Saints to sinners: A penalty taken for 'spygate'

I never thought I would see the day when two of my loves would combine, with such devastating consequences. Privacy and Southampton FC.

I have an interest or, rather, a confession to make. I am a card-carrying supporter of Southampton FC. Cheered by its fans as the "Saints," which "go marching in," they will now be jeered by many opposing fans with make-shift binoculars for their role in what has been dubbed "Spygate" in English football. 

On 8 May 2026, the English Football League issued charges against Southampton Football Club for breaches of EFL Regulations pertaining to treating other clubs with "utmost good faith" and, more specifically, not directly or indirectly observing another club's training session three days prior to any match scheduled to be played between the two clubs. Following some damning evidence, shared publicly, of a relatively junior Southampton FC intern on a work placement at the club, Southampton admitted to the charges with respect to its spying on Middlesbrough Football Club. Even more, Southampton admitted to two additional similar incidents of observing training sessions of other clubs, in breach of EFL Regulations.

As punishment, on 19 May, the EFL "expelled" Southampton from the EFL Championship Play-Off final, a match which is regarded as the most lucrative match in sport, let alone, football, due the financial windfall that comes with the broadcasting rights and other payments on promotion to the Premier League. Southampton will remain in the second tier of English football next season, albeit with a four-point deduction by way of further penalty.

Peeping Toms and eavesdroppers are prominent recurring protagonists in the storied development of the laws of privacy and, its often-erstwhile partner, property. So, what privacy lessons can be gleaned, and might still yet be learned, from this salutary tale of the Saints turning into sinners?

Turning to the basics, it's undeniable, that by videotaping Middlesborough, Southampton processed the personal data of opposition players and perhaps of its coaches and wider staff. It's hard to identify a legal basis Southampton could rely on for the processing of such data. Perhaps it might have argued, in the skullduggery of sport, it has a "legitimate interest" to collect insights that give it a competitive edge, but such an interest can hardly be legitimate when the practice is specifically outlawed by the EFL. 

It's also improbable that Southampton could fulfil its transparency obligations. After all, Southampton providing the competitor team players with notice of its data collection would surely undo the purpose of the covert mission to snoop. Exemptions to the obligation to be transparent do exist, however. For example, it would not make sense for public authorities conducting criminal investigations to provide notice where it would "render impossible or seriously impair" the objectives of the data processing. One could go on, scrutinizing the extent to which Southampton fulfilled requirements under applicable U.K. data protection law. 

Though Southampton's saga is rooted in rudimentary, if not clumsy, practices, it's not the first, nor will it be the last, organization to seek out information on competitors for its competitive advantage. In addition to traditional clandestine human espionage, the technological state of the art has also advanced in immeasurable ways that enable actors to obtain information on their competitors. For example, emerging AI capabilities have dominated headlines recently with the extent to which AI can obtain unauthorized access to third-party systems to gather information. 

Southampton have paid a hefty price, in both footballing and in revenue terms, for their sin. More might yet unravel on the extent to which certain individuals are culpable, whether the practices and governance (or lack thereof) of the club represent a culture deserving of more scrutiny and punishment, and the extent to which any new or compounded harms emerge. 

As the Saints go marching into the end of season break, there might still be more yet to pay. 

So, as fences go up ahead of this year's World Cup, tribal club allegiances are relegated in favor of patriotic national support, and the Saints skulk, rather than march, into the summer, the penalties for surveillance and poor privacy might yet deliver another kick.