Alexandra Fochios is a first-year law student at American University Washington College of Law. Alexandra earned her undergraduate degree from the University of Wisconsin and her master’s degree from the American University of Paris. Her interests include data privacy and the intersection between technology and law.
The United States Supreme Court’s decision to overturn the federal Professional and Amateur Sports Protection Act (PASPA) in 2018 opened the doors for states to legalize in-person and online sports gambling across the US.[1] Since then, many states have passed legislative that allows them to capitalize on the popularity of the highly lucrative sports gambling market. Moving forward, legislators must be cognizant of the market’s growing concerns surrounding data protection, cybersecurity, and privacy issues.
In 1992, the Senate passed PASPA, which banned sports betting in all states, except Nevada, amidst widespread apprehension about the negative impact of sports betting on the integrity of US sports leagues.[2] Legislative support for PASPA stemmed from the Dowd Report and widespread public disapproval of sports betting. After a year of public hearings headed by the Senate Judiciary Subcommittee on Patents, Copyrights, and Trademarks, the subcommittee found that sports gambling was a “national problem,” and PASPA passed in the Senate, with a voting margin of 88-5.[3]
Despite the intentions of lawmakers, sports gambling did not cease during PASPA’s twenty-six-year ban. Instead, bettors turned to illegal black-market betting or used offshore online sportsbooks to place bets.[4] Additionally, PASPA underwent numerous legal confrontations. The most significant case during this period, Murphy v. National Collegiate Athletic Association, arose in response to New Jersey Governor Chris Christie’s signing of the Sports Wagering Act (“2012 Act”) after a non-binding referendum in 2011 found that 64% of New Jersey voters supported a constitutional amendment to permit sports betting in the state.[5] The major US sports leagues including the MLB, NBA, NFL, NHL, and NCAA opposed New Jersey’s attempt to legalize sports betting and filed against the state under the federal regulations set forth in PASPA. The leagues prevailed and the 2012 Act was struck down.[6]
In 2014, New Jersey challenged the constitutionality of the PASPA by enacting Senate Bill 2460. The state argued this bill to decriminalize sports betting did not violate PASPA because it had not legally authorized sports betting.[7] The major sports leagues again brought action against New Jersey. Ultimately, the Supreme Court held that PASPA was unconstitutional since it violated the anti-commandeering principle enshrined in the Tenth Amendment, which states, “the powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people.” Thus, when the Supreme Court repealed PASPA in 2018, it did not automatically legalize sports gambling in the US. Rather, the Court lifted the federal ban and granted states the individual authority to legalize and regulate sports betting.[8]
In response, many states have passed legislation to take advantage of the emerging sports gambling market. By 2019, Delaware, New Jersey, Mississippi, West Virginia, Pennsylvania, Rhode Island, Arkansas, and New York legalized various forms of in-person and online sports betting. Since then, more than twenty other states have followed suit.[9] Although states have the authority to legalize sports gambling, most states have limited experience in regulating sports betting and even less, if any, experience regulating online or mobile application betting. In the modern era, data protection and cybersecurity have always been a major concern for the gambling industry, as there are huge amounts of personal data that must be collected, organized, and stored properly to ensure user safety.
States legalizing sports betting now are at a disadvantage because they do not have a federal data protection framework to reference.[10] Currently, the US has not passed any broad federal legislation concerning data protection, privacy, and security. While there are several federal laws in place that deal with data protection, they are limited in their scope and regulation, since they solely address narrow, distinct areas.[11] The US may instead look to the European Union’s 2018 General Data Protection Regulation, which addresses cybersecurity and data protection concerns, for guidance. In the absence of federal regulation, at least half of the states have passed their own legislation to address issues of data security and data privacy.[12] To date, the most comprehensive state legislative is the California Privacy Rights Act which protects California residents by placing duties on entities that collect consumer data. The law recently came into effect on the first of this year.[13]
The repeal of PASPA is in many ways a double-edged sword; sports enthusiasts and states can benefit from the emerging market opportunities, but without comprehensive legislation in place, federal and state-level regulation will remain difficult. The legalization of sports gambling comes with high stakes and high expectations, and states must adapt quickly to contend with the growing demand for enhanced cybersecurity and data protection measures in this industry.
[1] See Murphy v. Nat’l Collegiate Athletic Ass’n, 138 U.S. 1461 (2018).
[2] Richard Janvrin, PASPA Supreme Court Decision: Everything You Need to Know, World Sports Network (Jan. 2, 2023), https://www.wsn.com/sports-betting-usa/paspa/
[3] Id.
[4] Id.
[5] Id.
[6] See supra note 1.
[7] Supra note 2.
[8] Id.
[9] Jill R. Dorson, What is PASPA, the Federal Ban on Sports Betting?, SportsHandle (July 1, 2020)
https://sportshandle.com/what-is-paspa-sports-betting-ban-professional-amateur-sports/
[10] Steven Andrew Light & Kathryn R.L. Rand, Sports Betting and Data Security: Cybersecurity, Data Protection, and Privacy Rights in Gaming Law Practice, American Bar Association Business Law Section (Feb. 10, 2021) https://businesslawtoday.org/2021/02/sports-betting-data-security-cybersecurity-data-protection-privacy-rights-gaming-law-practice/
[11] Id.
[12] Id.
[13] Osano, Data Privacy Laws: What you need to know in 2023, Osano (Dec. 14, 2022) https://www.osano.com/articles/data-privacy-laws#:~:text=The%20most%20comprehensive%20state%20data,effect%20on%20January%201%2C%202023