DANIEL COOPER is head of Covington & Burling's European privacy and data security practice. Based in London, Cooper advises sports associations and businesses on European privacy and data protection matters. He spoke with SBD Global about his work with the World Anti-Doping Agency, athlete privacy issues and the use of technology in combating doping in sport.
On privacy issues in sport…
Daniel Cooper: It’s quite remarkable to me how now we’re in an era where there’s a lot more focus on athlete privacy and privacy issues. Partly, that’s to do with the fact that in organized sport all professional athletes have to undergo a drug testing regime. Maybe five or 10 years ago people didn’t really think, “What are the privacy interests of athletes when they undergo these processes?” To give you a sense of the privacy implications, every professional athlete today has to log their whereabouts for a certain period of time every day, whether they are on holiday, whether they are training or competing. The reason for this is that if they don’t do it, then it makes it much easier for them to take prohibited substances. Part of their commitment to participate in organized sport is to contribute information about their whereabouts as well as participate in drug tests if someone shows up at their door and says, “I’m here to take a blood or urine sample.” So, all top athletes will be aware of this. Ten or 15 years ago, the field was very patchy. Some countries were abiding by international commitments to clean up their sports and have drug-free sports. And others were doing a better job. It’s widely known that the Russians were probably pumping their athletes full of prohibited substances. In other countries they were doing a better job, but it was pretty rife I would have to say. Gradually, over time the testing techniques have gotten better. The commitments among sports bodies to actually test their athletes have become enhanced. Countries are becoming more committed so there are now more international conventions like UNESCO Convention Against Doping in Sport whereby countries commit to putting in place anti-doping rules. That has driven privacy issues in the sense that now more and more athletes and sports bodies and sports ministries and governments are aware that privacy interests of athletes are highly implicated through these drug-testing regimes. They’re collecting a lot of medical health data. They’re collecting samples of blood and urine. They’re testing it for substances, so you learn a lot about an athlete by virtue of their participation in sport. That’s on the sports side. The other thing is on the legal side. Now we have many laws that actually regulate personal data. This goes a little bit back to why my practice took off. In 1998, the Europeans enacted a directive of essentially a European level law to regulate the processing of personal data. That was kind of a watershed moment and a lot of European countries started to regulate the production of personally identifiable information. Other countries caught on. Now even the United States regulates it to a degree. So those twin factors drove and increased attention on athlete privacy and privacy in sports generally.
On dealing with different privacy laws from country to country...
Cooper: Because the legal regimes differ from continent to continent and country to country, it may be easier in some countries to conduct investigations than in others. When athletes sign up to participate in sport, they are meant to, and they should, consent to having their information and data and samples collected for anti-doping purposes, which would include investigative reasons. So off the bat you think, “OK, everything’s kosher because they’ve agreed to this.” In regions, for instance, Europe, there are some markets or regulators that are skeptical that athletes really have full valid consent because it’s really a condition of participating in sport. They don’t have a choice. In some European countries we’ve seen anti-doping organizations encounter difficulties because of the skepticism of those consents. I’d say in some countries it’s easier than others. There’re these high-level political commitments to enable anti-doping investigations to take place, but it doesn’t always percolate down to the levels where regulators are looking at applying their data protection laws to sports bodies. So it’s somewhat variable.
On sports associations’ concerns...
Cooper: They want to get the law right. They don’t want to breach anyone’s rights and their privacy interests. They want to be respectful of those and comply with the relevant standards and laws. For instance, we work with the UK Anti-Doping Agency. It’s a quasi-governmental body. They’re interested in getting advice on the forms that other sports bodies provide to athletes to make sure it contains the right elements to inform athletes about what to expect with respect to their data and what happens to it. They’re interested in understanding whether and to what extent they can share athlete data with law enforcement bodies who may be investigating associated crimes, because in many countries dealing in prohibited substances is illegal. They’ll come to us and want to make sure that they’ve dotted their I’s, crossed their T’s, not breached any laws and followed all the relevant standards that now apply to practice sport.
On the biggest challenge in revising WADA’s int’l standards...
Cooper: There are so many different agendas that we discovered when drafting the standard. Oddly, in countries which had data protection rules, you would have thought they would have been the most supportive. But in some cases, they felt a little bit threatened by the fact that there was going to be an international standard regulating sport, which is a little surprising. The countries that didn’t have data protection laws and were going to have to comply with the standard seemed to be amenable to putting in place something that their laws didn’t cater for, which was a little bit counterintuitive. There are a lot of different agendas that we found and a lot of politics, unfortunately, in negotiating and agreeing a standard that has international applicability. And I guess that’s to be expected. From our perspective, as legal counsel to the World Anti-Doping Agency, we wanted to produce something that was credible, that did the job, that both protected athlete privacy, but enabled anti-doping activities to be pursued. That was our intention, but we did encounter various agendas that we weren’t anticipating. Ultimately, we did succeed in putting out and assisted WADA prepare a standard that was the first of its sort. Nothing like this had been seen before. Currently, there’s no international law governing the processing of personal data. What we were doing was, in a very high-profile industry, sport, generating a standard that had international applicability which would regulate parties in countries without data protection concepts or laws and regulating parties and countries that had very established and mature regimes. So trying to get that balance right was really fascinating and challenging. Hopefully we succeeded.
On how technology is changing privacy and data security...
Cooper: Now with new technology in sport you can do a lot. One aspect is with collecting doping data. Formerly you would test an athlete and you kind of had a sense at that time whether they were doping, but you couldn’t look prior to that time. But now what they’re able to do with things like blood passports is do longitudinal profiles of an athlete over time. So you build up a much more detailed sense of what their blood parameters should look like when you test them. It makes it much harder to cheat because you can combine it with their whereabouts and expect their results to fall into a certain range. If they don’t, there’s a high suspicion that they’re doping. It makes it really tough. You can learn a lot more about athletes and what they’re doing and where they’re going than formerly. And technology makes it easier to share this information too. There’s now an important shared platform for sharing with data called the ADAMS (Anti-Doping Administration & Management System) database. It’s run by the World Anti-Doping Agency and enables organizations involved in anti-doping and sports bodies to share the data internationally. So it’s much harder for an athlete to go off to Tahiti to train and dope, and then come back to another jurisdiction to actually participate. There’s sharing of data between various parties to make it harder to elude detection.
