Do WADA’s International Standards sufficiently protect athletes’ personal data?

Following the reports earlier this year regarding the acquisition of personal data belonging to athletes by unauthorised persons, including the Sunday Times (as discussed in our article of October 2015¹), many athletes are genuinely concerned with the protection of their private health information entrusted to the World Anti-Doping Agency, National Anti-Organizations and/or International Federations.

This high profile leak raises important questions over sufficiency of the safeguards in place to protect athletes’ personal information (such as blood samples) since athletes must provide such confidential information to comply with the strictures of the World Anti-Doping Code 2015 (the “Code”).

This article examines the safeguarding policy that is designed to ensure that such information is kept safe: the World Anti-Doping Agency International Standard for the Protection of Privacy and Personal Information,² and looks at why significant leaks are still occurring.

The International Standard for the Protection of Privacy and Personal Information (the “Standard”)

The Standard is a mandatory framework that applies to all anti-doping organisations globally. An anti-doping organisation is defined as a signatory to the Code:³

"responsible for adopting rules for initiating, implementing or enforcing any part of the Doping Control process”.⁴

The first version of the Standard came into effect in June 2009 in recognition of the fact that anti-doping organisations are required to collect and process personal data belonging to athletes; a responsibility that should not be taken lightly. The Standard has recently been updated, and the latest version came into effect in January 2015. 5

Data protection and privacy legislation varies significantly between nations and, as such, the Standard sets out the rules with which an anti-doping organisation must comply to meet a minimum level of protection. This set of rules must be adhered to by all organisations worldwide.

Compliance with the Standard obliges anti-doping organisations to ensure that “appropriate, sufficient and effective privacy protections” are implemented,⁶ irrespective of the level of protection offered by national legislation.

The Standard Uncovered

What is personal data, and what personal data can an anti-doping organisation collect and process?

The Standard relates to the protection of data collected as a result of "anti-doping activities" carried out by the anti-doping organisations to identify any violations of anti-doping rules. These activities include conducting testing and carrying out investigations.

Much like our national data protection legislation (the Data Protection Act 1998), the Standard separates personal data into two categories:⁷

1. Personal Information: including the athlete’s name, date of birth, contact details, sporting affiliations, anti-doping test results, and results management. The use of the general term 'personal information' includes 'sensitive personal information' (see below). Information collected about other individuals connected to the athletes, such as their doctor or physiotherapist, would also fall into this category; and
2. Sensitive Personal Information: including personal data such as the racial or ethnic origin of the athlete, whether they have any convictions, and information about their health and genetic makeup (including information obtained from specimens or samples).

The Standard applies to anti-doping organisations that "process" personal data. The term “process” is broad and means the collection, use, storage, filing, analysis, storage etc. of data. However the Standard makes it clear that 'processing' should only be carried out in relation to personal data when required for anti-doping activities, or in order to engage effectively in the fight against doping. Processing must not be carried out by the organisation in breach of applicable privacy or data protection laws.⁸

It should also be noted that the Standard expressly forbids anti-doping organisations to collect unnecessary or irrelevant information from athletes or third-party individuals.⁹ This is worth considering - we have all become accustomed to providing so much personal data to third parties that people rarely question whether the third party actually needs the information they are requesting in order to carry out their service or function.