Editor's note: Rhys was an intern at the T.M.C. Asser Institute. He now advises on investments and Notre acquisitions in sport (mainly football) via Lovelle Street Advisory. Following a career as a professional athlete, Rhys has spent much of his professional life as an international sports agent, predominantly operating in football. Rhys has a Bachelor of Laws (LL.B) and a Bachelor of Philosophy (B.Phil.) from the University of Dame, Sydney, Australia. He is currently completing an LL.M at the University of Zurich in International Business Law / International Sports Law.

Having looked at the different types of investors in football in part one of this two-part blog series, “A non-exhaustive Typology”, it is fitting to now consider the regulations that apply to investors who seek to build a portfolio of football clubs.

One way to measure the momentum of a particular practice and how serious it ought to be taken, might be when that practice earns its own initialism. Multi-club ownership or MCO as it is increasingly known today, is the name given to those entities that have an ownership stake in multiple clubs. Within the little research and writing that has been undertaken on the topic, some authors submit that investors with minority stakes in multiple clubs ought not to be captured by the MCO definition.  This position appears problematic given some of the regulations draw the line at influence rather than stake.

There are now approximately 50 MCO’s across the football world that own approximately 150 clubs.^[1] Given the way MCO is trending, one might consider it important that the regulations keep up with the developing MCO practice, so as to ensure the integrity of football competitions, and to regulate any other potentially questionable benefit an MCO might derive that would be contrary to football’s best interests.

In this blog, I focus on the variety of ways (and levels at which) this practice is being regulated.  I will move through the football pyramid from member associations (MA’s) to FIFA, laying the foundations to support a proposition that FIFA and only FIFA is positioned to regulate MCO.

i)               The Cases that Shaped the MCO Regulatory Landscape

The ENIC and Red Bull cases essentially shaped MCO regulations, at least for UEFA.  For a comprehensive analysis of the cases, I would encourage one look at both “Multi-Club Ownership in European Football – Part I: General Introduction and the ENIC Saga” and “Multi-Club Ownership in European Football – Part II: The Concept of Decisive Influence in the Red Bull Case” by Tomáš Grell.

ENIC CASE[2]

The ENIC case featuring proceedings before the Court of Arbitration for Sport and before the European Commission, made its way to such bodies because London Stock Exchange listed entity, ENIC (English National Investment Company), owned stakes in both AEK Athens and SK Slavia Prague, that were set to play in the same UEFA club competition. At that point in time, UEFA had adopted regulations that made entry to UEFA club competitions conditional upon a club having not (i) held or been dealing in the securities or shares; and refrained from (ii) being a member; (iii) being involved in any capacity whatsoever in the management, administration, and/or sporting performance; and (iv) having any power whatsoever in the management, administration and/or sporting performance - of any other club participating in the same UEFA club competition. Furthermore, an individual or entity was prohibited from exercising control over more than one club participating in the same UEFA club competition.

The Committee for the UEFA Club Competitions had initially ruled that only SK Slavia would take part in the 1998/99 UEFA Cup. Not satisfied with that ruling, on 15 June 1998, AEK Athens and SK Slavia Prague filed a request for arbitration with CAS and simultaneously sought interim relief which was given, allowing both clubs to compete in the 1998/99 UEFA Cup. On 20 August 1999 however, the CAS held that the Original Rule was valid and that UEFA could apply the rule moving forward. Given the blow this dealt to ENIC’s football business strategies, on 18 February 2000, ENIC lodged a complaint with the European Commission and argued anew that the UEFA rules were contrary to EU competition law. The Commission was satisfied that the Original Rule was valid in that it sought to protect the integrity of UEFA competitions, rather than to restrict competition, hence seeing no violation of the relevant EU competition laws.

RED BULL CASE[3]

The current rules encapsulated in Article 5 of the UCL Regulations are distinct from the Original Rule in that one of the standards that would render a club unable to participate in a UEFA competition is if an individual or entity is able to exercise by any means a “decisive influence” in the decision-making of more than one club in that competition.

In 2017, RB Salzburg and RB Leipzig had both secured places in the 2017/18 UCL. Not long after, the UEFA General Secretary expressed concern with the Club Financial Control Body (CFCB), and the Adjudicatory Chamber of that body agreed that the clubs had failed to satisfy the criteria set out in the rules. The substantial levels of sponsorship received by Red Bull and certain individuals linked to the decision making of both clubs inter alia, were flagged as reasons for breaching the threshold.

However, and following some quite deliberate and specific changes, the CFCB Adjudicatory Chamber accepted compliance reports that RB Salzburg had cut ties with certain individuals, reduced the amount of sponsorship money paid by Red Bull and were satisfied that a cooperation agreement between the two clubs had been terminated.  The CFCB Chief withdrew his objection and RB Salzburg and RB Leipzig were admitted to the 2017/18 UCL.

ii)              Member Associations and Motives

Whilst one could simply list the national association’s MCO regulations, the reality is that for the MA’s that have express regulations, they are largely of a similar flavour to that of their Confederation. One might find the varying motivations of MA’s in enacting MCO regulations of more interest. One key feature is that some of the MA’s regulate based on MCO within their own nations, and some concern themselves with MCO even outside of the nation in which the MA governs football. This is where an MA’s motivations are evident.

Scotland

Scotland for instance, regulates MCO via Article 13 of the Articles of Association of the Scottish Football Association and refers to the section as “Dual Interests in Clubs”.[4]  It is understood that Scotland have a high standard when it comes to MCO, so as to ensure that its competition does not become the reserve competition to the English Premier League or another larger league.  With that in mind, one can then understand why Mike Ashley’s attempt to increase an already 8.92% to 29.9% shareholding of Rangers FC was rejected. The Newcastle United owner was not given written permission as is required per Article 13, as he had signed an agreement that he would not own more than 10% of the club and would not exercise influence on the board.

"The Board, under Article 13 of the Scottish FA Articles of Association, is required to have due regard to the need to promote and safeguard the interests and public profile of association football, its players, spectators and others involved with the game. This test is set out in full in Article 13.6."

Italy

Not too long ago, one was free to own more than one club in Italy (i.e. Aurelio De Laurentiis’ ownership of S.S.C. Napoli and S.S.C. Bari), but in recent months MCO in the Italian context has been headline material, with U.S. Salernitana 1919 promoting to the Serie A, a club owned by Claudio Lotito who also owns S.S. Lazio. The newly enacted Article 16 bis of the NOIF FIGC provides that an individual or entity cannot own two or more clubs in Italy, in the same competition.  On Thursday 30 September 2021, the FIGC announced that ownership of more than one professional club would be prohibited, “for those companies that should rise to Lega Pro from the Serie D” (translated), and multi-club owners would need to sell their (other) clubs “by the beginning of the 2024/2025 season”.

The result of this is retroactive in effect and one can reasonably suspect that the legal teams for these wealthy multi-club owners will be instructed to explore all options for a favourable outcome in courtrooms and other relevant decision-making bodies. One can simultaneously hold a view that MCO ought to be regulated, and concede that, when these owners bought these clubs, they did so on the representation that it was legal and they were free to do so. A forced sale as opposed to a willing sale distorts the market and what a willing buyer and willing seller would have otherwise settled on for a purchase price.  Flowing from the above, club owners can expect well below market rate offers, as has been the case reportedly with Salernitana, given they must sell. 

iii)             The Confederations

Most of the MCO regulations of Confederations refer to the concern of jeopardisation of the integrity of a match or competition. The regulations largely capture the substance of Article 20(2) of the FIFA Statutes which will be expanded upon below. For instance, the OFC regulation found at Article 15 (3) of the OFC Statutes, states that  ‘Member Associations shall ensure that no natural or legal person (including holding companies and subsidiaries) exercise third-party control in any manner whatsoever (in particular through a majority shareholding, a majority of voting rights, a majority of seats on the board of directors or any other form of economic dependence or control etc.) over more than one club or group whenever the integrity of any match or competition could be jeopardised.’  One will find almost verbatim, the same provision at Article 12(3) of the CAF Statutes and at Article 17(3) of the CONCACAF Statutes.

There is a distinction to be made however at confederation level, between MCO regulations applying specifically to the MA’s that fall under the Confederations, or to competitions hosted by the Confederation. Given the noise both the ENIC and Red Bull cases made, the most renown MCO regulations are those that apply to UEFA competitions, but consider also how CONMEBOL prohibits multi-club ownership in its competitions. Article 7(f) of the CONMEBOL Statutes provides that natural or legal persons cannot control more than one club. Perhaps an extension, “CONMEBOL’s Club Licensing Regulations establish as a requirement that, to participate in CONMEBOL Libertadores and CONMEBOL Sudamericana tournaments, license applicant clubs must submit a legally valid declaration if one: Owns or trades titles or securities of any other club participating in the same competition; or, b) Owns the majority of the shareholder voting rights of any other club participating in the same competition; or, c) Has the right to appoint or dismiss most of board or management or department members of another participating club in the same competition; or, d) Is a shareholder and controls most of the shareholder voting rights of shareholders in any other club participating in the same competition in accordance with an agreement signed with other shareholders of the relevant club; or, e) Belongs to the leadership structure of any other club participating in the same competition; or, f) Is involved in any quality in the management, administration and/or sporting performance of any other club participating in its competition; or, g) Has any power in the management, administration and/or sporting performance of any other club participating in the same competition.” 

The AFC regulates at both confederation club competition level, and via its club licensing regulations. The Entry Manual of the AFC Club Competitions provides as a condition of entry, at section 9.12: To ensure the integrity of an AFC Club Competition: no participating club may, either directly or indirectly, hold or deal in the securities or shares of any other participating club; be a member of any other participating club; be involved in any capacity whatsoever in the management, administration and/or sporting performance.

Article 19 of the AFC’s Club Licensing Regulations provides that a Licence Applicant must submit a legally valid declaration outlining the ownership structure and control mechanism of the club. These regulations prohibit a natural or legal person involved in the management, administration and/or sporting performance of the club, either directly or indirectly: a) holds or deals in the securities or shares that allows such person to exercise Significant Influence in the activities of any other club participating in the same competition; b) holds a majority of the shareholders’ voting rights of any other club participating in the same competition; c) has the right to appoint or remove a majority of the members of the administrative, management or supervisory body of any other club participating in the same competition; d) is a shareholder and alone Controls a majority of the shareholders’ voting rights of any other club participating in the same competition pursuant to an agreement entered into with other shareholders of the club in question; e) is a member of any other club participating in the same competition; f) is involved in any capacity whatsoever in the management, administration and/or sporting performance of any other club participating in the same competition; and g) has any power whatsoever over the management, administration and/or sporting performance of any other club participating in the same club competition.

When it comes to UEFA, MCO regulation is found throughout the so-called “UEFA Regulatory Framework”.  This includes the UEFA Statutes (Edition 2020), the UEFA competitions regulations, in particular the Regulations of the UEFA Champions League 2018-21 Cycle (2020/21 season) and the Regulations of the UEFA Europa League 2018-21 Cycle (2020/21 season), and the UEFA Club Licensing and Financial Fair play Regulations (Edition 2018).

The UEFA Statutes capture both the objectives of UEFA and the obligations of its MA’s, with a strong emphasis on the frequently referred to concern with MCO - issues of integrity. Then, within The Regulations of the UEFA Champions League, sits at Article 5 - Integrity of the competition / multi-club ownership.  This covers integrity of competition again and sets a criterion in order for a team to be eligible for UEFA competition, much the same flavour of regulation seen throughout the rest of the Confederations regarding ownership and control, but with the all-important test at Art.5 – 5.01(c) (iv)  No individual or legal entity may have control or influence over more than one club participating in a UEFA club competition, such control or influence being defined in this context as: being able to exercise by any means a decisive influence in the decision-making of the club.. 

FIFA reported that as of 2018, just 33 % of MA’s had regulatory provisions for MCO’s. The percentage of MA’s within the Confederations that regulate MCO is as follows:

• Confederation of North, Central America and Caribbean Association Football (CONCACAF) – 19%
• Oceania Football Confederation (OFC) – 22%
  
• Confederation of African Football (CAF) – 22%
• Asian Football Confederation (AFC) – 33%
• South American Football Confederation (CONMEBOL) – 50%
• Union of European Football Associations (UEFA) – 50%

What these figures might uncover is a gap in how serious MCO ought to be taken, between the Confederations and the MA’s, and that the perceived threat MCO posed to the integrity of competitions at the time these MA regulations were enacted was minor. Confederations might want to take a firmer proactive rather than reactive approach with MA’s, given the speed at which the MCO phenomenon has gained momentum. That is if one concludes that MCO regulation ought to lie with the Confederations.

Whilst MCO might not give rise to an issue for many nations (yet), the MCO environment of countries like Mexico, (1/3 of the clubs in the Liga MX are part of a domestic MCO arrangement, to say nothing of those same owners stake and influence in Mexican media and broadcast) where there are regulations in place at both MA and Confederation level, flies in the face of both the Mexican FEMEXFUT regulations and CONCACAF regulations. Might this highlight that FIFA and only FIFA can regulate this practice?

iv)             FIFA & MCO Regulation

FIFA does not expressly regulate MCO, assumingly as clubs are not its direct remit. Though through some interpretative effort, FIFA imposes an obligation on its MA’s to regulate MCO. In the FIFA Statutes at Article 20 (2), “Status of clubs, leagues and other groups of clubs”, it reads:

Every member association shall ensure that its affiliated clubs can take all decisions on any matters regarding membership independently of any external body. This obligation applies regardless of an affiliated club’s corporate structure. In any case, the member association shall ensure that neither a natural nor a legal person (including holding companies and subsidiaries) exercises control in any manner whatsoever (in particular through a majority shareholding, a majority of voting rights, a majority of seats on the board of directors or any other form of economic dependence or control, etc.) over more than one club whenever the integrity of any match or competition could be jeopardised.

Another way of looking at how FIFA may regulate MCO, is an obligation it places on the confederations at Article 23 (g), “Confederations’ Statutes”, it reads: 

The confederations’ statutes must comply with the principles of good governance, and shall in particular contain, at a minimum, provisions relating to the following matters:

(g) regulation of matters relating to refereeing, the fight against doping, club licensing, the imposition of disciplinary measures, including for ethical misconduct, and measures required to protect the integrity of competitions.

As one will notice, the protection of the integrity of competitions does not quite warrant its own sub-section of Article 23, and instead is heaped in with matters such as refereeing and doping. Article 20 might have more clout, but given the influx of MCO and investment in football in modernity, one can reasonably wonder if the regulations suffice.  

Article 20(2) of the FIFA Statutes (formerly Article 18(2)) has been considered to a degree at the Court of Arbitration for Sport. Though where it has, for instance in CAS 2014/A/3523 Club de Fútbol Atlante S.A. de C.V. v. Federación Mexicana de Fútbol (FMF) & Club Atlas F.C., the findings uncover that Article 20(2) cannot be relied upon for clarity, in terms of the jeopardisation MCO poses to the integrity of football matches or competitions.

“The FIFA rule on multiple ownership is not absolute but is based on a case-by-case assessment of the jeopardy caused to the integrity of football matches or competitions. Whether or not the integrity of a match or competition is jeopardised is a very intricate assessment which necessarily must be based on profound knowledge of the match or competition in question.”[5]

Whilst the case is not exclusively about the relevant integrity of competitions article within the FIFA Statutes, the appellant was unable to successfully argue the point that two clubs in the same league belonging to the same owner poses a serious threat to the competition (via the then Article 18(2) of the FIFA Statutes and the identical Article 7(m) of the CONCACAF Statutes) as it was unable to convince the Panel that the integrity of the Liga MX was indeed actually jeopardised.

The CAS in this instance was merely making a decision per its reach, but one struggles to imagine that any football governing body would want to take the position and to regulate so as to suggest that MCO within competitions does not “necessarily” raise integrity issues. Perhaps an extreme analogy, but that would be like concluding that doping is not “necessarily” performance enhancing and a case-by-case intricate assessment is needed to determine whether an advantage was actually attained.  Some threats to integrity require the preventative approach be captured in the regulations and the above case highlights that the articles regarding MCO found in the FIFA Statutes are insufficient and have probably not kept pace with the MCO phenomenon. A further reasonable question one might ponder, is what the reaction to the above case might have been if the clubs were UEFA based?

v)               Concluding remarks and why FIFA must assume MCO Regulations

MCO is a transnational phenomenon with no clear integrated or uniform regulatory framework and rather, a fragmented landscape, as one might reasonably expect when MCO regulation is left to the many Confederations and MA’s.  MCO regulations as they stand may have sufficed in yesteryear when football was not the target of such investment for direct financial return, branding in the case of company investment, or the branding and soft power strategies of nations – evidently the prime motivations for establishing an MCO. 

FIFA regularly offsets the negative news stories it attracts, with reference to growing the game globally. If FIFA is to cash in on the growing the game globally narrative, it surely has an obligation to regulate when that global growth produces integrity issues to football, as is the case with MCO. If one accepts that MCO is a transnational phenomenon and in turn a global issue, and that it does raise concerns in regard to the integrity of football inter alia, then it is difficult to see what body other than FIFA is best positioned to deal with the MCO phenomenon.

There are other reasons of significance as to why this should lie with FIFA as well. For instance, the MCO phenomenon also affects FIFA’s training rewards systems that it has gone to considerable lengths to attempt to fine tune (i.e. the establishment of the Clearing House). With players moving between clubs within the same MCO for free, many transfers will not trigger the trickledown effect they may have otherwise had players transferred for market rates. Another concern for FIFA might be player trading within an MCO being used as accounting tactics to avoid triggering Financial Fair Play issues, rather than a transfer representing the market value of the player.

Player welfare issues also arise, as do employment law questions.  It is already the case that there are clauses in player contracts where a player cannot refuse to be transferred to another club within an MCO if so requested (or demanded), which is in effect an MCO contract, rather than a club contract. Even when clauses of this nature are not inserted within an MCO club player’s contract, there are concerns when players are groomed within an MCO ,given the clubs have considerable time with players and a unique dynamic exists within MCO given common ownership, where a club is incentivised to persuade the player to remain within the group, when the best move, career, financial or otherwise, may be elsewhere. This is an entirely different dynamic to a player weighing up his or her transfer options and seeking professional advice from an agent and/or lawyer.  There are also instances where an MCO has only allowed a move internally and refused a transfer to another club and potentially better option for the player, raising  the ever-recurring freedom of movement questions. These instances are of course rare (for now), but real implications that need attention from football’s global governing body.

The increased globalisation of the game through creations like the UEFA Conference League and FIFA also expanding the Club World Cup, significantly broadens the number of clubs that may face each other, which increasing the risks that MCO presents. The obligations FIFA imposes on its MA’s and Confederations are not observed across the board, and are consequently not sufficient to keep pace with the burgeoning MCO phenomenon. FIFA can no longer simultaneously celebrate the globalisation of football, and defer on definition and regulation downwards in the football pyramid, when it comes to a product of that globalisation; Multi Club Ownership.

[1] I have added to the approximate figure mentioned in the hyperlinked article, to account for some recent acquisitions.

[2] CAS 98/200 AEK Athens and SK Slavia Prague / UEFA & Case COMP/37 806: ENIC / UEFA [2002] Commission

[3] CFCB Adjudicatory Chamber AC-01/2017 RasenBallsport Leipzig GmbH and FC Red Bull Salzburg GmbH

[4] DUAL INTERESTS IN CLUBS 13.1 Except with the prior written consent of the Board:- (a) no club or nominee of a club; and (b) no person, whether absolutely or as a trustee, either alone or in conjunction with one or more associates or solely through an associate or associates (even where such person has no formal interest), who:- (i) is a member of a club; or (ii) is involved in any capacity whatsoever in the management or administration of a club; or (iii) has any power whatsoever to influence the management or administration of a club, may at the same time either directly or indirectly:- (a) be a member of another club; or (b) be involved in any capacity whatsoever in the management or administration of another club; or ARTICLES OF ASSOCIATION 69 (c) have any power whatsoever to influence the management or administration of another club

[5] CAS 2014/A/3523 Club de Fútbol Atlante S.A. de C.V. v. Federación Mexicana de Fútbol (FMF) & Club Atlas F.C., at 88

Editor's Note: Marjolaine is a researcher and attorney admitted to the Geneva bar (Switzerland) who specialises in sports and life sciences. Her interests focus on interdisciplinary approaches as a way of designing effective solutions in the field of anti-doping and other science-based domains. Her book “Evidence in Anti-Doping at the Intersection of Science & Law” was published through T.M.C Asser Press / Springer in late 2015. She participates as a co-author on a project hosted by the University of Neuchâtel to produce the first article-by-article legal commentary of the 2021 World Anti-Doping Code. In her practice, she regularly advises international federations and other sports organisations on doping and other regulatory matters, in particular on aspects of scientific evidence, privacy or research regulation. She also has experience assisting clients in arbitration proceedings before the Court of Arbitration for Sport or other sport tribunals.

Since the spectre of the EU General Data Protection Regulation (‘GDPR’) has loomed over the sports sector,[1] a new wind seems to be blowing on anti-doping, with a palpable growing interest for stakes involved in data processing. Nothing that would quite qualify as a wind of change yet, but a gentle breeze of awareness at the very least.

Though the GDPR does mention the fight against doping in sport as a potential matter of public health in its recitals,[2] EU authorities have not gone so far as to create a standalone ground on which anti-doping organisations could rely to legitimise their data processing. Whether or not anti-doping organisations have a basis to process personal data – and specifically sensitive data – as part of their anti-doping activities, thus remains dependent on the peculiarities of each national law. Even anti-doping organisations that are incorporated outside the EU are affected to the extent they process data about athletes in the EU.[3] This includes international sports federations, many of which are organised as private associations under Swiss law. Moreover, the Swiss Data Protection Act (‘DPA’) is currently under review, and the revised legal framework should largely mirror the GDPR, subject to a few Swiss peculiarities. All anti-doping organisations undertake at a minimum to abide by the WADA International Standard for Privacy and the Protection of Personal Information (‘ISPPPI’), which has been adapted with effect to 1 June 2018 and enshrines requirements similar to those of the GDPR. However, the ISPPPI stops short of actually referring to the GDPR and leaves discretion for anti-doping organisations to adapt to other legislative environments.

The purpose of this blog is not to offer a detailed analysis of the requirements that anti-doping organisations must abide by under data protection laws, but to highlight how issues around data processing have come to crystallise key challenges that anti-doping organisations face globally. Some of these challenges have been on the table since the adoption of the first edition of the World Anti-Doping Code (‘WADC’) but are now exposed in the unforgiving light of data protection requirements.

Who is who and who does what?

It is hardly a scoop for those familiar with the World Anti-Doping Program to state that its structures are complex, relying on an intricate network of private entities as well as public (or quasi-public) agencies, each subject to their own applicable laws. The World Anti-Doping Program has always struggled with reconciling its objectives of global harmonisation with the sovereignty and diversity of national laws. National Anti-Doping Organisations (‘NADO’s) operate at the national level; they are in charge of doping issues across all sports in one country and are endowed with more or less extensive enforcement powers depending on their country’s regulatory approach to the sport sector. By contrast, international federations claim exclusive governance over one sport worldwide, uniformly and without regard to national borders but have to do so with the instruments available to private entities based on contractual or similar tools of private autonomy.

Over time, the WADC has been repeatedly updated to strike a balance between the two (national versus international) spheres and avoid positive or negative conflicts of competence. Provisions seek to clarify attributions in areas where international- and national-level competences collide, such as roles in Therapeutic Use Exemption (‘TUE’) management, testing authority, or results management responsibilities.[4] Even as it is, there is no safeguard to prevent disputes from arising about the proper authority to investigate and initiate proceedings for doping.[5]

Data processing activities are not exempted from the difficulties that accompany the complexity of anti-doping. If anything, these difficulties are rather exacerbated by data protection laws. In particular, the GDPR seeks to create a framework within which data subjects can easily recognise when data is being processed about them, by whom and to what aim(s), and whom to turn to in order to exercise their rights. This forces anti-doping organisations to be precise and unambiguous about their respective roles and attributions among themselves and chiefly towards the data subjects, the athletes subject to doping control.

The GDPR draws a distinction between two major categories of entities that process personal data: an entity can be characterised either as a data ‘controller’, or as a data ‘processor’. A controller is defined as an entity which “alone or jointly with others, determines the purposes and means of the processing of personal data”. A processor is an entity “which processes personal data on behalf of” a controller.[6]

The distinction may seem rather straightforward at first sight: the controller has a personal or commercial interest in the data processing and decides which data to collect, from whom, and through what means. At the other end of the spectrum, a ‘typical’ processor receives documented instructions from a controller and merely implements these instructions with no autonomy of decision or an autonomy limited to technical issues and logistics. However, interrelationships are often much more subtle in reality with considerable room for borderline situations: multiple controllers may need to agree on their (joint) controllership of the data while operating alongside entities that may act in part as processors, in part as controllers of their own right for different aspects of the data processing.[7]

In anti-doping, more than half a dozen entities may be involved in a routine doping control activity, between test planning and the outcome of a disciplinary process. All of these will either collect or gain access to athlete data, including sensitive data, as illustrated by the following: an international federation decides to conduct blood testing on an athlete from its registered testing pool but delegates sample collection to the NADO of the country in which the athlete is currently residing. To do so, the NADO has access to the athlete’s whereabouts filings through the ADAMS database, managed by the World Anti-Doping Agency (‘WADA’). The NADO itself carries out sample collection through a private service provider with its dedicated blood control officers and decides to use the opportunity to order, in addition, the collection of urine samples from the athlete. Upon sampling, the athlete is asked to fill in the doping control form in front of the doping control personnel, which includes disclosing several ongoing medication courses in the dedicated box. Samples are then transported, in a de-identified (‘coded’) form, by private courier from the country of collection to the international federation’s usual WADA-accredited laboratory in a different country.

Assuming the laboratory reports an adverse analytical finding in the blood sample, the international federation requests a full documentation package from the laboratory and verifies whether a Therapeutic Use Exemption on the record could be related to the adverse analytical finding. Upon notification of the results and public announcement of the immediate provisional suspension, the athlete requests the analysis of the B sample, thereby de facto lifting the code on the A sample where the laboratory is concerned. The athlete submits a series of explanations regarding the possible causes for the adverse analytical finding, including a report from his treating physician regarding a medical condition that might account for the findings. The international federation may send the laboratory documentation package and athlete explanations to external experts for additional input and then hands over the file to its external anti-doping tribunal members. Most data will at some point have to pass through the ADAMS database and be stored within that database for up to ten years. However, it may also be communicated by other (electronic or physical) means among anti-doping organisations and their service providers and experts.

Once the disciplinary decision is issued, its main elements are publicly disclosed by the international federation on its website, and the decision shared with WADA and any NADO having jurisdiction over the athlete. The NADO further decides to send the negative urine sample for long-term storage and possible reanalysis to the WADA-accredited laboratory that provides its storage facilities.

The above description represents an imaginary but ultimately rather standard situation for anti-doping organisations. It does not seem too far-fetched to identify that the international federation at the very least acts as a controller of the athlete data processed. However, a NADO who receives instructions to collect samples and also decides to collect additional data (and additional biological materials) on its own and for its own purposes, potentially acts as both a processor and controller depending on the data at stake. A number of processors and sub-processors are involved in the process as service providers, while the qualification of external experts may have to be assessed on a case-by-case basis. WADA offers the ADAMS database as an IT infrastructure for data storage and sharing for the international federation and NADO but also uses the data to fulfil its own obligations and purposes under the WADC, such as exercising its appeal rights or verifying compliance of the anti-doping organisations with their duties. Arguably, at the very least there will be three controllers of data (international federation, NADO, and WADA) in addition to multiple processors and sub-processors.

Characterising the role of each entity as a ‘controller’ or as a ‘processor’ is far from being of academic interest only. The two types of entities have distinct responsibilities and requirements for lawful processing. Appropriate contractual arrangements need to be set up among the entities involved, and data subjects must be informed of these in a comprehensible manner allowing them to exercise their rights. Controllers have primary responsibility for dealing with data subject requests and responding to supervisory authorities and have a more extensive scope of liability across the entire scope of data processing. By contrast, processors are, in essence, only liable for their own processing activities and merely undertake to support the controllers in their obligations towards data subjects and authorities.[8]

There is one other important difference that carries special significance in the context of anti-doping: a processor who acts under instructions can rely on the processing contract with the controller responsible for the data as a lawful basis for processing.[9] By contrast, if two or more parties qualify as controllers in their own right, each controller needs to secure its individual lawful basis with respect to the data subjects. The requirement of lawful processing is entwined with the discussion around the validity of ‘consent’ to anti-doping regulations.

Lawful basis and problematic character of consent

Processing of personal data under the GDRP requires a lawful basis. As relevant to our topic, three types of legitimising grounds co-exist: i.) grounds rooted in private autonomy (consent or necessity for performance of a contract with the data subject), ii.) grounds relying on public interest or overriding interests of the controller (e.g. pursuing a legal claim), or iii.) a specific basis in Union or national law, e.g. for performance of a substantial public interest or public health task.[10] Not all grounds enter into consideration for every category of data; special categories of data – also known as ‘sensitive’ data under the DPA – have a more limited number of valid processing grounds.[11] Obviously, a major part of data processed as part of doping control qualifies as sensitive data as it relates to health,[12] including the data gathered through analysis of doping control samples or collected as part of TUE applications.

The traditional way for international sports organisations to impose their rules on their ultimate addressees, i.e., the individual athletes, has been through contract, quasi-contractual chains of submission, or other instruments involving a declaration of consent. The validity of consent on the part of those who submit to anti-doping regulations is a recurring matter for debate, in particular as its informed and voluntary character is generally described at best as limited and more frequently as purely illusory. The issue has been scrutinised in particular with respect to submission to proceedings before the Court of Arbitration for Sport (‘CAS’),[13] which the WADC imposes as a legal remedy in international doping disputes. While acknowledging the ‘constrained’ nature of the athlete’s consent, the Swiss Supreme Court accepts the validity of arbitration clauses in sports regulations in the name of the needs for swift and competent resolution of sport disputes. It has, however, imposed certain limits on the extent to which an athlete can entrust their fate to the sports resolution system. As decided in the Cañas v. ATP case, an athlete cannot validly waive in advance the right to challenge the CAS award in front of the Supreme Court in disciplinary matters.[14] In Pechstein v. Switzerland, the European Court of Human Rights (‘ECtHR’) was asked to discuss the status of an arbitration clause in the context of doping proceedings. It reached the same conclusion that the only choice offered to the athlete was either to accept the clause in order to be able to make a living by practising her sport at a professional level or to refuse it and completely give up on practising at such level. As a result of this restriction on the athlete’s professional life, it was not possible to argue that she accepted the clause ‘in a free and unequivocal manner’.[15]

In both cases, the findings were ultimately of little consequence for the sports sector. The Swiss Supreme Court only reviews CAS awards through an extremely narrow lens so that the power to set strategic jurisprudence in sports matters remains with the CAS panels, whether or not athletes retain their rights to challenge the award. Similarly, in the Claudia Pechstein matter, the only shortcoming found in the ruling was the lack of an option for a public hearing in CAS proceedings. Absence of genuine consent has thus been – expressly or implicitly – compensated for by courts through procedural safeguards, in an effort to ensure that athletes still benefit overall from a system of justice broadly compliant with Article 6 of the European Convention on Human Rights.

Data protection issues create a greater challenge here, since the GDPR explicitly requires consent to be ‘freely given’, in addition to being informed.[16] The same is true under the Swiss DPA.[17] The GDPR does not accommodate compensatory mechanisms to account for the ‘fictional’ character of consent in the sports context: consent that is not optional is not free, and consent that is not free is not valid. Importantly, free consent also presupposes that consent can be withdrawn at any time as easily as it was given and without significant detrimental consequences for the data subject.[18]

I will not delve here into how anti-doping organisations can fulfil the requirement of ‘informed consent’, which as per the GDPR requires “intelligible and easily accessible form, using clear and plain language”.[19] The template information notices (here and here) proposed by WADA currently in effect inform athletes, in essence, that their data may be processed based on various legal grounds, may be accessed by various entities around the world according to various data protections laws, which may offer them various levels of protection, and that they may have various rights and obligations under these laws. It is questionable whether explanations in this form would satisfy the requirements for informed consent. Still, adequate information appears at least achievable with appropriate and individualised legal drafting supported by a data protection specialist. The question of free consent is a much more delicate one since it is not in the hands of anti-doping organisations to give athletes a genuine choice in this respect.

In spite of the potential financial implications, one could argue that consent is freely given where the athlete can choose at any time to withdraw consent to data processing, with the sole consequence of losing the benefit of the services attached to the ‘contractual’ relationship with their sports authorities, i.e. the right to participate in sports competitions. This would, for example, suppose that an athlete notified of a testing attempt could elect to either submit or instead declare immediate retirement from sport without any further consequences. Under the current rules, however, such withdrawal of consent would trigger disciplinary sanctions, which may include ineligibility or fines depending on the sport, and in any event, will have a significant impact on the athlete’s reputation. The templates proposed by WADA explicitly warn athletes about these consequences, as well as the fact that anti-doping organisations may retain and continue processing their data in spite of any withdrawal (see here and here). In fact, the WADC provides that the results management and disciplinary process may be initiated or may continue in spite of the athlete announcing their retirement from sport.[20]

To this day, one is still awaiting a realistic proposal that would allow consent to anti-doping regulations to be genuinely freely given. Most stakeholders would agree that there is no viable manner of making compliance with anti-doping rules optional for athletes without undermining the very notion of a level playing field.[21] Unlike the relatively benign implications that lack of genuine consent had for the sport dispute resolution system so far, the impossibility of creating the prerequisites for free consent to anti-doping regulations is far more consequential in the data protection context. Indeed, it precludes reliance on consent as a reliable lawful basis that can be used globally by international sports governing bodies to secure the lawfulness of their data processing. This is the case unless courts would be willing to go against the explicit wording of data protection laws and tolerate ‘forced’ consent as a lawful basis in the context of sport.

As the Swiss Federal Council noted in their official communication on the Swiss Sport Act, the questionable validity of athlete consent makes it necessary to create express legal provisions authorising anti-doping organisations to collect and process personal data for anti-doping purposes.[22] Under the GDPR, processing sensitive data relying on an interest of substantial public or public health interest equally requires a legal basis in EU or relevant national law of a member state. Without intervention of national lawmakers to recognise anti-doping as a matter of ‘substantial public interest’ or ‘public health’ interest and identify those entities that are entitled by law to process data together with an appropriate description of the admissible scope and purposes for such processing, sports organisations will continue to rest on shaky ground when it comes to data processing and in particular processing of sensitive data.

Proportionality of treatment

The issue of proportionality is relevant for almost any component of an anti-doping system. It is recognised by CAS panels and courts as an internationally accepted standard,[23] as part of the assessment for deciding whether an encroachment upon individual freedoms is justifiable and justified in any given case. Proportionality is frequently debated in connection with the severity of the disciplinary sanctions set forth in the WADC,[24] but it is also a test that every other aspect of the regulation must stand up to.[25]

An important limb of the proportionality test is the ‘necessity’ of a measure having regard to the rights affected. This aspect was recently addressed by the European Court for Human Rights in the context of French legislation on the whereabouts regime applicable to professional athletes and its compatibility with privacy: “the general‑interest considerations that make them necessary are particularly important and, in the Court’s view, justify the restrictions on the applicants’ rights under Article 8 of the Convention. Reducing or removing the requirements of which the applicants complain would be liable to increase the dangers of doping to their health and that of the entire sporting community, and would run counter to the European and international consensus on the need for unannounced testing.”[26] The ECtHR conducted its assessment with respect to the right to privacy under Article 8 of the European Convention on Human Rights without having regard to specific data protection provisions.

The requirement of proportionality is a pillar of data protection in all its aspects, from the decision to collect the data to its retention. It is enshrined both in the GDPR and in the DPA[27] and is notably also highlighted in the WADA ISPPPI.[28] Concerns about proportionality of the anti-doping system were expressed by EU data protection advisory authorities as early as 2008,[29] and numerous exchanges with WADA have ensued.[30] Various adjustments have been made to the ISPPPI since then with a significant review to adapt the ISPPPI to the GDPR requirements, and a new set of WADA Guidelines adopted in 2018.

Still, the threats on proportionality are bound to be ubiquitous in a context where standardisation is a guiding principle of regulation. For example, the ISPPPI (Annex A) enshrines retention times based on different categories of data (TUE, samples, whereabouts, etc.), but with only two different retention periods overall: 18 months (newly being reconsidered in the draft revised version as 12 months) or 10 years. These have been criticised again in the ongoing stakeholder consultation process as being insufficiently differentiated to be adequate.[31] Indeed, while a column in the Annex formally indicates for each category that the retention time has been chosen based on “necessity” or “proportionality” criteria, Annex A states in limine that the limitation to two retention periods is “for practical reasons”. These justifications cannot be easily reconciled. To properly account for proportionality, anti-doping organisations would need to conduct their own assessment in a more individualised fashion, adapted to their athlete pool and sport. However, as in many other domains of doping control, one wonders how many of them will have the resources, competences and willingness to look beyond WADA prescriptions. Also, since most of the data must be processed through the ADAMS database managed by WADA, anti-doping organisations may have limited effective power over the set-up of the data deletion process.

The proportionality principle is also connected to another fundamental requirement, which is that data processing must remain within the ‘purpose’ defined (‘purpose limitation’ principle). The ISPPPI contains a list of purposes for which anti-doping organisations may process data. However, the ISPPPI gives anti-doping organisations an option to decide to process data for other purposes related to the fight against doping, provided they carry out a documented assessment. The WADA Guidelines propose a template for ‘new purpose assessment’, and indicate that such new purpose could encompass purposes that were not contemplated in the WADC nor perhaps could even be envisaged at the time of collection. The draft revised ISPPPI seems to go even further down this line: “In certain contexts, it may be appropriate or necessary for Anti-Doping Organizations/WADA to Process Personal Information for additional purposes, […] besides those already permitted or required by the Code, the International Standard or expressly required by law, in order to engage effectively in the fight against doping”.[32] It is unclear how this assessment is to be effectively implemented especially for sensitive data, be it under the assumption of a consensual basis or of one based on national law recognising substantial public interests for anti-doping activities. In both cases, if the actual purposes for which the data may be used are in limbo awaiting potential reassessment for ‘new’ purposes, it is questionable whether informed consent or a sufficiently predictable legal basis respectively could even be created.[33]

As the claims for more ‘evidence-based’ approaches and stronger monitoring of anti-doping programs grow louder, more thought could be spent on proportionality and purpose limitation of data processing in anti-doping. Most of the discussion so far has revolved around the intrusiveness of the whereabouts requirements. Whereabouts information, however, is only collected from a limited number of high-profile athletes (i.e., those included within a registered testing pool) and is only a fraction of the data collected as part of anti-doping programs. In the FNASS et al. v. France ruling, the ECtHR essentially relied on the pleas of the anti-doping movement and governments to find that the fight against doping pursues a public health interest and implements it in a proportionate way. In doing so, the ECtHR seems to perpetuate a tendency of CAS and other courts to take policy documents and consensus statements - whether enshrined or not in international law instruments such as the UNESCO Convention against Doping in Sport - as proof of the reality of the claims they contain[34] without requiring much supporting evidence. In many instances, this is technically justified by placing on the contesting party the burden of demonstrating any lack of proportionality.[35] On a higher level, however, it tends to create a presumption that any doubt must benefit the cause of anti-doping.[36] This may lead to self-perpetuating policy biases based on circular reasoning by justifying new measures through previous, unverified claims.

Data protection laws, with their detailed requirements and descriptions of data subject rights, may offer a foundation for a more granular analysis than general human rights provisions under the undetermined heading of ‘privacy’. Opportunities for legal analysis may still be hindered by the fact that an argument related to data protection is hard to build into a defence when athletes – or their counsel – would typically start seriously thinking about these issues only once they become subject to investigations or discipline for a potential breach of the anti-doping rules. CAS panels have been rather generous in admitting evidence unlawfully obtained against individuals charged in disciplinary proceedings.[37] It could thus prove extremely difficult – perhaps even counter-productive as a defence strategy – for an athlete to object to the admissibility of doping control data obtained in breach of data protection laws, in particular when the objection relates to a breach that leaves as much discretion to the panel as proportionality of data collection or retention. CAS panels have repeatedly recognised the fight against doping as an interest that overrides individual freedoms without carrying out much of an individualised balance of the interests at stake. [38]  More promising impetus could come from a random athlete seeking advice from supervisory authorities through the avenues offered by his or her national data protection laws prior to exposure to a positive test or other disciplinary action. Unfortunately, much like consumers, athletes often seem to show little interest in their privacy until they are confronted with some tangible detrimental consequences.

A true plague or a real opportunity?

Some may view recent developments in data protection laws as just another headache for sports governing bodies and deplore the advent of a new hurdle for anti-doping organisations who aspire to take their tasks under the World Anti-Doping Program seriously. Anti-doping organisations advocate that they are carrying out a mission of public interest. As we have seen, this view has been supported by various bodies and courts around the world and is also reflected in the UNESCO Convention against Doping in Sport. However, the GDPR does not regard public interest as an absolute basis for all data processing; in particular, sensitive data cannot be processed on the sole basis of an alleged public interest unless such public interest is substantial or related to public health, and its modalities are set out in national or EU law.

In a time where the credibility of existing structures and procedures within anti-doping authorities is questioned, the challenge arising from data protection standards can also be perceived as an opportunity for the anti-doping system. The ISPPPI and related WADA Guidelines, unfortunately, do not purport to provide solutions to the various crucial challenge set out above but merely invite anti-doping organisations to act in accordance with their applicable data protection laws. They give little guidance on how this is to be achieved in the event that these laws conflict with their duties under the WADC.

Developments in data protection force anti-doping organisations to look at their structures, legal status and their relationships with other organisations within the system. These developments should also have the effect of prompting national legislators to take measures more supportive of anti-doping policies in this domain, and in particular by making sure that sports governing bodies benefit from an appropriate legal basis for processing data, including sensitive data. Given that the very purpose of the WADC is to harmonise the regulation of doping in sport worldwide and that this objective is routinely invoked to justify restrictions on athlete rights, it would seem somewhat counterintuitive not to afford all athletes the same level of protection where their data is concerned. If there is truly a general international consensus on the legitimacy of the fight against doping and this consensus is supported by the State parties to the UNESCO Convention, those States, at a minimum, must be willing to give anti-doping organisations the means to carry out their tasks in a legally sustainable manner, unless and until these States are ready to engage in a fundamental overhaul of the current system.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The GDPR started to apply on 25 May 2018. In theory, all entities conducting data processing activities within the scope of the GDPR ought to have secured compliance as of this effective date.

[2] Recital 112 refers to requirements for cross-border data transfers and provides: “Those derogations should in particular apply to data transfers required and necessary […] for public health, for example […] in order to reduce and/or eliminate doping in sport”.

[3] Article 3 para. 2 of the GDPR regarding territorial scope of application.

[4] See Articles 4.4 of the WADC for TUEs, 5.2 for testing, and 7.1 for results management.

[5] See e.g. CAS 2014/A/3598, 3599 & 3618, in which the authority of USADA to initiate proceedings against Johan Bruyneel and others was challenged.

[6] Article 4 (Definitions) of the GDPR. Note that a processor within the meaning of the GDPR may itself choose to delegate part of its activities to a sub-processor, if and to the extent authorised by the controller.

[7] See the guidance and examples given by the UK Information Commissioner’s Office.

[8] See Chapter IV of the GDPR.

[9] Article 28 para. 3 of the GDPR.

[10] Article 6 of the GDPR.

[11] Article 9 of the GDPR.

[12] Article 9 para. 1 of the GDPR; Article 3 lit. c of the DPA.

[13] See e.g. Duval A (2017) Not in My Name! Claudia Pechstein and the Post-Consensual Foundations of the Court of Arbitration for Sport, Max Planck Institute for Comparative Public Law & International Law (MPIL) Research Paper No. 2017-01; Rigozzi A & Robert-Tissot F (2015) "Consent" in Sports Arbitration: Its Multiple Aspects. In: Geisinger & Trabaldo-De Mestral (eds) Sports Arbitration: A Coach for Other Players? ASA Series 41, Jurisnet NY, pp 59-95;

[14] Swiss Supreme Court Decision, 4P.172/2006, 22 March 2007.

[15] ECtHR Decision 22 October 2018, Mutu & Pechstein v. Switzerland, no 40575/10 et 67474/10, para. 114.

[16] Article 4 (Definitions) of the GDPR.

[17] Article 4 para. 5 of the DPA.

[18] Article 7 para. 3 of the GDPR.

[19] Article 7 para. 2 of the GDPR.

[20] Article 7.11 of the WADC.

[21] Though it is often debated to what extent exactly the performance enhancing effect of individual prohibited substances and methods is established. Heuberger J, Cohen A (2018) Review of WADA Prohibited Substances: Limited Evidence for Performance-Enhancing Effects. Sports Med. 2019; 49(4): 525–539.

[22] Message du Conseil fédéral du 11 nov. 2009, FF 09.082, pp 7450/7451 : « Aujourd’hui, les contrôles antidopage relevant du sport de droit privé reposent sur une déclaration de consentement du sportif. Cette déclaration doit être librement consentie. Or, cette liberté n’est pas garantie, dans la mesure où le refus de donner son consentement peut entraîner l’exclusion de la manifestation ou la perte de la licence ».

[23] CAS 2005/C/976 & 986, FIFA & WADA, para. 138 ; CJEU decision Meca-Medina & Majcen v. Commission (C-519/04).

[24] A recent example: CAS 2018/A/5546, Guerrero v. FIFA, CAS 2018/A/5571, WADA v. FIFA & Guerrero, paras 85 et seq.; Legal Opinion by Jean-Paul Costa on the 2015 revision of the WADC.

[25] Viret (2016), Evidence in Anti-Doping at the Intersection of Science & Law, T.M.C Asser, p. 133; Since its 2015 version, the WADC has included an explicit reference to proportionality as one of the key considerations underlying its drafting. See introductory section “Purpose, Scope and Organization of the World Anti-Doping Program and the Code”.

[26]ECtHR, FNASS et al. v. France (48151/11 and 77769/13), para. 191.

[27] Article 5(1)(c) of the GDPR, whereas the data must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)”.

[28] Section 5.0 ISPPI “Processing Relevant and Proportionate Personal Information”.

[29] Art. 29 Working Party, now replaced by the European Data Protection Board under the GDPR.

[30] See collection of legal documents on WADA website.

[31] Comment to revised ISPPPI by NADA Germany, ad Annex Retention Times.

[32] Comment ad Article 5.3(d) draft ISPPPI.

[33] The EU Commission warns that extension of purpose is not possible where processing was based on consent or a provision of law without renewing the consent or creating a new legal basis.

[34] See e.g. preamble of the UNESCO Convention “Concerned by the use of doping by athletes in sport and the consequences thereof for their health, the principle of fair play, the elimination of cheating and the future of sport”.

[35] See already in CJEU decision Meca-Medina & Majcen v. Commission (C-519/04) regarding the proportionality of threshold levels.

[36] Maisonneuve Mathieu, La CEDH et les obligations de localisation des sportifs : le doute profite à la conventionnalité de la lutte contre le dopage, note sous CEDH, 5^e sect., 18 January 2018, Fédération nationale des associations et des syndicats sportifs (FNASS) et autres c. France, req. Nos 48151/11 et 77769/13. Journal d’actualité des droits européenes, Centre de recherches et de documentation européennes et internationales, 2018.

[37] CAS 2016/A/4487, IAAF v. Melnikov, para. 108.

[38] CAS 2009/A/1879, Valverde v. CONI, para. 139.