Back of the net for FIFA

The Court of Arbitration for Sport (CAS) has upheld FIFA’s new football agent regulations and dismissed a legal claim (arbitration) brought by the Professional Football Agents Association (PROFAA).

PROFAA is an organisation that represents football agents worldwide.

The FIFA Football Agents Regulations (FFAR) were approved back in December 2022, and amongst other things, the FFAR re-introduces the agent’s examination and limits agents’ commissions known as a service fee cap.

The proceedings themselves were quite complex in that they considered the General Data Protection Regulation (GDPR) Swiss Competition Law, EU Competition Law, Italian Law and French Law. This blog will focus exclusively on privacy and data protection.

It is worth noting from the outset that Article 15 of FFAR introduces a service fee cap. In other words, agent’s fees will be limited / capped in relation to the commissions that they receive for example when a player is transferred to a new club.

Article 19 FFAR outlines the data that FIFA will make available:

a) the names and details of all Football Agents;

b) The Clients that Football Agents represent, the exclusivity or non exclusivity of their representation and the expiry date of their representation agreement;

c) The Football Agent Services provided to each Client;

d) Any sanctions imposed on the Football Agents and Clients; and

e) Details of all Transactions involving Football Agents, including the service fee amount paid to Football Agents.

PROFAA had argued that Article 19 FFAR is an “alarming” provision because it gives FIFA the possibility to publish the names of the clients that football agents represent and allows for disclosure of transactions involving football agents. They had sought to argue that it would be a breach of privacy to disclose individual player’s salaries. PROFAA argued that FIFA has breached Article 8 of the European Convention on Human Rights (ECHR), Article 7 of the Charter of Fundamental Rights of the European Union (CFREU) but did not mention the General Data Protection Regulation (GDPR).

Privacy

For completeness, Article 7 CFREU states:

“Everyone has the right to respect for his or her private and family life, home and communications.”

Article 7 CFREU will not be discussed in this blog save as to mention that the CAS considered FIFA’s compliance with CFREU in the context that the GDPR is aligned with Article 7 CFREU. The panel did note that its finding is without detriment to any future EU Court of Justice findings in the future.

Article 8 ECHR safeguards an individual’s right to a private and family life. Article 8 states:

1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The CAS stated that the ECHR is an international treaty that applies to states. On the basis that FIFA and PROFAA are private organisations the ECHR is not applicable.

Data Protection

The CAS panel reviewed if Article 19 FFAR is compatible with the GDPR. The panel noted that Article 19 of the FFAR was “incomplete” and “vague”.

During the course of the proceedings, FIFA did expand on the data that would be collected and has stated that the following data would be made available through a “layered system” of disclosure:

(i) the agent’s name, gender, nationality, country of domicile, licence number, CPD course taken, office telephone number, office email address, agency name, agency website, information regarding authorisations to work with minors, and details of relevant social media channels will be made publicly available on FIFA.com;

(ii) client names and duration/exclusivity of the relevant representation agreement will be made available to FIFA, players, coaches, clubs, Single-Entity Leagues, and Member Associations; and

(iii) details of the football agent services provided to each client and details of service fees paid to Football Agents will be made available to FIFA, the relevant Member Association and to Football Agents only.

The CAS noted that neither the FFAR or the accompanying FAQ explained which data would be published on the FIFA website and the FIFA Legal Hub (a restricted section available only to FIFA agents and national associations).

The CAS referred to FIFA’s Data Protection Regulations (DPR) which stated that the application of the DPR were applicable to “all activities of FIFA, without limitation.” The CAS stated that the DPR is applicable to FFAR.

The CAS then went on to consider the compliance of the FFAR with the GDPR. In this context, Articles 3, 5 and 6 of the GDPR were reviewed.

As a starting point, to explain some of the data protection parlance, FIFA is a data controller of personal data, meaning that FIFA determines the purpose and means of the processing (using) of personal data (information). Data subjects are individuals such as agents and football players.

In summary, Article 5 states how personal data shall be processed (used), (i) lawfulness, fairness and transparency, (ii) purpose limitation, (iii) data minimisation, (iv) accuracy, (v) storage limitation, (vi) integrity and confidentiality, and (vii) accountability of the data controller

The applicable provision of Article 6 is processing shall be lawful only if the data subject (individual) has given consent to the processing and that the processing is necessary for the legitimate interest pursued.

The panel considered “legitimate interest” in some detail, stating that there is a relevant relationship between FIFA and football agents because FIFA has imposed regulation on football agents to create a regulated framework and therefore data can be processed.

The CAS then went on to consider the data minimisation principle, in other words, it considered whether FIFA’s layered disclosure system complies with the principle that personal data should only be processed for as long as necessary. The starting point was that it is necessary and proportionate to publish certain agents details on the FIFA website such as the agents’ name, country of domicile, agent number, office telephone number, email address, agency name, agency website, social media channels, CPD courses taken and authorisation to work with minors. This information is required to identify football agents so that only licenced football agents provide regulated services. It was noted that agents’ gender and nationality was not necessary and proportionate.

The CAS then noted that it was necessary to disclose to FIFA, players, coaches, clubs, single-entity leagues and member associations client names and duration of representative agreements to ensure compliance with FFAR and the prohibition of multiple representation of players. A single-entity league is an organisation that organises a league, such as the Premier League and the English Football League (EFL).

Regarding the disclosure to FIFA and member associations details of football agent services provided, and details of financial information was decided to be necessary to ensure financial transparency.

Finally, the CAS reviewed the disclosure to FIFA, players, coaches, clubs and single-entity leagues and member associations the sanctions imposed on football agents as necessary and proportionate to ensure transparency and to protect players.

The CAS concluded that “in the interests of legal certainty, transparency and accountability” that it would be advisable for FIFA to amend Article 19 FFAR. It was also concluded that FIFA should only publish data that is strictly necessary –as noted above, this seems to relate to information such as agents’ gender and nationality.

What next?

It will be interesting to see what amends (if any) FIFA make to Article 19 FFAR and if any agents or players make a complaint to the regulatory bodies about how their data is processed (used).

Here in England, the Football Association (FA) is expected to issue the English Football Association Agency Regulations imminently.

What does it mean for agents?

This decision means that the FFAR stands, the FA will be issuing its own regulations as the national governing body of football.

Specifically in relation to data protection and privacy, this is a timely reminder for agents to take data protection matters very seriously, and to ensure that they have a robust privacy policy. Agents should also have robust IT systems particularly if they are processing medical information about their clients and financial information.