Technology and data protection considerations in World Cup projects

Welcome to the second article in our Dentons Middle East Sports Series.

We are still on the topic of football, following Saudi Arabia's successful bid to host the FIFA World Cup in 2034. This time we are talking all things technology and data protection.

Here is our round-up of some of the key issues to consider in the context of major sports events.

Data protection and the General Data Protection Regulation

The FIFA World Cup is the most-watched sporting event in the world. Tickets are sold to fans globally and it employs a huge array of people. Businesses all around the world will be involved in organising the event, each providing different services which will require the collection and use of personal data including, for example: (i) for the provision of flights, accommodation and transportation; (ii) for the sale of merchandise related to the event; and (iii) to provide catering and food services. This means that the collection, storage and processing of personal data will be key.

However, with the extensive use of personal data comes the responsibility to protect that personal data, which is where compliance with data protection laws such as the Kingdom of Saudi Arabia's (KSA) Personal Data Protection Law (PDPL) become relevant. It is therefore important for organisations to ensure they have a clear understanding of the requirements under these laws and establish protocols for handling personal data responsibly. This may include: (i) compliance with obligations around having a lawful ground to collect and use personal data (e.g. obtaining the consent of the individual); (ii) implementing appropriate security measures to protect the personal data; (iii) conducting data protection impact assessments for any high-risk use of personal data; (iv) putting in place appropriate procedures to respond to requests from individuals to exercise their rights around their personal data; and (v) ensuring that data is not kept longer than is necessary for the purposes for which it was collected.

Given the global nature of the World Cup and the fact that stakeholders are located across the world – from ticket vendors, travel agencies and sponsors – organisations located in other countries may be caught by data protection laws that would not ordinarily apply to them. For instance, the PDPL sets the framework for how personal data should be handled within KSA. It applies to any entity processing the personal data of individuals who reside within KSA. Therefore, if you are an organisation that will be processing the personal data of KSA residents as part of the FIFA World Cup, even if you are located outside KSA, you may be subject to the PDPL.

Moreover, organisations in KSA or abroad that are offering goods and services to individuals who are not located in KSA may be caught by the privacy laws of the country in which those individuals are located. For example, any organisation offering goods and services related to the FIFA World Cup to individuals in the EU may also be caught by the General Data Protection Regulation (GDPR), regardless of where they are located. The GDPR is known for its stringent data protection requirements, imposing rigorous standards for the collection, processing and storage of personal data.

Cross-border data transfers of personal data across jurisdictions will also be a key challenge that organisations involved in the FIFA World Cup will have to overcome. Organisations will need to ensure that any transfers of personal data outside their customers' countries of residence comply with the transfer regime of that country. This may include obligations requiring organisations to ensure that: (i) the purpose for the transfer is permissible under the applicable law; (ii) there is an adequate level of protection for the personal data in the recipient country; or (iii) appropriate safeguards are adopted, such as standard contractual clauses, where relevant.

The power of technology

The 2022 World Cup in Qatar serves as a compelling example of how pivotal technology is in transforming sporting events. Advanced ticketing technology (including mobile and RFID-enabled tickets) enhanced security, streamlined entry for more than 1 million visitors and revolutionised event operations. By integrating hand-held RFID readers and an event management platform, Qatar optimised crowd control and emergency response, illustrating how cutting-edge technology can elevate both the fan experience and the efficiency of event operations.

Looking ahead to 2034, technologies like virtual reality and augmented reality promise to deliver immersive fan experiences, while data analytics can personalise content, further engaging audiences. Smart stadiums are transforming event management by optimising operations, improving security and promoting sustainability through internet of things (IoT) devices and eco-friendly initiatives. Real-time communication, mobile applications, websites and social media platforms foster global connectivity, engaging fans worldwide. Advanced surveillance and AI-driven threat detection ensure a secure environment, while technology enhances emergency response capabilities.

Legal strategies for technology success

Hosting the 2034 World Cup offers KSA a unique chance to harness technological innovations. These investments promise long-term benefits, including enhanced infrastructure and increased global visibility, aligning with the nation's ambitious future goals. The World Cup serves as a pivotal platform for showcasing KSA's commitment to innovation and development.

The challenge lies in ensuring that the technology planned for the event and integrated into stadiums remain cutting-edge and adaptable. As technology evolves rapidly, innovations developed and implemented today may become obsolete by 2034, necessitating updates to deliver the cutting-edge experience that is promised.

It will be important to ensure that the contracts put in place allocate the risk, responsibility and costs of future changes appropriately between the contracting parties. The contracts should include clauses for technological upgrades and variation regimes to manage necessary updates during the overall project, and will need to sit alongside technical specifications that deliver flexible designs which can accommodate future technological advances.

It will be equally important to define deliverables, timelines and performance standards to ensure that the digital solutions meet the event's high expectations. By specifying deliverables in detail, both parties can prevent scope creep and maintain a mutual understanding of the project's objectives. Timelines must be realistic, with provisions for remedies and incentives to encourage timely completion. Performance standards should include measurable criteria such as uptime guarantees and response times, ensuring consistent service quality. Additionally, these agreements should allow for technological upgrades and variation regimes to manage necessary updates in the lead-up to and during the event.

As these digital solutions become increasingly sophisticated, the risk of technical glitches or system failures also rises. Such incidents can disrupt the fan experience and damage the stadium's reputation. Therefore, establishing robust disaster recovery frameworks is crucial to ensuring operational continuity, even during unexpected outages.

By proactively addressing these potential challenges as part of their technological, operational and legal strategy, organisers can safeguard the integrity and reliability of the digital platforms, providing a seamless and enjoyable experience for all fans, and tech providers can understand their obligations and proactively manage risk and costs.

Apps and website

There is no doubt that mobile applications and websites will play a huge part in ensuring fans gain access to the stadium, follow their favourite teams, keep up to date with statistics and watch all the exciting highlights. Building these applications and websites requires careful thought around privacy policies, terms and conditions, and licensing.

The collection of personal data is often key to the functionality of these applications. Given the sensitivity of the personal data collected, which often includes the geo-location data and detailed profiles of users, it is imperative that organisations are transparent about their processing of this personal data. Organisations will likely need the consent of individuals to collect this personal data, so any consents obtained must be drafted clearly to explain its intended use. Organisations will also have to adopt compliant privacy notices that can be accessed easily by users on both mobile applications and their websites, which set out what data they are collecting, the purposes for which they are using the data and any third parties with whom their personal data will be shared. Given the high-risk and intrusive nature of these activities, it is likely that organisations will also have to conduct data processing impact assessments to ensure that any collecting and use of this information is proportionate.

Logo/emblem protection and registration

Major sporting events such as the FIFA World Cup face brand protection challenges due to the global recognition of their trade marks, logos and emblems. These elements must be safeguarded through intellectual property (IP) rights, allowing only official sponsors and partners to legally use them.

A significant concern is preventing ambush marketing, where marketers associate their brands with the event without official sponsorship, often through indirect references, or by leveraging social or political issues related to the event. For example, during the 2022 FIFA World Cup, some companies gained substantial publicity by alluding to the event without directly infringing on trade marks. These campaigns were legally challenging to contest as they avoided using official logos or implying any formal connection with FIFA.

To protect their interests, event organisers and sponsors must monitor potential IP violations and anticipate new ambush marketing tactics. Companies looking to engage with such events should ensure their marketing efforts do not mislead consumers into thinking they are official sponsors when they are not.

To actively protect logos and emblems, various legal tools such as trade mark registration, copyright and design rights are essential. These tools provide a framework to address unauthorised use of event-related IP. Sponsors should also carefully draft agreements with event organisers, including exclusivity clauses and strategies for handling ambush marketing. Additionally, event-specific laws, such as those restricting misleading advertising, help preserve the value of sponsorships and prevent unauthorised promotions from affecting official partnerships.

Get in touch

Our experts have advised developers, suppliers, financiers and investors on world-class sporting events across the globe including, more recently, the World Cup in Qatar. Please get in touch with us to discuss.

This article is also available in Arabic, click here to download.

Click here to read article