role, with an express statement of who cannot — coaching staff, the general manager, the commercial department.
[ ] Whether it can be used in contract talks, stated plainly either way.
[ ] Which vendor holds it, named, with a one-line description of what they may do with it.
[ ] How long it is kept, and what happens when you leave.
[ ] How to see your own data, with a route and a response time.
[ ] How to say no, with an express statement that declining carries no consequence.
[ ] How to withdraw later, and what withdrawal does and does not undo.
[ ] Who to ask, with a name and contact details.
[ ] A version number and date, so a later dispute can identify what was signed.
[ ] A copy given to the athlete, recorded.

If the form runs past one page, something in it is doing work that belongs in a policy rather than in a consent.

One paragraph for the file

Athlete data is governed by the collective agreement first and by privacy statute second; biometric statutes bite hardest at the stadium gate, where the exposure is measured by attendance; genetic screening is prohibited rather than merely risky; competition data is protected by venue access and contract rather than by any property right; and the vendor's standard data grant is the most likely single source of a breach of obligations the club intended to honour. Separate the clinical record from the performance record technically, keep both away from the people who decide contracts, address synthesis expressly in every new agreement, and treat minors more strictly than professionals.

Officials, staff, and everyone else on the pitch

A short addendum, because the athlete framework routinely omits the other measured people.

[ ] Match officials are frequently instrumented alongside players — position, distance, decision timing — under no agreement that mentions them. Identify which contract or appointment terms apply and whether any consent exists.
[ ] Coaching and performance staff wear devices in some programmes, and are employees whose data attracts the same employment constraints without the collective protection.
[ ] Medical staff generate records about themselves incidentally through facility access systems.
[ ] Academy and trial participants are measured before any contract exists at all, sometimes on a single day, and the resulting record is rarely deleted.
[ ] Spectators are the largest measured population at any venue, through entry systems, ticketing, payment, and cameras — and are the group most likely to produce a statutory class action.
[ ] Contractors and matchday staff pass through the same biometric access systems as employees with none of the accompanying paperwork.

The compliance answer is the same in each case: identify the population, identify the instrument that covers them, and where none exists, either stop the collection or create one.

Key Authorities at a Glance

Employment and bargaining. 29 U.S.C. § 158 makes monitoring a mandatory bargaining subject. 42 U.S.C. § 12112 constrains medical examinations and inquiries and requires separate confidential records. 42 U.S.C. § 2000ff prohibits requesting, requiring, or purchasing genetic information including family medical history.

Privacy and biometrics. State biometric statutes require written notice and release before collection, impose retention limits, prohibit sale, and provide a private right of action; Rosenbach v. Six Flags Entertainment Corp. holds a technical violation sufficient. The medical privacy rule sits at 45 C.F.R. § 164. Deceptive practices enforcement runs under 15 U.S.C. § 45.

Data and competition. Feist Publications, Inc. v. Rural Telephone Service Co.; National Basketball Ass'n v. Motorola, Inc.; 18 U.S.C. § 1030 with Van Buren v. United States and hiQ Labs, Inc. v. LinkedIn Corp.; 17 U.S.C. § 102 and 17 U.S.C. § 106 for broadcast.

Publicity and likeness. Zacchini v. Scripps-Howard Broadcasting Co.; Keller v. Electronic Arts Inc.; Hart v. Electronic Arts, Inc.; 15 U.S.C. § 1125.

Trade secret. 18 U.S.C. § 1836; Rockwell Graphic Systems, Inc. v. DEV Industries, Inc..

| Phase | Authority | Record that proves it | | --- | --- | --- | | 1 Collective agreement | 29 U.S.C. § 158 | One-page provision summary | | 2 Inventory | Collective agreement | Stream map with basis per flow | | 3 Medical | 42 U.S.C. § 12112 | Separation protocol and system evidence | | 3 Genetics | 42 U.S.C. § 2000ff | Firewall policy and leak-route closure | | 3 Biometrics | Rosenbach | Written releases and published schedule | | 4 Devices | Approved device list | Committee approval per model | | 5 Vendors | Collective agreement | Narrowed grant with audit right | | 6 Competition data | Feist | Access control and supply contracts | | 7 Likeness | Keller; Hart | Clearance file per use | | 8 Athlete rights | Contract | Access log and portability export | | 9 Minors | Children's privacy rules | Parental consent and short retention | | 10 Incident | State breach statutes | Rehearsed notification matrix |