Sports technology has rapidly reshaped the measurement and governance of athletic performance. Wearables, smart fabrics, and AI-linked sensors now generate constant biometric and tactical streams used for analytics, injury prevention, and fan-facing applications. As these tools become embedded in everyday training, the line between assistance and surveillance becomes harder to distinguish, raising new concerns about autonomy and control(1). Although the data originate from athletes' bodies, legal ownership remains uncertain (2). Existing privacy law and international sports governance frameworks offer no clear allocation of rights over the digital traces produced through play or training (3). The concept of data sovereignty-first developed in Indigenous data governance and later expanded into digital rights debates-suggests that individuals should retain authority over information tied to their bodily identity (4). Yet, despite its relevance, this principle has rarely been applied to the sporting context (5). This absence of legal clarity creates a paradox. Athletes generate the data that underpin modern sports technology, yet remain largely excluded from decision-making about its use. Without a recognised ownership framework, performance data sit in an ambiguous space: deeply personal yet institutionally controlled, private yet commercially valuable (6).To avoid uncertainty in interpretation, several key terms are defined at the outset. First, performance data refers to biometric or sport-generated information produced during training or competition. This category includes measurable signals such as heart-rate output, GPS tracking traces, neuromuscular load, movement efficiency markers, reaction-time scores, and other analytics derived directly from an athlete's body or actions. Unlike ordinary personal data collected outside a workplace, these data exist only because the athlete performs. Second, the term data sovereignty is used here to describe an individual's authority to decide how information linked to their physical identity is collected, accessed, shared, stored, and potentially erased. The idea originally emerged in Indigenous data governance debates, but it now informs wider discussions about digital autonomy and informational rights. Finally, co-ownership is not presented as a settled legal rule but as an emerging governance model relevant to sport. Under this model, data rights and responsibilities are shared among athletes, clubs, leagues, and technology providers. Rather than permitting unilateral control by employers or vendors, co-ownership assumes that access, secondary use, retention, and commercial exploitation must be negotiated and justified.Athlete performance data differ from ordinary personal information because they are generated through professional activity and combine physiological, biomechanical, and tactical elements(1). Their production is inseparable from physical labour and competitive action, meaning they exist only because the athlete performs. This hybrid character-both biological and professional-complicates the question of who holds legitimate control. Despite this, prevailing regulatory and contractual structures treat such information as employer-managed output rather than an extension of personhood (3). Many leagues include provisions permitting extensive use of biometric or performance data for analytics, marketing, or third-party licensing(3). In these contexts, consent is typically formal rather than substantive due to structural bargaining inequality between athletes and organisations (5). Over time, this asymmetry has normalised treatment of athlete-generated data as proprietary institutional assets rather than material tied to identity.Although the GDPR recognises individual rights including access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21), supported by transparency duties under Articles 12-14, exercising these rights in elite sport remains challenging.Once biometric records enter layered analytic ecosystems, athletes encounter fragmented storage, opaque processing, and procedural barriers, rendering legal rights difficult to operationalise (7). Institutional platforms often integrate medical, performance, and commercial modules, making data lineage unclear and deletion or correction technically difficult. Although bodies such as the IOC and FIFA provide guidance on secure handling, they refrain from addressing ownership or benefitsharing (6). As a result, athletes often do not know how long their information is retained, whether it is monetised, or who profits from derivative datasets (2). What begins as performance optimisation can therefore evolve into an opaque economic system that privileges institutional control.This unresolved framework creates a conceptual gap: athlete data are simultaneously personal, professional, and commercial, yet legal regimes force a binary classification(1). The result is an athlete positioned primarily as a passive data subject rather than a rights-bearing contributor(4). Real-world disputes demonstrate that this ambiguity is not theoretical. NBA players have questioned whether teams may claim rights over analytic outputs derived from wearables even where collection was negotiated through union channels (8). Comparative labour analysis similarly shows that although leagues such as the NFL and MLB reference wearable technology, most agreements fail to define ownership, access conditions, or benefit-sharing obligations (9).Korea's Personal Information Protection Act (PIPA) focuses on controller duties but does not recognise any proprietary claim athletes may hold over data produced from their bodies (5). Although it regulates consent, purpose limitation, and retention, it frames personal information as institutionmanaged rather than individually controlled. For athletes, this offers procedural compliance but no substantive...