Next play: the privacy regimes filling the gap in privatized college athletics (Part 2)

Following the House v. NCAA settlement, which allows Division I institutions to share revenue directly with athletes, and the growth of NIL activity, universities are under growing financial pressure to find new sources of revenue. Some collegiate athletic operations are now turning to private capital and commercial partners, placing ticketing, sponsorship, licensing, and media operations into affiliated limited liability companies (LLCs) and other separate entities. This three-part series examines the privacy and data governance implications of the trend.

Part 1, Offsides on Data (available here) used the University of Utah’s Crimson Brand Partners model to examine when key legislation, FERPA and HIPAA, apply, continue to apply, or do not reach an affiliate’s independent activities.

Part 2, Next Play (below) turns to the additional privacy regimes and commercialization risks, with practical recommendations for university counsel. Using the University of Utah's venture as a reference point, it examines how state consumer privacy laws and consumer health data statutes, such as Washington's My Health My Data Act, may apply to a for-profit athletics affiliate operating outside FERPA and HIPAA. It then considers data ownership and commercialization, including biometric privacy, cross-border processing under the GDPR, and FTC enforcement, before setting out the governance steps counsel should take before athlete data is transferred or repurposed.

Part 3, Home-Field Rules (available shortly), compares Kentucky’s public-affiliate model and addresses structural choices for public and private universities.

Article overview

• Introduction
• State consumer privacy laws: the biggest emerging risk
• State consumer health data privacy laws: an emerging layer of exposure
• Data ownership and commercialization
• Key recommendations for university counsel
• Final thoughts