CJEU - C‑209/23 - RRC Sports
| CJEU - C‑209/23 RRC Sports | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 6(1)(f) GDPR |
| Decided: | |
| Parties: | FT (an agent for players and Vice-President of Football Forum) RRC Sports GmbH Fédération internationale de football association (FIFA) |
| Case Number/Name: | C‑209/23 RRC Sports |
| European Case Law Identifier: | ECLI:EU:C:2025:362 |
| Reference from: | LG Mainz (DE) 9 O 129/21 |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion |
| Initial Contributor: | cci |
The AG opined that rules requiring sport agents to disclose certain information to FIFA might violate Article 6 GDPR if they exceed what is necessary for ensuring the good functioning of the football transfer market.
English Summary
Facts
Fédération internationale de football association (FIFA) is a Switzerland-based non-profit that acts as the global governing body for football. A large number of football clubs and national football associations are member of FIFA and bound by its regulations.
In January FIFA published the FIFA Football Agent Regulations (FFAR). FFAR regulated the conduct of player’s agents. In particular, FFAR provided maximum limits to agents’ remuneration and prohibited specific types of contractual arrangements between clubs, agents, and agencies.
In order to ensure compliance with these rules, Article 12 FFAR required agents to disclose certain information to FIFA. In particular, agents had to disclose:
- Information about any agreement with a client, other than a representation agreement;
- Information on any arrangement between agents to cooperate in the provision of their services, or to share the revenue or profits of their services;
- Information about their relationship with agencies, including the names of all of the agency’s employees.
Additionally, FIFA would make the information available to a number of stakeholders including agents, players, and football clubs.
Three applicants (an agent, a company acting as a players’ agent, and the Vice-President of a players’ agents’ associations) challenged FFAR in the Regional Court of Mainz (Germany). The Court referred four questions to the CJEU for a preliminary ruling. In essence, the Court asked the CJEU whether the FFAR was compatible with Articles 101 TFEU (prohibition on cartels), 102 TFEU (prohibition on abuse of a dominant position), 56 TFEU (freedom to provide services), and 6 GDPR (legal bases for processing personal data).
With regards to Article 6 GDPR specifically, the referring court essentially asked whether there was a lawful basis under the GDPR for a collection of personal data, such as required under the FFAR’s mandatory disclosure rules.
Advocate General Opinion
The referring question did not specify what legal basis had to be examined in order to assess the compatibility of FFAR disclosures with the GDPR. However, the AG opined that interest under Article 6(1)(f) was the relevant legal basis, based on the nature of the FFAR rules and on other information on the order for reference. Therefore, the AG focused on the legal basis of legitimate interest exclusively.
The AG recalled that the mandatory disclosure under FFAR were compatible with the GDPR if they met three cumulative requirements:
- They genuinely pursued an interest worthy of protection;
- They were limited to what was strictly necessary to that end;
- They did not place an intolerable burden on the data subjects as regards their right to privacy and their financial interests.
The AG opined that in the case at hand, the processing of personal data pursued an interest worthy of protection (that is, FIFA’s interest in ensuring that the conduct of agents was consistent with the core objective of the football transfer systems, and other objectives related to the good functioning of the player market). However, the AG was more cautious about the other two requirements.
With regards to the requirement of necessity, the AG noted that FFAR required the collection of a substantial amount of personal data, including delicate data about agents’ remuneration and contractual agreements. Additionally, FIFA would not only receive the data but also make it available to stakeholders such as clubs, players, and player’s agents.
The AG opined that such a broad collection and disclosure of personal data could, to some extent, exceed what was strictly necessary to pursue FIFA’s legitimate interest. In that regard, the AG stressed that FIFA should explain to the referring court why the collection and disclosure of the data were necessary, in relation to each type of information.
With regards to the balancing of interests, the AG opined that agents operate within a regulatory framework and, therefore, have a reasonable expectation that FIFA would process their data as a regulatory body. In the AG’s view, this expectation could weight favorably on the balancing of legitimate interest. At the same time, the AG opined that the availability of agents’ personal data to both competitors and potential clients, could financially harm agents and erode trust in agent-client relationships.
Holding
TBD
Comment
The case is largely about competition law and the freedom to provide services. Only the fourth question involves the protection of personal data.
With regards to the fourth question and to the assessment of legitimate interest, the AG's Opinion seems to closely follow the "three-step test" even though the AG does not directly refer to the CJEU's case law in listing the requirements of the test.
Further Resources
Share blogs or news articles here!
