The Spanish anti-doping agency (AEPSAD) may have to redact the names of athletes investigated for doping, after a court dismissed its appeal against a sanction issued by the country’s data protection agency (AEPD) for failing to protect an athlete’s personal data. As the relevant provisions of a 1999 Spanish data protection law are replicated by the General Data Protection Regulation (GDPR) that came into force in May 2018, the ruling could have implications for anti-doping organisations across the European Union.

The case arose after a 19 July 2018 ruling, in which the AEPD upheld an athlete’s complaint that by including their name in an archive of proceedings, AEPSAD had breached data protection law. It is understood that the AEPSAD’s case against the athlete was dismissed, after they successfully argued that their adverse analytical finding (AAF) was due to accidental ingestion of common medication issued for their son’s illness.

The AEPD found that by publishing the details of the case including the athlete’s name in an archive, AEPSAD had violated Article 7.3 of Spain’s 1999 data protection legislation. This mandates that personal data relating to health can only be collected, processed and transferred for reasons of general interest provided for by law, or with the express consent of the party concerned. 

The AEPSAD acknowledged its error in not anonymising the data but appealed (case 791/2018) to the Audiencia Nacional, arguing that the offence shouldn’t be considered as serious, as the athlete’s name doesn’t constitute health data. The court rejected the appeal, explaining that in the field of sporting regulations, ‘the fight against doping is closely linked to the health of the athletes […] since the use and consumption of certain products can distort individual performance and, therefore, are prohibited in sports competitions but also directly affect the physical condition of the user and, therefore, also their health’.

The Audiencia Nacional outlined that as well as analysing Spanish law, it also analysed European and international law, concluding that data on doping in sport should be considered health data. Although the ruling is only applicable in Spain, its consideration of EU and international law could have implications for other anti-doping organisations. Article 9 of the GDPR, which came into force in European Union Member States (such as Spain) in May 2018, replicates the provisions in Spain’s 1999 data protection legislation (see right).