The IAAF blood test data leak - was publishing the data lawful?

On 2 August 2015, the Sunday Times published an article entitled ‘Revealed: sport’s dirtiest secret’ (the Article),¹ which claimed that the disclosure of supposedly ‘secret’ data held by the International Association of Athletics Federations (IAAF) revealed “the extraordinary extent of cheating by athletes at the world’s top events”. The Sunday Times and German broadcaster ARD/WDR stated that blood test data had been leaked to them by a whistle-blower concerned about the content (the Database).

In its response to these allegations, on 4 August 2015 the IAAF confirmed that, following internal investigations, it believed that there was no whistle-blower and that the Database had been obtained illegally.²

The Database allegedly contains more than 12,000 blood test results of over 5,000 athletes and the Article has led to finger-pointing in the sporting world. Whatever the position regarding the anti-doping procedures and practices implemented by the IAAF, the Article has placed innocent athletes in the public eye and forced them to defend themselves, some even feeling the need to release extremely personal information into the public domain in order to do so. 

The actual Database has not been disclosed by the Sunday Times (reportedly after being threatened by an injunction by the IAAF and promising not to do so). But what is the position from a data protection perspective? What rights did the press have to obtain and hold personal information about 5,000 individuals without their consent? Were they permitted to publish information about the blood tests of athletes? And should the athletes themselves have had any say in the matter?

Was the publication of the data lawful?

From an English law perspective, blood test results are classed as 'sensitive personal data' under the Data Protection Act 1998 (DPA), and any entity that obtains, holds or uses that data must comply with higher levels of protection afforded by our national legislation, which implements the current European Directive 95/46/EC³ regarding the processing of personal data. The World Anti-Doping Agency (WADA) also has its own International Standard for the Protection of Privacy and Personal Information⁴ that seeks to impose a minimum level of protection of privacy and personal data in those jurisdictions where data protection requirements may not be as stringent as in Europe. This is a mandatory International Standard and all relevant organisations and persons must comply. The IAAF is based in Monaco (which is not part of the European Union) and must comply with the International Standard to protect the privacy of the individuals whose data it holds and ensure that the data held by it is secure and remains confidential.

At present, it is not known how the Sunday Times acquired the data in question, but if the data was held in the UK, the Sunday Times had an obligation to comply with the DPA. In an attempt to balance the often-conflicting rights under Article 8 (right to respect for private and family life) and Article 10 (freedom of expression) of the European Convention of Humans Rights, journalists are able to process personal data without the consent of the individual where there is public interest. Section 32 DPA exempts those processing information for the purposes of journalism from most of the provisions of the DPA that could prevent investigative journalism.