Combating doping in sport and personal data transfers abroad

Since the entry into force of the Federal Law on the Promotion of Sport and Physical Education (LPSPE), there is a legal basis for the transfer of data to the World Anti Doping Agency. As the data are transferred outside Switzerland, however, a sufficient level of data protection has to be guaranteed by contractual agreement.

The new Federal Law on the Promotion of Sport and Physical Education contains a section entitled Ā«anti-doping measuresĀ» which regulates the collection, processing and exchange of personal data in connection with the fight against doping. We have been contacted by various sports associations who want to know whether under the new law, athletes' health data may be transferred without restriction to the World Anti Doping Agency's (WADA) server which is based in Montreal. The FDPIC examined the situation and has published his opinion.

Under the old law, there were two problems regarding the transfer of athletes' data to WADA's server in Montreal. First, there was no legal basis for the collection, processing and exchange of personal data for the purpose of combating doping. In order to get round this problem, a declaration of consent was obtained from the athletes in question. However, as that consent was not given voluntarily from a data protection perspective, its legal validity was extremely doubtful (cf. our 15th Report on activities 2007/2008, section 1.5.4 in German, French or Italian, as well as our 17th Report on activities 2009/2010, section 1.2.7 in German or French). Secondly, WADA is not bound by the data protection laws of either Canada or the Province of Quebec, since it is not a commercial undertaking but acts for ideological reasons. Since there is therefore an insufficient level of data protection, no data may be transferred to WADA in Montreal. However, according to Article 6 of the Data Protection Act, data transfers in such cases are only permissible if an appropriate level of data protection may be guaranteed by some other manner, e.g. by contract (cf. our 15th Report on activities 2007/2008, section 1.5.3).

The new LPSPE introduced a solution to the first issue. Both, the collection and processing of personal data for the purposes of combating doping, and the exchange of such data with national or international anti-doping agencies is now governed by legal provisions and consequently there is no need to obtain the prior consent of the person concerned (cf. section 1.2.4 of the present Report on activities in German or French). This not only facilitates the work of the anti-doping agencies, but it also introduces greater clarity for the athletes with regard to their rights and obligations during doping controls.

On the other hand, the new law did not simplify the situation with regard to the need to secure an adequate level of data protection in the recipient country when data are transferred abroad. On the contrary, Article 25, paragraph 4 of the LPSPE explicitly states that no data may be transferred if the recipient is unable to guarantee a sufficient level of data protection. The provision repeats the general rule established in the Data Protection Act and makes it clear that although the fight against doping is entirely legitimate, it may not lead to a situation where the personality rights of the individual concerned are violated.

We have informed the sports federations that contacted us on the subject that even under the new law, data protection must be contractually guaranteed, in other words that contracts with WADA need to be negotiated or, if there is a pre-existing one, maintained.