Data centres, breaches and the new sports-tech data stack

The complaint, lodged under the Aarhus Convention and first reported by POLITICO, argues the EU built a "wall of silence" around data centre consumption. That is not a sports story on its face. But the same racks that run betting models, tracking systems and broadcast analytics are the racks under scrutiny.

There is a number attached. According to the Commission's own figures, Europe's data centres used 20.7 terawatt-hours of electricity in 2025, about as much as Croatia, and more than 8 million cubic metres of water. That is a 26% rise in electricity use and a 52% rise in water use from 2024. The totals come from incomplete data, and a 2024 law banned Brussels and EU capitals from disclosing key performance indicators for individual facilities after lobbying from tech giants.

The research behind the complaint did not come out of nowhere. NL Times reported on 30 September, working with Trouw and other European media, that less than a quarter of larger Dutch data centres publish figures on electricity and drinking water. The Netherlands Enterprise Agency holds data on 104 of the 186 commercial facilities with at least 500 kW of capacity. Public figures exist for the electricity use of 44 and the water use of 47.

What this has to do with a scoreboard

Sports technology is now a data centre business. Player tracking, ball tracking, video review, streaming overlays, fan apps, ticketing and gambling pricing all run on rented compute. When the cost of that compute changes, or when a facility's water permit is challenged, the bill lands somewhere. Usually on the rights holder or the league.

Germany's data centre count is not in the dossier, so there is no point guessing at it. What is in the dossier is the shape of the pressure. The Commission presented a transparency label last week to steer investment towards greener facilities, with minimum performance standards expected to follow. The EU's energy chief, Dan Jørgensen, told POLITICO: "If we do not make sure that these big power consumers are indeed in line with our overall objectives… then they will risk undermining our ability to live up to our own targets."

Diego Solier, a conservative member of the European Parliament working on the bloc's digital capacity push, told POLITICO that "transparency should be the starting point", while adding that it "must be proportionate, and should not require companies to disclose genuinely commercially sensitive information". The Aarhus Convention Compliance Committee meets in November to decide whether the complaint is admissible. The Commission did not respond to POLITICO's request for comment.

On-site power moves the problem next door

Where grids cannot supply the load, operators are building their own generation. Data Center Knowledge reported on 30 September that New Jersey's Department of Environmental Protection fined a Vineland AI data centre operator $1.07 million, saying the facility installed and operated 62 natural gas generators without required permits. The operator, identified as DataOne, disputed the finding on the temporary generators but said it would apply for air permits.

The analyst quoted in that piece, Forrester senior analyst Abhijit Sunil, put the trade-off plainly: "Taking pressure off the grid doesn't eliminate an environmental cost." For a sports venue or a broadcast campus with its own backup generation, the same logic applies to nitrogen oxides, carbon monoxide, particulate matter and noise.

Inside Climate News reported on 30 September that administrative law judges at the Public Utilities Commission of Texas found El Paso Electric failed to adequately consider alternatives to a 366 MW natural gas plant intended to power Meta's $10 billion, 1-gigawatt data centre in northeast El Paso. The judges recommended approval only on condition that the utility does not pass capital and operating costs to ratepayers, and recommended denial otherwise. The five commissioners have not scheduled a vote.

Meta said nothing in the dossier about the ruling. What the dossier does record is the scale: the McCloud facility would use 813 modular natural gas generators supplied by Enchanted Rock, at an estimated $499 million, and Meta would carry the costs for the first five years.

The compute is being built somewhere else too

Capacity is shifting. Light Reading reported on 30 September that Globe Telecom plans to invest at least $1 billion in data centres in 2027, through a joint venture with ST Telemedia Global Data Centres. STT GDC Philippines operates five facilities with 30 to 35 MW projected by the end of this year, rising to 124 MW over three years. The Philippines has 44 data centres with 140 MW of live capacity today and a stated goal of moving from 50 MW to 1.5 GW of AI data centre capacity by 2033.

For sports rights holders in Asia, that pipeline is the relevant one. It is also the one where announced capacity can sit unused for years, as BMI Research noted in the same report.

None of this replaces the harder question about who owns the data once it is processed. On 30 September, The Guardian reported exclusively that more than 44,000 people have filed legal objections under article 21 of the UK GDPR to their health data being handled by the Palantir-powered Federated Data Platform. The campaign is not a sports campaign, but the mechanism is the one that will eventually be pointed at fan data, biometric tracking and athlete medical records.

Palantir said its patient data could only be handled according to NHS instructions and remained in the UK. Amnesty International and Just Treatment staged a protest outside Palantir's London headquarters on Wednesday.

Where the leaks are coming from

Security is the other half of the same story. On 30 September, TechCrunch reported that the Defense Manpower Data Center is notifying millions of current and former US military personnel that their records were stolen in a breach running from October 2025 to mid-July 2026. A Pentagon official told CNN and Federal News Network the breach affects about 2.8 million living people and close to 300,000 deceased. The records were not encrypted and included Social Security numbers and, in some cases, occupational specialty.

The Register reported on 30 September that a 16-year-old researcher named Faav found an authentication flaw in Microsoft's Titan analytics service, gaining administrator access and reaching databases estimated at 17.3 trillion rows. Microsoft locked down the API and paid a $5,000 bug bounty. Faav wrote that he rewrote his blog post at Microsoft's request, cutting sections and numbers.

Two smaller items point the same way. The Register reported on 29 September that researchers affiliated with Glow Security found more than 13,000 sensitive screenshots of corporate software projects from 343 companies posted to public GitHub repos by AI agents, a finding they call PixelLeak. And Tom's Hardware reported on 30 September that Meta's Muse agent surfaced the contents of a private Messages conversation a reporter had never granted it access to.

Sports organisations are not the target of any of these. They are simply in the same blast radius, holding the same kinds of records, on the same kinds of infrastructure, with less security engineering than a Pentagon payroll system.

The most recent thread to watch is the one with a date on it. The Aarhus committee meets in November. If the complaint is admitted, the EU will have to argue in public about what it knows about the energy and water its own data centre boom consumes. Every sports analytics vendor buying capacity in Europe will be reading the same document.