Medical examination data in a club transfer: consent, purpose and access

Before a club transfer, clubs often request medical reports, information about earlier injuries and an assessment of current fitness. For players and clubs, it is important to remember that a sporting review does not automatically justify access to the player’s complete medical history.

Health data receive special protection. Before anything is disclosed, the purpose, legal basis, scope, recipients and deletion point should be clear. A general consent to “all medical records” does not answer those questions.

The phrase medical records can cover very different information. It may refer to a current fitness statement, a particular diagnosis, a rehabilitation plan, an injury history or complete medical reports. These items do not have the same informational value and should not automatically be available to the same recipients.

The sporting question should be stated first. Is the issue fitness for a particular date or workload? Does the receiving club need to plan around a known injury? Or is it trying to assess a general health risk? The more precise the question, the easier it is to limit the information requested.

The club transfer and registration in the sporting system do not, by themselves, create blanket permission to obtain every medical detail. Sporting documents and the data-protection assessment must fit together. The regulations topic page helps with the sporting level, but it cannot replace a review of the actual processing.

Health data fall within Article 9(1) GDPR. Their processing is therefore generally prohibited unless an exception in Article 9(2) GDPR applies. A legal basis under Article 6 GDPR is also required. Signing a form does not automatically make the processing lawful.

Explicit consent can, subject to the statutory requirements, provide an Article 9(2)(a) GDPR condition. It must relate to a defined purpose and a clearly described scope of data. A declaration releasing “all medical information” for any purpose without further limits is therefore particularly problematic.

The relationship between player and club also requires a close look at whether consent is genuinely freely given. Economic and sporting dependence may affect that assessment. The club should not merely collect a signature. It should limit processing to what is needed and, where possible, provide a meaningful way to conduct the review without unnecessary disclosure.

The privacy notice provides an important starting point for information about rights, recipients and purposes. It does not replace a case-specific assessment of consent or a medical-data request in a transfer.

Article 5(1)(b) and (c) GDPR require purpose limitation and data minimisation. The purpose must be set before disclosure. “Squad planning” or “medical review” may be too broad unless the club explains which concrete decision is being prepared and which information is needed for it.

A staged approach may be sufficient in many cases. A responsible medical person might confirm whether the player is fit for a defined workload or period. The receiving club would then not automatically receive every report. Whether a summary is enough depends on the actual sporting and medical question.

Minimisation also applies to old records and later additions. An earlier injury should not become a permanent part of every future transfer decision without a link to the current purpose. If more information is needed, the club should be able to explain why that particular information is necessary.

A club transfer involving several clubs may already generate many contract and registration records. Medical data should be kept separate so that they are not sent to every participant merely for convenience.

Recipients must be determined by their task and the information they need. Medical staff may require different details from coaches. Club management may need a summary for a contract decision without receiving the complete medical report. A general access right for all officials cannot be justified on that basis.

The distinction between a raw report, a medical summary and a sporting decision is particularly important. Each stage may involve different recipients. The platform should implement roles, record access and remove permissions when the relevant task ends.

If reports are supplied by the former club, a doctor, a laboratory, an insurer or an external provider, the full chain should be recorded. The receiving club should know where the data came from, who disclosed them, where they are stored and whether a provider uses them for its own purposes. A disclosure to another club or association also needs a defined purpose.

The club and player-contract page complements the contractual side. For medical information, the decisive point remains which person needs which information for which task.

Processing does not automatically end when a transfer is signed or refused. After the decision, the club must ask which data are still needed for a continuing purpose. This may include ongoing medical care or documentation of a specific matter. General retention for possible future transfers is a different question.

Article 5(1)(e) GDPR limits retention to what is necessary for the purpose. Raw reports, short summaries, internal notes, exported files and backups may require different rules. A deletion concept must therefore cover not only the main platform but also downloads, email attachments and local copies.

If the transfer is abandoned, record which recipients received the data and whether their copies need to be deleted or returned. After a successful move, the club should also clarify which records are transferred and which no longer serve a purpose at the former club. A specific statutory retention duty may depend on another legal matter and should not be assumed in general terms.

The player should be told in an understandable way who processes the data, for what purpose, which data are involved, which legal basis is relied on, who receives the information and how long it will be retained. A reference to “medical review” alone is not enough for a transfer disclosure.

Article 15 GDPR generally provides a right of access to personal data being processed. Depending on the situation, rights to rectification, erasure, restriction or objection may also be relevant. Whether a right applies and to what extent depends on the legal basis and statutory exceptions.

A focused request is more useful in practice than a demand for the entire club file. Identify the transfer, period, suspected recipients and type of information concerned. This allows the club to match the request to its actual systems and processing activities.

For an initial review, keep the data request, consent wording or privacy information, the player contract and the transfer correspondence together. Depending on the matter, add the medical report, a fitness summary, a recipient list and information about the platform used.

Prepare a simple timeline. When was information requested? Who supplied it? Was consent given or refused? Which people could access the records? When was the transfer decided or abandoned? This makes gaps and unnecessary copies easier to identify.

For a dispute about the contract, remuneration or the move, the contract-completion checklist and the article on rights and data in a player contract can help organise the records. Medical reports should remain in a separate protected document area.

Requesting the complete medical history: A transfer review needs a defined question. Extensive old records should not become the default for convenience.

Confusing consent with information: A signed form replaces neither the legal-basis assessment nor clear information about the processing.

Treating coaches and management alike: Their tasks may call for different data scopes. A raw report and a fitness statement are not the same thing.

Sending health data by email to a broad group: The transmission method, recipients and access security must match the sensitivity of the information.

Keeping every copy after the move: Downloads, attachments and exports belong in the deletion concept and should not be retained permanently out of habit.

May a receiving club request medical reports before the transfer?
That depends on the specific purpose, legal basis, necessary scope and recipients. A general request for the complete medical history is not automatically justified. The first question is often whether a narrower statement about current fitness is sufficient.

Must a player expressly consent to disclosure?
There is no single answer for every processing activity. Health data are subject to Article 9 GDPR and require an appropriate exception as well as a legal basis under Article 6 GDPR. Explicit consent can be one option, but it must be specific, informed and genuinely voluntary.

May the coach see the complete medical report?
Not automatically. Access must follow the concrete task and the necessary amount of information. A limited statement may be enough for training planning, while medical details remain with the responsible medical staff.

Start by organising purpose, data types, legal basis and recipients. Limit the request to the actual transfer question and separate raw medical information from any necessary summary. Access, transmission and retention can then be set out in a traceable way.

Players should not sign unclear blanket consents. They should ask which information will be sent, to whom and for what purpose. Clubs should establish a staged process with defined roles, secure transmission and documented deletion.

If you would like to receive new legal guidance on player contracts and sports law, you can subscribe to BRANDaktuelle Legal News.

Contact the firm
If you want a data request, consent form or the handling of medical records in a club transfer reviewed, prepare the player contract, transfer correspondence, consent wording and recipient list. Mag. Bernhard Brandauer, Rechtsanwalt, will clarify the next sensible steps with you.