Anti-Doping data protection notice
Doping Control Related Data
1. This Information Notice is intended to set out in more detail how your Doping Control Related Data (as defined below) will be used and processed by World Rugby and other Persons for the purposes of implementing the Anti-Doping Rules set out in World Rugby Regulation 21 in accordance with the Code in order to ensure harmonised, coordinated and effective anti-doping programmes for detection, deterrence and prevention of doping. Any documentation or notice provided to Players by World Rugby, any Anti-Doping Organisation or Delegated Third Party acting under World Rugby Regulation 21 (including any informed consent forms, tournament participation terms or agreements, doping control forms, Out-Of-Competition doping control notifications or forms or any other forms or documents relating to Anti-Doping Activities) should be read in conjunction with this Information Notice.
World Rugby has its principal place of business at World Rugby House, 8-10 Pembroke Street Lower, Dublin 2, Ireland. World Rugby’s data protection officer is Liam McKenna, and you can contact the data protection officer by emailing dataprotection@worldrugby.org. World Rugby’s data protection officer is World Rugby’s designated Person for the purposes of paragraph 4.5 of the WADA International Standard on the Protection of Privacy and Personal Information.
For more information on World Rugby’s privacy practices, policies and protocols, please see here: https://www.world.rugby/privacy-policy.
Unless defined in this Information Notice, capitalised terms used in this notice have the meanings given in World Rugby Regulation 21.
Categories of Data
This section describes the types of data that might be collected about you when you engage with the doping control process. It includes biological data processed when you provide a sample, and medical data from documents like Therapeutic Use Exemptions.
2. Your Doping Control Related Data is any and all data with respect to the Doping Control process related to you (including test distribution planning, Sample collection and handling, laboratory analysis, records of the Education you have been provided with, Results Management, hearings and appeals), Athlete Biological Passport information, intelligence gathered as part of Anti-Doping Activities, Therapeutic Use Exemptions, whereabouts (including your home address) and other data relating to you which is collected pursuant to Anti-Doping Activities under World Rugby Regulation 21.
3. The laboratory analysis results may include, without limitation: detection of a Prohibited Substance, its Metabolites or Markers or any evidence of use of a Prohibited Method identified on the Prohibited List; detection of the presence of other substances not included on the Prohibited List as may be directed by WADA pursuant to a monitoring programme described in Article 4.5 of the Code; longitudinal profiling of haematological parameters such as haemoglobin and red blood count over a specified period of time as well as testosterone/epitestosterone ratio; and/or results from other tests that may be developed in the future to identify the presence of Prohibited Substances or Prohibited Methods.
4. Some of your Doping Control Related Data constitutes “personal data” as defined under applicable data protection or privacy laws and “Personal Information” as defined in the WADA International Standard on the Protection of Privacy and Personal Information. Some of your Coping Control Related Data may also constitute “special categories of personal data” as defined under applicable data protection or privacy laws and “Sensitive Personal Information” as defined in the WADA International Standard on the Protection of Privacy and Personal Information.
Responsibility
This section describes what responsibilities the organisations who collect your anti-doping information have in terms of storage, security and processing, and sets out the ways in which World Rugby will use and process your data. It also sets out your responsibility to ensure that the information provided by you, or on your behalf is accurate.
5. Your Doping Control Related Data will be collected by an Anti-Doping Organisation (including without limitation World Rugby) acting pursuant to Regulation 21 and/or the Code (“the Testing Authority”), or through an authorised collection authority and/or results management authority. The Testing Authority will be responsible for protecting your information in accordance with its local laws and regulations, the WADA International Standard on the Protection of Privacy and Personal Information and Regulation 21 and/or the Code or equivalent anti-doping rules.
6. The Testing Authority will use a data-management system (which may be in electronic form including but not limited to the ADAMS system) to process and manage, including disclose to authorised recipients, your Doping Control Related Data. The management, handling and sharing of your Doping Control Related information on ADAMS will be governed by WADA’s ADAMS privacy policy which is available here: https://adams-help.wada-ama.org/hc/en-us/articles/360012071820-ADAMS-Privacy-Policy .
7. You will be responsible for ensuring that all information which you provide or that is provided on your behalf by other parties, such as your Union, is accurate and up to date, including with respect to your whereabouts. Please note that failure to provide and/or update accurate whereabouts information is likely to constitute an anti-doping rule violation, whether the failure is intentional or negligent. Where you have been provided with user access to ADAMS, you will have an opportunity to review personal information relating to you which is stored on ADAMS, and will have the ability to update any parts of such personal information which are inaccurate or out-of-date. If you are provided with a password to access to ADAMS or any other data-management system you will be responsible for keeping this password confidential at all times. Should you inadvertently or otherwise disclose such password you should contact the Testing Authority immediately.
8. We will process your Doping Control Related Data (which may include special categories of personal data) for the following purposes:
a) to determine whether your use of a Prohibited Substance or Prohibited Method is consistent with the provisions of a TUE (which processing will be proportionate and relevant to the making of this determination in accordance with Regulation 21 and/or the Code and/or the International Standard for Therapeutic Use Exemptions);
b) in order to perform Testing (e.g., test distribution planning, creating test missions, Sample collection, Sample handling, Sample transport to the laboratory or associated matters) in accordance with Regulation 21 and/or the Code and/or the International Standard for Testing and Investigations;
c) in order to track and monitor whereabouts information relating to you so that we can fulfil our Testing obligations under the Code and conduct an effective programme to detect doping;
d) gathering of Athlete Biological Passport information in accordance with our obligations under the Code and in order to carry out effective doping detection programmes;
e) in order to engage in investigations and carry out Results Management (including associated disciplinary hearings, appeals and adjudications) for the purposes of investigating and establishing one or more anti-doping rule violations in accordance with Regulation 21 and/or the Code and/or the International Standard for Results Management and the International Standard for Testing and Investigations; and
f) the collecting of education records (details relating to anti-doping education courses you have attended or completed) in order to verify whether you have received the level of anti-doping education appropriate to your involvement in the Game and to ensure that anti-doping education is delivered effectively.
Disclosures
This section describes how data collected about you, and that you provide as part of the doping control process, will be shared with other organisations for the purposes of operating such controls.
9. Your Doping Control Related Data will, where appropriate, be made available to authorised Anti-Doping Organisations, in accordance with Regulation 21 and/or the Code or equivalent anti-doping rules, to enable them to administer their anti-doping programmes. These Anti-Doping Organisations may include, without limitation, National Anti-Doping Organisations, international or national sporting federations including without limitation World Rugby, Major Event Organisations and National Olympic Committees. Where this occurs, such Anti-Doping Organisations will be responsible for protecting your information in accordance with their local laws and regulations, the WADA International Standard on the Protection of Privacy and Personal Information and Regulation 21 and/or the Code or equivalent anti-doping rules. Your Doping Control Related Data may also be shared with any third party agent (including Delegated Third Parties) where relevant to their activities and with Unions and Associations in connection with Results Management, reporting and sanctioning processes and to enable Unions and Associations fulfil their obligations under Regulation 21.
10. Your Doping Control Related Data will also be made available, in part, to WADA, which will need to process certain information in order to fulfil its obligations and responsibilities under the Code. In such case WADA will be responsible for protecting your information in accordance with its local laws and regulations, the WADA International Standard on the Protection of Privacy and Personal Information and the Code, and its own privacy policy which you can review here: https://www.wada-ama.org/en/privacy-policy.
11. WADA accredited laboratories will need to receive your Samples and possibly other data relating to you; however, such laboratories will only be provided with de-identified, key-coded data and Samples that will not enable the laboratories to identify you.
12. The Anti-Doping Organisations, WADA and WADA accredited laboratories will process your Doping Control Related Data only for the purpose of ensuring harmonised, coordinated and effective anti-doping programmes.
13. Anti-Doping Organisations, WADA, and WADA accredited laboratories will not disclose any of your Doping Control Related Data other than to those persons within their organisation who require it for Doping Control purposes. Each of the organisations accessing and using any of your Doping Control Related Data may only do so in order to fulfil their responsibilities and obligations arising under Regulation 21 and/or the Code or equivalent anti-doping rules, which primarily involve the establishment and maintenance of anti-doping programmes and ensuring appropriate information sharing as provided for under Regulation 21 and/or the Code or equivalent anti-doping rules.
14. Your Doping Control Related Data (in particular data relating to an actual or potential anti-doping rule violation) may be Publicly Disclosed in accordance with the requirements of, and subject to satisfaction of the conditions set out in, the Code, the WADA International Standard on the Protection of Privacy and Personal Information and Regulation 21.14.3.
Legal basis for processing Doping Control Related Data
15. Our legal basis for processing (which in this notice shall have the meaning given in applicable law and shall include, for the avoidance of doubt, retaining and disclosing) your Doping Control Related Data is the consent you provide in any applicable Doping Control form (or other applicable consent forms) and/or applicable law which provides for or requires such processing and/or the necessity of such processing in the performance of a public interest task, for reasons of substantial public interest or public health, for the fulfillment of a contract, and/or to protect your vital interests or those of another Person. We may also need to process your Doping Control Related Data, regardless of whether you withdraw or refuse to grant consent, where necessary to establish, exercise or defend legal claims (including in relation to investigations into suspected violations of the Code and/or Regulation 21 or proceedings involving suspected violations of the Code and/or Regulation 21 or equivalent anti-doping regulations).
International Transfers
16. While World Rugby is established in the European Economic Area (EEA), your Doping Control Related Data may be transferred or made available to persons or parties, including WADA, Anti-Doping Organisations and Delegated Third Parties, located outside of the EEA, in countries where you train, compete or travel. In some other countries, data protection and privacy laws may not provide equivalent protections to those provided in the EEA. If we transfer personal data to such locations, save where derogations apply under applicable laws and regulations, we will ensure that appropriate measures are in place to comply with our obligations under applicable law governing such transfers. Such measures may include entering into ‘standard contractual clauses’ in the form approved by the European Commission. If you would like to receive further details of the measures that we have taken in this regard, please contact us using the contact details set out below.
Your Rights
This section describes your rights with regards to data about you that is obtained and processed as part of your engagement with doping control, and how you can submit a compliant if you consider that it has not been used or processed correctly.
17. You may have the following rights under the WADA International Standard on the Protection of Privacy and Personal Information in relation to your Doping Control Related Data: (a) the right to be informed by us whether we process your personal information; (b) the right to be provided with certain information about our processing of your personal information and (c) including rights to obtain a copy of your Doping Control Related Data.
18. You also have the following rights under applicable law in relation to your Doping Control Related Data, subject to certain exemptions: a) the right to access your personal data; b) the right to request the rectification and/or erasure of your personal data; c) the right to restrict the use of your personal data; d) the right to object to the processing of your personal data or withdraw your consent to the processing of personal data; and e) where we are processing personal data based on your consent, the right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format or to require us to transmit that data to another controller;
19. To the extent that you have any complaints about the processing of your Doping Control Related Data, you may contact World Rugby by sending an email to dataprotection@WorldRugby.org or by writing to us at the following address: World Rugby Limited, World Rugby House, 8-10 Pembroke St Lower, Dublin 2, Ireland. You may also consult with the Testing Authority, WADA (www.wada-ama.org), your Union and/or your National Anti-Doping Organisation, as appropriate.
If you are unsatisfied with any response you receive from us, you have the right to lodge a complaint relating to the processing of your personal data to the Irish Data Protection Commission by using the following link: https://forms.dataprotection.ie/contact. If you wish, you may also contact another data protection supervisory authority of your choice. You can also notify WADA of your complaint, who may then review the complaint in accordance with the International Standard for Code Compliance by Signatories.
Data Retention
20. World Rugby will retain each category of your Doping Control Related Data in accordance with the retention periods (and based on the rationale) set out in Annex A to the WADA International Standard for the Protection of Privacy and Personal Information. Where a Results Management decision relating to you is Publicly Disclosed and is considered to form part of important legal precedent and part of the public record, such decision may be retained indefinitely. We will also retain your Education records in accordance with our retention policies that are in place for our training and education practices (please see: [insert Iris privacy statement link) for further details.
Objecting, withdrawing consent or refusing to participate in Doping Controls
This section describes your right to withdraw your consent to the use and processing of your personal data, and what the consequences are for you if you choose to do so.
21. You understand and accept that the your submission of your Doping Control Related Data (including via you participation in Doping Controls including Testing) to any Person, and the collection, processing, disclosure and use of such information in accordance with, and for the purposes of implementing these Anti-Doping Rules (in accordance with the International Standard for the Protection of Privacy and Personal Information and as otherwise required to implement these Anti-Doping Rules) is a condition of your membership, accreditation and/or participation in the Game of Rugby.
22. Notwithstanding the above, you have the right to object and/or to withdraw your consent to the processing of your Doping Control Related Data, although in that event, and as noted above, it still may be necessary for World Rugby, or another Testing Authority or any Deleted Third Party, and WADA to continue to process certain parts of your Doping Control Related Data, where permitted by applicable law, to fulfil obligations and responsibilities arising under Regulation 21 and/or the Code or equivalent anti-doping rules and applicable laws, including to (a) commence or pursue analyses or investigations involving suspected anti-doping rule violations relating to you, (b) conduct or participate in proceedings involving suspected anti-doping rule violations relating to, and/or (c) establish, exercise or defend against legal claims.
23. You should also note that refusing to disclose or provide your Doping Control Related Data (including, without limitation, by refusing to participate in Doping Controls, including Testing), or objecting or withdrawing your consent to the processing or disclosure of your Doping Control Related data, may make anti-doping testing and procedures in accordance with Regulation 21 and/or the Code and/or equivalent anti-doping rules, as applicable, and the International Standards impossible. In such case a withdrawal of consent or objection could be equivalent to an anti-doping rule violation (whether it falls within the definition of Tampering or otherwise) which may exclude you from further participation in the Game, and may result in disciplinary or other sanctions being imposed upon you, such as disqualification from competitions in which you are scheduled to participate or the invalidation of results arising from prior competitions.