The Privacy Commissioner of Canada recently announced the outcome of its investigation into the World Anti-Doping Agency (WADA), concluding a years-long examination of the organization’s data-sharing practices.
The investigation followed a complaint that we filed with the Privacy Commissioner. We alleged WADA violated Canadian privacy law by disclosing athletes’ doping data to international sport federations for the purpose of sex testing.
In order to resolve the commissioner’s investigation, WADA has agreed to adopt remedial measures to ensure that doping data under WADA’s control is used only for anti-doping purposes.
While WADA agreed to the measures, it has maintained that it did not violate privacy laws. At the same time, it has signalled a willingness to work with regulators around data protection.
The decision is expected to have significant implications for sex-testing policies in women’s and girls’ sport, and the journey to reach it reveals a broader problem concerning data protection in international sport.
Complaint grounded in research
Our complaint was based on our own peer-reviewed research published in August 2024 showing that doping data under WADA’s control was being accessed by international sport federations to monitor athletes’ blood testosterone levels and determine their eligibility to compete in women’s sport.
These international federations have eligibility regulations banning women with sex variations and transgender women from women’s sport, unless their testosterone levels fall below certain thresholds.
Our study examined how WADA’s Anti-Doping Administration and Management System (ADAMS) — a database containing doping test results — enabled this data sharing.
We found that when international federations access doping data in ADAMS for sex-based eligibility determinations, there is a disclosure of that data by WADA that is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). WADA, a Montréal-based organization, became subject to PIPEDA in 2015 in respect of its collection, use and disclosure of personal information for interprovincial and international activities.
Legal and ethical concerns
In our view, WADA’s disclosure of doping data for sex testing violated PIPEDA in two ways.
First, the disclosures occurred without the knowledge or consent of athletes. Second, the disclosures were not for an appropriate purpose under the law. It was inappropriate due to the lack of scientific evidence and lack of consensus that women with testosterone levels above the thresholds have a competitive advantage.
In addition, the data disclosures could cause significant harms to women athletes, including stigma, humiliation and the loss of business and professional opportunities.
Concerns about such practices were already raised by human rights organizations and investigative journalists.
Nonetheless, WADA’s 2021 World Anti-Doping Code permitted international sport federations to use doping data for purposes unrelated to anti-doping, including monitoring the eligibility of transgender athletes.
This permissive stance enabled the expansion of sex-testing policies by international federations.
Response to the complaint and investigation
Initially, WADA’s response to the privacy complaint suggested it viewed the issue as relatively minor, both in comments to the media and in its own internal board meetings.
This position was reflected in early drafts of the 2027 World Anti-Doping Code, which maintained the ability of international sport federations to use doping data for purposes unrelated to anti-doping, including sex testing.
That approach shifted after the Privacy Commissioner of Canada, Philippe Dufresne, launched a 16-month investigation into WADA in November 2024.
The inquiry ultimately led WADA to agree to prohibit international sport federations and anti-doping organizations from using doping data stored in ADAMS for purposes other than anti-doping.
WADA has since revised the 2027 World Anti-Doping Code to include this prohibition. It must now communicate these changes to relevant organizations and develop mechanisms to ensure compliance.
This outcome is likely to force international sport federations that have relied on doping data in ADAMS for sex testing to rethink how they regulate eligibility in women’s and girls’ sport — including considering more gender-inclusive approaches for competitions.
A reactive approach to athletes’ rights
While the outcome of the investigation is a success for athletes’ data-protection rights, it’s disconcerting that it was needed in the first place.
Privacy experts and scholars have long criticized the global anti-doping system for not respecting athletes’ data-protection rights.
Too often, international sport organizations deprioritize the human rights of athletes in their quest to govern sport. This stems from their lack of accountability to athletes and the mistaken belief that they are outside the reach of national legal systems.
As a result, protections for athletes’ rights often occur only after an international sports organization is compelled or pressured to do so through legal processes.
Legal challenges ahead for global sport
These concerns are increasingly being tested through legal challenges.
The Court of Justice of the European Union is considering whether the mandatory public disclosure of athletes’ anti-doping rule violations complies with the EU’s General Data Protection Regulation.
A ruling against such practices will require significant changes to the anti-doping system — something WADA could have pursued years ago if greater attention was paid to athletes’ data protection rights.
Read more: The return of sex testing in sport risks harming women athletes rather than protecting them
Similar issues are emerging elsewhere in sport. The International Olympic Committee’s recent decision to require genetic sex testing for women’s events likely violates the data protection laws of many jurisdictions. Despite this, the IOC is pushing ahead with its policy.
As a result, athletes and their advocates must continue to seek the intervention of courts and regulators to ensure athletes’ data protection rights are upheld.
The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.
This article was originally published on The Conversation. Read the original article.
