Offsides on data: the federal privacy gap in college athletics’ LLC era (Part 1)

Following the House v. NCAA settlement, which allows Division I institutions to share revenue directly with athletes, and the growth of NIL activity, universities are under growing financial pressure to find new sources of revenue. Some collegiate athletic operations are now turning to private capital and commercial partners, placing ticketing, sponsorship, licensing, and media operations into affiliated limited liability companies (LLCs) and other separate entities. This three-part series examines the privacy and data governance implications of the trend.

Part 1, Offsides on data (below) examines federal privacy questions using the example of University of Utah’s for-profit Crimson Brand Partners model. It explains how moving commercial operations into a separate LLC changes the privacy analysis, when the Family Educational Rights and Privacy Act (FERPA) continues to protect student records shared with a for-profit affiliate, and why the Health Insurance Portability and Accountability Act (HIPPA) is usually not the governing regime for student health records. It closes with the questions counsel should answer before any data crosses the LLC boundary.

Part 2, Next play (available here), addresses the additional state, federal, and international regimes that may apply.

Part 3, Home-field rules (available shortly), examines the University of Kentucky’s public-affiliate model, compares the two approaches, and considers how public and private universities might structure similar ventures.

Article overview

• Background
• How the LLC structure changes the privacy calculus
• FERPA: the “educational institution” question
• HIPAA: usually not the governing regime for student health records
• Final thoughts