Tracking U.S. Professional Athletes: The Ethics of Biometric Technologies

Abstract

Professional sport in the United States has widely adopted biometric technologies, dramatically expanding the monitoring of players’ biodata. These technologies have the potential to prevent injuries, improve performance, and extend athletes’ careers; they also risk compromising players’ privacy and autonomy, the confidentiality of their data, and their careers. The use of these technologies in professional sport and the consumer sector remains largely unregulated and unexamined. We seek to provide guidance for their adoption by examining five areas of concern: (1) validity and interpretation of data; (2) increased surveillance and threats to privacy; (3) risks to confidentiality and concerns regarding data security; (4) conflicts of interest; and (5) coercion. Our analysis uses professional sport as a case study; however, these concerns extend to other domains where their use is expanding, including the consumer sector, collegiate and high school sport, the military, and commercial sectors where monitoring employees is viewed as useful for safety or to maximize labor potential.

Keywords:

• confidentiality and privacy
• conflict of interest
• informed consent
• professional–patient relationship
• risk/benefit analysis

ACKNOWLEDGMENTS

We owe a huge debt of gratitude to the sport scientists, trainers, coaches, team lawyers, company employees, and players who agreed to speak on the condition of anonymity. We are grateful to Roger Noll, Christine Sublett, Henry Greely, Gary McCoy, Euan Ashley, Leslie Saxon, Jay Porterfield, Brandon Marcello, Lesley Moser, John Protevi, and the anonymous reviewers for their valuable insights. Alexis Garduno provided excellent research assistance.

Notes

1. Estimates of the financial loss due to injury is exceedingly complex. These calculations, which were derived by multiplying the number of games lost to injury by the player's salary per game, are illustrative of potential losses due to injury, but they are far from comprehensive enough to be taken at face value.

2. Although these technologies are also in use by women's teams and individual women athletes internationally, their use in the United States is more prevalent in the heavily financed world of men's professional sport. We imagine they will become more widely adopted by women's teams in the near future and will raise concerns specific to women athletes, the most obvious of which is the ability for such technologies to detect pregnancy.

3. The privacy policy indicates all data are stored on servers in the European Union. Under the section “How Do We Keep Your Data Safe,” there is very little in the way of specific controls, including whether the data are encrypted at rest, referring to data in persistent storage.

4. The U.S. Privacy Act of 1974 has embedded in it a code of fair information practices, which provides a privacy framework and safeguard requirements for automated personal data, but it directly applies to federal executive branch agencies. Moreover, the act's “imprecise language, limited legislative history, and somewhat outdated regulatory guidelines” make it difficult to interpret and apply (Department of Justice 2015).The Organization for Economic Cooperation and Development (OECD), an international forum for countries to work together to solve global problems, adopted privacy guidelines in the 1980s with the goals of integrating data security across the spectrum of government and business usage of personal data, as well as online usage of such data (OECD 1980). The OECD principles are closely tied to the European Union legislation as contained in the Data Protection Directive 95/46/EC, where “personal data” is framed broadly as “any information relating to an identified or identifiable individual.” In 2013 the European Commission announced new data protection regulations to address how mobile apps should comply with EU data protection law, which is part of the EU privacy and human rights law.

5. For a good discussion see Andrew Flatt: https://www.freelapusa.com/interpreting-hrv-trends-in-athletes-high-isnt-always-good-and-low-isnt-always-bad/

6. This is a particular risk during software or firmware updates—a player would likely not know that the scope of collection had changed.

7. The NBA CBA, Section 3: Disclosure of Medical or Health Information, states:

(a) A Team physician may disclose all relevant medical information concerning a player to (i) the General Manager, coaches, and trainers of the Team by which such player is employed, (ii) any entity from which any such Team seeks to procure, or has procured, an insurance policy covering such player's life or any disability, injury or illness such player may suffer or sustain, and (iii) subject to the terms of Section 3(d) below, the media or public on behalf of the Team.

Sections 3(d) and (e) of the NBA CBA reads as follows:

(d) Subject to Section 3(e) below, each Team may make public medical information relating to the players in its employ, provided that such information relates solely to the reasons why any such player has not been or is not rendering services as a player.

(e) A player or his immediate family (where appropriate) shall have the right to approve the terms and timing of any public release of medical information relating to any injuries or illnesses suffered by that player that are potentially life- or career-threatening, or that do not arise from the player's participation in NBA games or practices.

8. Microsoft has developed a Data Governance for Privacy, Confidentiality and Regulatory Compliance (DGPC) framework that may serve as a model.