Here, specifically, GDPR prescribes exemptions for journalism: https://gdpr.eu/article-85-right-to-freedom-of-expression-an...
There are probably other exemptions that would apply for innocuous activity freely done in public, with the explicit understanding that it would be filmed.
If the player just wears the brand through their own choice and they company advertises "As worn by Jordan in NBA all-star game!" then they would not need to pay.
Ads and stats are two completely different things.
Since most player contracts are frequently renegotiated and most clubs use third party databases and generate revenue from betting companies (so if necessary they'd all end up with clauses permitting this data use), the long term effects of a favourable stretch of the definition of 'personal data' are more likely to have chilling implications for people collating activity/performance metrics or compiling biographies of other types of public figure anyway...
All you would need is one club saying they searched the data for say "any player over six foot" and one player who fit the search term but the data was inaccurate.
It’s questionable if they can win, but demonstrating damages may be the easiest part of this case.
Even more so when the context is that virtually any employer of professional footballers derives some of their revenue from betting, and betting companies are the primary sponsors of half the English Premier League teams and the English Football League organization
It’s the same basic principle as speeding or drunk driving being illegal even if nobody was actually harmed, putting people at significant risk of harm is not acceptable.
In my opinion a third party would only be liable for harming their reputation if the statistics being published were untrue.
In effect their a RNG that happens to make people dislike them.
Does GDPR make this distinction?
1. There have been breaches of data protection law (GDPR as implemented in the Data Protection Act 2018), e.g. players did not consent to data transfer, the data isn't accurate, etc. and it's done on a commercial basis.
2. These breaches were injurious to the economic prospects of the affected players and therefore damages should be awarded.
I would imagine that the cause of action will be the tort of negligence against whoever sold the data on, and/or the gaming, betting, and data-processing companies. This is because they arguably had a duty of care to the players, the duty was breached, and the players suffered some harm -- based solely on the facts in this article.
Regarding personal compilation of statistics, that's fine - there's an exemption for activities of a purely personal nature in the GDPR - which is why you wouldn't get caught, but commercial exploitation of the data falls outside of that.