In the wake of the recent Beijing Olympic games and with a view to preserving a level playing field in international sports, the Anti-Doping Organizations (ADOs) — consisting of sports movements and governments — are exposing athletes worldwide to more rigorous and more frequent doping tests.

As members of the World Anti-Doping Agency (WADA), ADOs must comply with WADA’s Anti-Doping Code when testing athletes for doping and processing their personal data for that purpose. The processing of personal data for anti-doping purposes is a contentious issue, given the fact that data and samples collected from athletes are freely exchanged between the different authorities and across borders.

The Standard vs. the Code

In light of the controversy surrounding data processing in doping cases, WADA introduced an international standard for the protection of athletes’ privacy and personal information. On September 20, 2008, WADA approved the final version of the Standard, but urged for continued cooperation and dialogue with European governments to better protect the privacy of athletes.  The Standard lays down minimum privacy protection and provides guidance to national and international ADOs, as well as event organizers regarding the collection and further handling of athletes’ personal data. The Standard should be read in conjunction with the Code, in particular Article 14, which deals with public disclosure and data privacy. Both the updated version of the Code and the Standard are expected to enter into full force and effect on January 1, 2009.

The Standard vs. the EU Data Protection Directive

On August 1, 2008, the Article 29 Working Party published its Opinion 3/2008, which assesses the Standard under the principles of the EU Data Protection Directive. While Opinion 3/2008 considers the previous version of the Standard (before WADA approved the final version on September 20, 2008), it still provides a useful discussion on the possible shortcomings of the Standard from a privacy perspective.

First, the Working Party welcomes the fact that the Directive is mentioned in the preamble of the Standard and that the Standard emphasizes that data protection issues should not be ignored by ADOs. The Working Party adds, however, that the Standard does not provide the high level of data protection imposed by the Directive.

For instance, the Standard raises concerns with relation to the Anti-Doping Administration and Management System (ADAMS), a Web-based database management tool for data entry, storage, sharing, and reporting designed to assist stakeholders and WADA in their anti-doping operations. It is not clear what kind of sensitive data may be processed in ADAMS (e.g., race, gender, etc.) and what rules and policies apply to their processing.

Furthermore, the legal basis invoked by WADA for processing of personal data raises questions. WADA claims that athletes’ consent is obtained, but, as the Working Party notes, under the Directive consent must be informed and freely given. The Working Party apparently is not convinced that the consent obtained from athletes meets this test.

In addition, the Working Party queries whether WADA needs to gather genetic information relating to athletes for the purpose of preventing doping in sports. The Working Party also invites WADA to agree on a maximum retention period for athletes’ personal data, with an obligation to erase the data when it is no longer needed for doping control purposes.

The Article 29 Working Party’s Verdict

Suitable data protection ensures that doping in sports is combatted with appropriate means, while respecting athletes’ privacy rights. However, while the Standard is a step in the right direction, the question remains whether it offers an adequate level of data protection in accordance with the Directive. The Working Party does not seem to think so. Whether WADA will take all of the Working Party’s comments and recommendations into account and amend the Standard accordingly, remains to be seen.


The final version of the Standard can be found here.

The updated Code (2009) can be found here.

The orginial Code (2003) can be found here.