Using data from doping controls to monitor the testosterone thresholds of intersex and trans athletes violates data protection laws

Opinions on playthegame.org reflect the views of the author(s).

Since the International Olympic Committee (IOC) published its Framework on Fairness, Inclusion and Non-Discrimination on the Basis of Gender Identity and Sex Variations in 2021, international sports federations (IFs) have been given the responsibility to develop rules for how intersex and transgender athletes can take part in competitions. 

While the IOC’s framework asks for rules that are inclusive, non-discriminatory, evidence-based and specific to the sport in question, many IFs have ended up with very similar rules which require intersex and trans women athletes to keep their testosterone levels below certain thresholds in order to participate in international competitions or set world records in the women’s competition category. 

The idea behind the rules is to ensure ‘fairness’ in the women’s category due to beliefs that intersex and trans women athletes have testosterone levels that give them a performance advantage over other female athletes. However, the testosterone thresholds in the regulations are not based on scientific evidence or consensus.

At least nine IFs, including World Athletics and World Aquatics, have adopted such sex-based eligibility regulations, and more IFs are expected to follow suit in the near future. 

To monitor compliance with the regulations, IFs use testosterone data that was originally collected to detect doping. The data comes from WADA’s (World Anti-Doping Agency) database called ADAMS, which includes athletes’ blood testosterone levels. IFs access this data through ADAMS, and the practice is possible due to rules in the World Anti-Doping Code.

This use of doping control data to administer sex-based eligibility regulations is problematic because it results in significant harms to intersex and trans women athletes and occurs without legal authority, such as the meaningful consent of athletes. As our research shows, this practice violates data protection laws in Canada and the EU.

Harms to athletes

The testosterone data is collected for anti-doping purposes, but it can cause a number of problems for athletes if it is also used for sex-based eligibility regulations. 

In the anti-doping context, there are no consequences for an intersex athlete with naturally occurring high testosterone levels or a trans woman athlete with certain testosterone levels from gender-affirming hormone therapy permitted under a therapeutic use exemption. However, in the eligibility context, the data could be used to:

• subject intersex and trans women athletes to embarrassing and intrusive physical examinations
• force athletes to disclose their status as intersex or trans
• require intersex athletes to reduce their naturally occurring testosterone levels with medications that are medically unnecessary, provide no therapeutic value, and can have harmful physical side effects
• require trans women athletes to maintain their testosterone levels below arbitrary thresholds that are not evidence-based and may not allow them to maintain overall health
• make intersex and trans women athletes targets of verbal abuse, stigmatization, marginalization, and bullying due to a relentless focus on their gender and sex characteristics
• exclude intersex and trans women from competing in international events and result in their loss of business or professional opportunities.  

All of these harms have been recognised to varying degrees by the Court of Arbitration for Sport, the European Court of Human Rights, Human Rights Watch, and the United Nations High Commissioner for Human Rights.

Athletes' consent is not voluntary, informed, or explicit 

In the anti-doping context, athletes give explicit consent to have their doping control data collected and used by an IF for anti-doping purposes. This consent is obtained through WADA’s standard doping control form.

However, if an IF wants to use the doping control data for sex-based eligibility rules, then WADA has instructed the IF to modify the form to describe that secondary use. 

Unfortunately, this consent is not truly voluntary, informed, or explicit:

1. The consent provided by athletes is coerced, and not voluntary, because athletes cannot refuse to give consent without risking penalties or being punished for violating anti-doping rules.
2. The consent provided by athletes is not knowledgeable as they are not fully informed about the significant harms that might result from the use of their data for eligibility purposes.
3. The consent provided by athletes is not explicit as the form does not clearly ask athletes whether they agree to have their doping control data used for sex-based eligibility purposes (e.g., through “yes” or “no” checkboxes). Instead, participation in the doping control process is presumed to represent the athlete’s consent to have their data used for eligibility purposes. 

Violations of data protection laws

Data protection laws can be used to challenge the way IFs are using doping control data to enforce testosterone thresholds in sex-based eligibility regulations. Two key laws are Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and 
the European Union’s General Data Protection Regulation (GDPR).

The key points of Canada’s PIPEDA law are

• Scope: PIPEDA governs how WADA collects, uses, and shares personal data for activities that take place across provinces and internationally.
• Inappropriate purpose: It prohibits the collection, use, and sharing of personal data for inappropriate reasons, such as those that cause significant harm to an individual.
• Consent: It requires an organization to obtain voluntary, informed and explicit consent to collect, use or share sensitive data.

WADA is violating these rules in PIPEDA when it shares doping control data in ADAMS with IFs for sex-based eligibility purposes. 

The key points in the EU's GDPR law are

• Scope: GDPR applies to IFs operating in the EU and those outside the EU that handle the personal data of athletes training or competing in the EU.
• Permitted use: Sensitive data can only be collected, used or shared with proper legal authority, such as explicit consent or for substantial public reasons based on EU or member state law.

As explained above, IFs are not obtaining the meaningful consent of athletes to use their doping control data for sex-based eligibility purposes, nor do they have substantial public interest under EU or EU member state law to use doping control data for these purposes.

Possible outcomes of privacy complaints

Currently, a complaint against WADA for not following PIPEDA is being reviewed in Canada, and it is possible for athletes in the EU to file complaints with their national data protection authorities if their GDPR rights are violated.

If these complaints succeed and stop IFs from using doping data for eligibility purposes, IFs might respond in one of several ways:

1. The IF may decide to revoke its sex-based eligibility regulations if it believes it does not have sufficient data to enforce the testosterone thresholds in the regulations.
2. The IF may decide to revise its sex-based eligibility regulations by removing the testosterone thresholds and replacing them with different eligibility criteria for intersex and trans women athletes. If the revised criteria are more restrictive than what they are today (e.g., criteria that results in the exclusion of all intersex and trans women athletes, regardless of their testosterone levels), then an athlete would be able to bring a discrimination claim to challenge such rules and the IF would have a difficult time justifying the discrimination based on current scientific evidence.
3. The IF may decide to maintain its sex-based eligibility regulations and establish a testing regime that is separate from the anti-doping system to collect and analyze the testosterone levels of intersex and trans women athletes. However, if this occurs, then athletes should continue to use the GDPR and other applicable data protection laws to challenge the IF’s data processing.

The Paris Olympics are the most recent example of how sex-based eligibility regulations are narrowing the women’s competition category to the exclusion of many intersex and trans women athletes. 

Algerian female boxer Imane Khelif faced unfair and discriminatory commentary about her sex and gender due to misinformation and sport governance failures. Top female sprinters, Christine Mboma and Maximila Imali, did not qualify for the Olympics due to regulations within World Athletics that required them to reduce their naturally-occurring testosterone levels. Additionally, there are very few transgender women athletes at the Olympics because of strict rules that exclude them. 

We believe the regulations perpetuate sexist, racist, and transphobic views that stereotype women’s bodies and diminish the athletic accomplishments of female athletes who do not fit the traditional sex binary. 

If eligibility criteria are required to regulate the participation of intersex and trans women athletes in the women’s competition category, then such criteria must be based on scientific evidence, informed by consultation with athletes, and implemented in a manner that respects the human rights of athletes, including their privacy rights under data protection laws. 

Hopefully, there comes a time when international sport organizations proactively follow these good governance principles, without being forced to do so following legal challenges brought by athletes and their supporters.