Adopted on 11 February 2025
The European Data Protection Board (EDPB) examined the revised World Anti-Doping Code and its International Standards for Data Protection (ISDP) and Intelligence and Investigations (ISII) to assess their compliance with the GDPR and adopted on 11 February 2025 its Recommendations. While acknowledging improvements, the EDPB did identify some key concerns that require further adjustments.
First, the legally binding nature of the Code varies across Member States, and the EDPB stresses the need for GDPR-compliant national implementations to ensure a consistent level of data protection. Additionally, the roles of World Anti Doping Agency (WADA) and National Anti-Doping Organisations (NADOs) remain unclear, particularly regarding data processing responsibilities within the Anti-Doping Administration and Management System (ADAMS).
The EDPB also raises concerns about the legal bases for processing personal data. Consent under the ISDP may not always be freely given, making it an inadequate legal basis under GDPR. Furthermore, the use of "vital interest" as a justification for data processing appears unjustified in many cases. The EDPB advises that where consent and vital interest do not meet GDPR requirements, NADOs should rely on alternative legal bases outlined in Section 7.1a of the ISDP.
The principle of purpose limitation is another area of concern, as some processing activities lack a clear purpose, and retention periods are not sufficiently justified. The EDPB recommends that the ISDP explicitly include principles ensuring personal data is processed for specific, explicit and legitimate purposes, and that it is adequate, relevant and limited to what is necessary.
Data sharing with third parties is another critical issue. The ISDP’s broad definition of “persons” who can access data requires clarification, and the EDPB recommends establishing stricter conditions for such data transfers. It suggests additional measures to ensure that recipients process data only for specific, legitimate anti-doping purposes, keep data only as long as necessary, and implement appropriate security measures.
Additionally, the ISDP should integrate privacy-by-design principles more effectively, requiring NADOs to implement concrete technical and organisational safeguards. The processing of special categories of personal data, such as health and genetic data, requires stricter measures, and the ISDP should align its definition of “sensitive personal data” with the GDPR.
Finally, the EDPB highlights significant limitations on data subject rights under the ISDP. Restrictions on access and rectification rights are formulated too broadly and may not comply with the GDPR. The EDPB calls for clearer safeguards to ensure that individuals can exercise their rights effectively, as well as the introduction of a right to remedy and compensation for those affected by non-compliant data processing.
To sum up, these recommendations are expected to influence the drafting of the World Anti-Doping Code and its International Standards, which are set to come into effect in January 2027. It remains to be seen how these matters will ultimately be resolved.
If the current code or the contemplated changes impact you, our team is here to offer guidance.
Adopted on 11 February 2025
The European Data Protection Board (EDPB) examined the revised World Anti-Doping Code and its International Standards for Data Protection (ISDP) and Intelligence and Investigations (ISII) to assess their compliance with the GDPR and adopted on 11 February 2025 its Recommendations. While acknowledging improvements, the EDPB did identify some key concerns that require further adjustments.
First, the legally binding nature of the Code varies across Member States, and the EDPB stresses the need for GDPR-compliant national implementations to ensure a consistent level of data protection. Additionally, the roles of World Anti Doping Agency (WADA) and National Anti-Doping Organisations (NADOs) remain unclear, particularly regarding data processing responsibilities within the Anti-Doping Administration and Management System (ADAMS).
The EDPB also raises concerns about the legal bases for processing personal data. Consent under the ISDP may not always be freely given, making it an inadequate legal basis under GDPR. Furthermore, the use of "vital interest" as a justification for data processing appears unjustified in many cases. The EDPB advises that where consent and vital interest do not meet GDPR requirements, NADOs should rely on alternative legal bases outlined in Section 7.1a of the ISDP.
The principle of purpose limitation is another area of concern, as some processing activities lack a clear purpose, and retention periods are not sufficiently justified. The EDPB recommends that the ISDP explicitly include principles ensuring personal data is processed for specific, explicit and legitimate purposes, and that it is adequate, relevant and limited to what is necessary.
Data sharing with third parties is another critical issue. The ISDP’s broad definition of “persons” who can access data requires clarification, and the EDPB recommends establishing stricter conditions for such data transfers. It suggests additional measures to ensure that recipients process data only for specific, legitimate anti-doping purposes, keep data only as long as necessary, and implement appropriate security measures.
Additionally, the ISDP should integrate privacy-by-design principles more effectively, requiring NADOs to implement concrete technical and organisational safeguards. The processing of special categories of personal data, such as health and genetic data, requires stricter measures, and the ISDP should align its definition of “sensitive personal data” with the GDPR.
Finally, the EDPB highlights significant limitations on data subject rights under the ISDP. Restrictions on access and rectification rights are formulated too broadly and may not comply with the GDPR. The EDPB calls for clearer safeguards to ensure that individuals can exercise their rights effectively, as well as the introduction of a right to remedy and compensation for those affected by non-compliant data processing.
To sum up, these recommendations are expected to influence the drafting of the World Anti-Doping Code and its International Standards, which are set to come into effect in January 2027. It remains to be seen how these matters will ultimately be resolved.
If the current code or the contemplated changes impact you, our team is here to offer guidance.