Spanish Soccer League Violates Privacy Laws With Spying App

On June 11, 2019, the Spanish Agency for Data Protection (AEPD) fined LaLiga, the professional soccer league of Spain, €250,000 for breaching Articles 5.1 and 7.3 of the General Data Protection Regulation (GDPR). LaLiga allegedly violated the GDPR by using their mobile application (App) to discover the location of venues illegally broadcasting soccer matches.

LaLiga’s App is used by millions of people to view league updates and player statistics. However, the App is also used by LaLiga to locate venues screening soccer games without a license. The App does this by accessing the smartphone’s microphone to listen for game broadcasts and then connects this information with geolocation information to locate the venue and verify its license.

The App requests user permissions to activate the microphone and access the geolocation services.  Furthermore, the user may opt out when they install the App. However, AEPD found LaLiga’s approach to obtaining consent to be insufficient and found LaLiga to have violated GDPR’s rules surrounding consent and transparency. According to the AEPD, consent must requested each time the microphone is activated because the practice amounts to the collection of personal data. The AEPD also found that LaLiga violated the GDPR by failing to enable users to withdraw their consent at any time.

This decision is consistent with Canadian law. In January, the Office of the Privacy Commissioner of Canada (OPC) released guidelines addressing the importance of meaningful consent and provided recommendations for obtaining it from users, such as the need for organizations to shape their policies around the context in which consent is sought.

Summary By: Imtiaz Karamat