Your Athletes’ Biometric Data Just Got a Real Regulator

Wearable technology as infrastructure

Wearable technology has moved from novelty to infrastructure in professional sport. Since European clubs first tracked player workload in 2009, the practice has expanded from biometric monitoring into psychological and perceptual data, feeding directly into injury prevention — the Toronto Raptors went from the NBA’s most injured roster in 2012 to its least injured within two years of adopting wearable monitoring. In football, these are formally Electronic Performance and Tracking Systems (EPTS), governed under an IFAB/FIFA protocol since March 2018 and covering optical camera systems, local positioning systems and GPS/GNSS devices.

The athletes’ rights question, abroad

Where a professional league has a properly negotiated collective bargaining agreement, wearable technology use tends to be governed by it directly. The NFL Players Association reached a landmark 2017 agreement with performance company WHOOP allowing players to own and sell their own biometric data — a genuine transfer of leverage to athletes. The NFL’s own collective bargaining agreement, whose 2020 expiry once created uncertainty about how wearable-generated data would be treated going forward, was in fact renewed that same year on a term running to 2030, resolving the question this piece left open.

US case law on athlete privacy expectations remains instructive even outside Nigeria: courts have generally held that an athlete’s expectation of privacy is diminished on team premises or using team-provided equipment, and that public-figure status further narrows what a court will treat as private (Bilney v Evening Star Newspaper Co.). Where no collective bargaining agreement exists to negotiate terms on an athlete’s behalf, that diminished expectation of privacy is precisely where legal exposure concentrates.

The Nigerian framework has changed

The Nigerian Data Protection Regulation (NDPR) 2019, the framework originally underpinning this analysis, has been repealed. The Nigeria Data Protection Act 2023 (NDPA), signed into law on 12 June 2023, is now the operative statute, and it is a materially different instrument: where the NDPR was subsidiary legislation issued by NITDA with limited independent enforcement capacity, the NDPA is a full Act of the National Assembly establishing the Nigeria Data Protection Commission (NDPC) as an independent regulator with real investigative and sanction powers.

This is no longer a theoretical compliance risk. The NDPC has already fined MultiChoice ₦766.2 million and Meta $220 million. The substantive obligations a sports organisation using wearable technology on Nigerian athletes must observe carry over in spirit from the old regime — freely given, unambiguous consent from the athlete as data subject; a written contract governing any transfer of that data to a third-party processor; appropriate technical and organisational safeguards against breach — but now sit under an Act the NDPC has shown a genuine willingness to enforce, rather than a regulation whose penalties were rarely tested. Cross-border data transfer, relevant to any Nigerian club or federation sharing biometric data with a foreign club, broadcaster or wearable-technology vendor, is likewise now governed by the NDPA rather than the superseded NDPR provisions.

What this means in practice

A Nigerian sports organisation running a wearable technology programme today should treat its data governance the way a bank or telecom operator already has to — documented consent processes, a data protection officer where the volume of processing warrants one, and written data processing agreements with every third-party vendor, including foreign ones. The NDPC’s enforcement record to date suggests it is prepared to act against well-resourced, high-profile organisations rather than confine itself to smaller targets, which is exactly the profile of a professional football club or league body collecting athlete health data at scale.

Key takeaways and conclusion

The NDPR 2019 has been repealed and replaced by the Nigeria Data Protection Act 2023, a full statute with a genuinely empowered regulator, the NDPC. The NDPC has already imposed fines exceeding ₦766 million and $220 million against major organisations — wearable-technology data governance is now a live enforcement risk, not a theoretical one. The NFL’s collective bargaining uncertainty this piece flagged around wearable data was resolved in 2020 with a CBA now running to 2030. Any Nigerian sports organisation processing athlete biometric data, including for cross-border transfer to foreign clubs or vendors, should review its consent and processing agreements against the NDPA rather than the superseded NDPR.

The legal questions this piece raised about athlete privacy and wearable technology remain live and largely unanswered by Nigerian case law. What has changed is the seriousness of the regulator standing behind the answer a court or the NDPC itself might eventually give. Sports organisations that treated NDPR compliance as a formality should not make the same assumption about the NDPA.