The IAAF blood test data leak - was publishing the data lawful?
On 2 August 2015, the Sunday Times published an article entitled ‘Revealed: sport’s dirtiest secret’ (the Article),1 which claimed that the disclosure of supposedly ‘secret’ data held by the International Association of Athletics Federations (IAAF) revealed “the extraordinary extent of cheating by athletes at the world’s top events”. The Sunday Times and German broadcaster ARD/WDR stated that blood test data had been leaked to them by a whistle-blower concerned about the content (the Database).
In its response to these allegations, on 4 August 2015 the IAAF confirmed that, following internal investigations, it believed that there was no whistle-blower and that the Database had been obtained illegally.2
The Database allegedly contains more than 12,000 blood test results of over 5,000 athletes and the Article has led to finger-pointing in the sporting world. Whatever the position regarding the anti-doping procedures and practices implemented by the IAAF, the Article has placed innocent athletes in the public eye and forced them to defend themselves, some even feeling the need to release extremely personal information into the public domain in order to do so.
The actual Database has not been disclosed by the Sunday Times (reportedly after being threatened by an injunction by the IAAF and promising not to do so). But what is the position from a data protection perspective? What rights did the press have to obtain and hold personal information about 5,000 individuals without their consent? Were they permitted to publish information about the blood tests of athletes? And should the athletes themselves have had any say in the matter?
Was the publication of the data lawful?
From an English law perspective, blood test results are classed as 'sensitive personal data' under the Data Protection Act 1998 (DPA), and any entity that obtains, holds or uses that data must comply with higher levels of protection afforded by our national legislation, which implements the current European Directive 95/46/EC3 regarding the processing of personal data. The World Anti-Doping Agency (WADA) also has its own International Standard for the Protection of Privacy and Personal Information4 that seeks to impose a minimum level of protection of privacy and personal data in those jurisdictions where data protection requirements may not be as stringent as in Europe. This is a mandatory International Standard and all relevant organisations and persons must comply. The IAAF is based in Monaco (which is not part of the European Union) and must comply with the International Standard to protect the privacy of the individuals whose data it holds and ensure that the data held by it is secure and remains confidential.
At present, it is not known how the Sunday Times acquired the data in question, but if the data was held in the UK, the Sunday Times had an obligation to comply with the DPA. In an attempt to balance the often-conflicting rights under Article 8 (right to respect for private and family life) and Article 10 (freedom of expression) of the European Convention of Humans Rights, journalists are able to process personal data without the consent of the individual where there is public interest. Section 32 DPA exempts those processing information for the purposes of journalism from most of the provisions of the DPA that could prevent investigative journalism.
Get access to this article and all of the expert analysis and commentary at LawInSport
Already a member?
Articles, webinars, conference videos and podcast transcripts
This work was written for and first published on LawInSport.com (unless otherwise stated) and the copyright is owned by LawInSport Ltd. Permission is granted to make digital or hard copies of this work (or part, or abstracts, of it) for personal use provided copies are not made or distributed for profit or commercial advantage, and provided that all copies bear this notice and full citation on the first page (which should include the URL, company name (LawInSport), article title, author name, date of the publication and date of use) of any copies made. Copyright for components of this work owned by parties other than LawInSport must be honoured.
- Tags: Anti-Doping | Athletics | Data Protection Act 1998 | Databases | European Convention on Human Rights | European Directive 95_46_EC | European Union | Governance | Human Rights Act 1998 | Information Commissioners Office (ICO) | Intellectual Property | International Association of Athletics Federations (IAAF) | Regulation | World Anti-Doping Agency (WADA) | World Anti-Doping Code (WADC)
- Protecting athletes’ data: an examination of database rights in the UK and EU
- WADA confirms that leaked Athletics Database does not originate from its Anti-Doping Administration & Management System (ADAMS)
- WADA’s Independent Commission to launch investigation into doping allegations against international athletics
- WADA alarmed by widespread doping allegations against international athletics
Abby Brindley is a solicitor in Mishcon de Reya's Private department where she works on a wide range of commercial disputes for both companies and individuals. She has specialist knowledge and interest in the evolving area of data protection and regularly advises on rights and obligations under the Data Protection Act 1998, acting for both individuals and companies. She also provides training on data protection issues for the firm and its clients