# Legitimate Interests Assessment (LIA) ## EchoDepth — Pre-Match Press Conference Emotional Analysis **Controller:** Cavefish Ltd (Reg. 15127122) **ICO Registration:** ZB915633 **Document ref:** LIA-ED-SPORT-001 **Version:** 1.0 **Date:** January 2026 **Author:** Jonathan Prescott, Founder & CEO **Review date:** January 2027 --- ## 1. Purpose of Processing EchoDepth analyses publicly broadcast pre-match press conference footage of professional football managers to derive behavioural and emotional state indicators. Processing uses FACS (Facial Action Coding System) methodology, mapping 44 Action Units to Valence-Arousal-Dominance (VAD) scores, producing three composite outputs per manager per press conference: - Genuine Confidence score (0–1) - Instability Index (0–1) - Net Confidence score (−1 to 1) These outputs are used for: **(a) Editorial and journalistic purposes** — published analysis of manager demeanour and communication style in the context of upcoming fixtures, framed as sports commentary and performance intelligence. **(b) Commercial data intelligence** — scored outputs provided to trading desks, quant funds, and alternative data aggregators as a pre-match behavioural signal orthogonal to existing statistical models. --- ## 2. Three-Part Legitimate Interests Test ### Part 1 — Purpose Test: Is there a legitimate interest? **Yes.** Cavefish has a legitimate commercial interest in developing and commercialising a novel behavioural intelligence product. The processing is not inherently unethical or contrary to law. Specifically: - Professional football managers hold public-facing roles in which press communication is a structured, intentional, and contractually required activity - Press conferences are staged media events, distributed by clubs, the Premier League, and broadcasters specifically for public consumption - Analysing the behavioural content of these events — as distinct from private life or private communications — serves a genuine commercial and editorial purpose - Sports analytics and behavioural science applied to publicly broadcast content is an established commercial category There is additionally a legitimate interest in providing editorial commentary that serves public interest in sports journalism. ### Part 2 — Necessity Test: Is the processing necessary for that purpose? **Yes.** The purpose cannot be achieved by less intrusive means. Sentiment analysis of spoken words is available but materially different — managers curate spoken content for media consumption. FACS AU analysis of involuntary facial muscle movements provides a signal unavailable from text or audio alone. No less privacy-intrusive method exists that would produce equivalent output. Processing is limited to: - Footage taken at formally scheduled, publicly broadcast press conferences - Managers acting in their professional capacity as public figures - Output is aggregate behavioural scoring, not biometric identification - No processing of private life, personal communications, or non-professional contexts ### Part 3 — Balancing Test: Do the individual's interests override the legitimate interest? **Assessment: No, for the following reasons.** **Factors weighing in favour of processing:** - Data subjects are professional public figures who have voluntarily assumed a public role with understood media obligations - Press conferences are staged specifically for broadcast and public distribution — managers have no reasonable expectation of privacy in this context - Processing serves both commercial purpose and editorial/public interest in sports analysis - Outputs are behavioural inferences about professional performance, not personal life data - No data is used to make automated decisions affecting the data subject's employment, finances, or legal status - The processing does not enable identification of the data subject (they are identified by the event context, not by biometric matching) - Data subjects are not members of a vulnerable group requiring enhanced protection - Processing is disclosed publicly via this LIA and the associated DPIA **Factors weighing against processing:** - FACS AU analysis constitutes processing of physical characteristics and may be classified as biometric data under Article 4(14) UK GDPR - Data subjects have not been directly notified of this processing - Commercial use of a person's image-derived data without consent may conflict with residual image rights expectations - Published scores could affect professional reputation if methodology is disputed **Mitigation measures applied:** - Processing limited strictly to public professional contexts (press conferences, not private life) - Outputs presented as analytical/editorial commentary, not objective fact - Methodology caveats included in all published outputs - No persistent biometric profile created or retained - Raw processing data not retained after analysis window - Data subjects can request information about processing via hello@cavefish.co.uk - Article 9(2) position documented in accompanying DPIA: processing is not used for biometric identification and therefore does not engage Article 9 as a unique identifier; alternatively, Article 9(2)(j) (archiving/research/statistical purposes) or Article 9(2)(g) (substantial public interest — sports journalism) provides additional cover for editorial outputs **Conclusion on balancing test:** The reduced privacy expectation of public figures acting in their professional public capacity, combined with the mitigation measures above, means the data subject's interests do not override the legitimate interests of Cavefish in this processing. --- ## 3. Article 9 Position Cavefish's primary position is that the processing does not constitute biometric processing under Article 9 because the FACS AU outputs are not used to **uniquely identify** the data subject. The manager is identified by the event context (the press conference itself), not by the AU analysis. The AU outputs measure emotional state, not identity. In the alternative, if a regulator or court determines that FACS AU analysis does engage Article 9, Cavefish relies on: - **Article 9(2)(j)** — processing necessary for scientific or statistical purposes (methodology validation, sports analytics research) subject to appropriate safeguards - **Article 9(2)(g)** — substantial public interest under Schedule 1, Part 2, DPA 2018, specifically Paragraph 8 (journalism, academic purposes, art or literature) for editorial outputs Both positions are documented in the accompanying DPIA (ref: DPIA-ED-SPORT-001). --- ## 4. Transparency This LIA is publicly accessible at cavefish.ai and echodepthsports.com. Data subjects may request further information or object to processing at: hello@cavefish.co.uk. Objections under Article 21 UK GDPR will be assessed against the compelling legitimate grounds documented in this LIA. --- ## 5. Sign-off | Role | Name | Date | |---|---|---| | Data Controller | Jonathan Prescott, Founder & CEO, Cavefish Ltd | January 2026 | | Review due | — | May 2027 |