sou · H7B324 · 2019-06-03 00:00:00 — The purpose of the act should be to make possible the processing of personal data in anti-doping work in sport in an appropriate way and to protect natural persons from interference with their personal privacy in this processing. Anti-doping work in sport Anti-doping work in sport is governed by the World Anti-Doping Code adopted by the (). The World Anti-Doping Code is intended to guarantee the athletes their fundamental right to participate in doping-free sport and thus promote health, fairness and equality for athletes. It is also intended to harmonise anti-doping work in sport at the international and national level. In the first place, it is the bodies that have signed the World Anti-Doping Code, i.e. the code signatories, that are bound by the Code. As an example, a national anti-doping organisation (NADO), an international sports federation or an event organisation can be a code signatory. But bodies other than signatories can also perform anti-doping work on account of the Code. The World Anti-Doping Code contains rules that code signatories are obliged to follow. For instance, it regulates what are anti-doping rule violations. The Code also includes provisions about anti-doping testings, athlete’s whereabouts information, result management and the investigation of anti-doping rule violations. There are a number of international standards, six at present, that belong to the World Anti-Doping Code; adherence to them is mandatory for the code signatories. One international standard relates to therapeutic use exemptions from the anti-doping rules; another standard relates to testing A further standard relates to the protection of privacy and personal information. That standard states that it is not applicable if it breaches national legislation. By ratifying ’s Anti-Doping Convention and its Additional Protocol and ’s International Convention against Doping in Sport, has assumed a responsibility to combat doping in sport. has also given its approval to the anti-doping work performed in accordance with the Code. In addition, has committed to the principles of the Code. The proposed law defines anti-doping work in sport as anti-doping work performed on account of the World Anti-Doping Code or the international standards that supplement the Code. Scope of the Act We propose that the act on data protection in anti-doping work in sport should apply to all processing of personal data that takes place in in anti-doping work performed on account of the World Anti-Doping Code or the international standards that belong to the Code. Participants in anti-doping work that are established in should be covered by the act irrespective of where their processing of personal data is performed. In anti-doping work in sport is mainly performed by the Swedish Sports Confederation (RF), which is an NGO and the umbrella organisation for most of the Swedish sports movement. The Confederation has 71 national special sports federations as members. Its base consists of around 3.1 million members and around 20 000 local sports associations affiliated to their special sports federations. At regional level, these local associations are affiliated to special sports federations and district sports federations. The Swedish Sports Confederation is a signatory to the World Anti-Doping Code and is the national anti-doping organisation (NADO) of Swedish sport in accordance with the Code. Under the World Anti-Doping Code, the is therefore obliged to perform anti-doping work in sport in . The Confederation also receives the entire central government appropriation for antidoping action. Anti-doping work in the is led and coordinated by the independent Doping Commission elected by the ’s General . However, the operational work is performed by , under the name of Swedish Anti-Doping. Work in the Department can be divided into five different areas: handling of applications for therapeutic use exemptions, handling of athlete’s whereabouts information, doping controls, result management and intelligence work. However, the 's statutes provide that anti-doping work is conducted in all parts of the organisation. We have therefore concluded that the act should be applicable to all the processing of personal data that is performed in anti-doping work on account of the World Anti- Doping Code by the Swedish Sports Confederation and by the associations and federations affiliated to the . There are also a small number of associations and special sports federations that are not affiliated to the Swedish Sports Confederation but that are affiliated to an international sports federation that is a signatory to the World Anti-Doping Code. Examples include the Swedish Bodybuilding and and affiliated associations. Our proposal is that they should also be covered by the act to the extent that they process personal data in anti-doping work performed in accordance with the World Anti-Doping Code. Anti-doping work in can also be performed by foreign entities. Our proposals also cover the processing of personal data that takes place when signatories to the World Anti-Doping Code other than the Swedish Sports Confederation – such as international special sports federations and the national anti-doping organisations of other countries – process personal data in when performing doping controls here in accordance with the World Anti-Doping Code. We also propose that the act should be applicable to bodies that perform anti-doping work on behalf of a signatory to the World Anti-Doping Code. At present there is one private service company, , that is established in whose activities include the performance of doping tests in accordance with the rules of the World Anti-Doping Code on behalf of signatories to the Code. There are also a few companies that perform anti-doping work on an international basis on behalf of a signatory to the World Anti-Doping Code and that can therefore be covered by our proposals to the extent that they process personal data in . The Act should only apply to the processing of personal data if it is or partly automated or if the personal data forms part of or is intended to form part of a structured set of data which are accessible for searching or compilation according to specific criteria. Relationship to other legislation The proposed act supplements the directly applicable provisions of the Data Protection Regulation. Protection Act (2018:218), which contains general supplementary provisions to the Data Protection Regulation, is also applicable, unless otherwise provided by the proposed act. Along with the Data Protection Regulation and the Data Protection Act, the act will take precedence to the sports movement’s internal regulations on the processing of personal data. The proposed act will not apply when personal data are processed at the Doping laboratory of pursuant to the Act (2008:355). Control of personal data In our assessment, each body covered by the act is the controller for the processing of personal data performed by that body in the antidoping work of sport. We propose stating this in the act for the sake of clarity. Under the proposed act, personal data may only be collected and processed in other ways in the anti-doping work of sport if this is necessary for certain purposes specified in the act. These proposals cover the purposes for which personal data needs to be collected and processed in order to perform work under the World Anti-Doping Code and the associated standards. The provisions on purposes are optional in the sense that they regulate what the participants in anti- doping work may do. So the point of the provisions on purposes is to set an outer limit for when personal data may be collected and continue to be processed pursuant to the act on data protection in the anti-doping work of sport and the Data Protection Regulation. Moreover, the purposes stated are exhaustive in the sense that the various participants covered by the act may not make their own decisions about additional purposes for which personal data will be collected in their activities. In the anti-doping work of sport, data is disclosed to other participants via ’s database or some other system approved by . The disclosure is made within the framework of anti-doping work and follows from the World Anti-Doping Code. The recipients are other signatories to the World Anti-Doping Code or service companies performing their work on behalf of a signatory and in accordance with the Code. The disclosure is therefore made as part of the same global anti-doping work and normally takes place in the activities of each signatory. The disclosure of information that takes place as part of anti-doping work in sport is covered by the act’s primary provisions on purposes. There is a small amount of disclosure of personal data from participants in anti-doping work to law enforcement agencies. The proposed act also permits the processing of personal data if this is necessary in order to provide information needed in law enforcement activities in the Swedish Authority, the Swedish Prosecution Authority or the Swedish Customs. The proposed provision opens up a possibility for participants in anti-doping work to disclose data about suspected doping-related offences to the relevant law enforcement authorities. The transfer of personal data to a third country in anti-doping work in sport can take place pursuant to the provisions of the Data Protection Regulation. So no special provisions about this need to be included in the proposed act. Sensitive personal data and data relating to criminal offences Article 9(1) of the Data Protection Regulation contains a principled prohibition of the processing of special categories of personal data, also called ‘sensitive personal data’. There are, however, a number of exemptions from the prohibition. If the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, the data may be processed (9(2)(a)). In addition, certain sensitive personal data may be processed if, among other reasons, the processing is necessary for reasons of substantial public interest, on the basis of Union or law (9(2)(g)). According to our proposals, only sensitive personal data concerning health, genetic data or biometric data for the purpose of uniquely identifying a natural person, may be processed in anti-doping work in sport pursuant to Article 9(2)(g) of the Data Protection Regulation. Article 10 of the Data Protection Regulation contains special provisions about the processing of personal data relating to criminal convictions and offences. Information that an athlete has committed an anti-doping rule violation under the internal rules of sport does not concern a criminal conviction. In our assessment, it does not relate to an offence in the meaning of Article 10 of the Data Protection Regulation either. Personal data like this could, nevertheless, be processed in anti-doping work. According to our proposals, personal data concerning criminal offences may be processed to handle cases concerning anti-doping rule violations. They may also be processed in the intelligence work conducted by the Swedish Sports Confederation under the World Anti-Doping Code. Public disclosure of data concerning anti-doping rule violations The World Anti-Doping Code provides that data about athletes suspended for doping must be publicly disclosed. In the case of the Swedish Sports Confederation, the data is published on the internet. We have concluded that this publication is problematic from a privacy perspective. Since the publication takes place pursuant to a certificate of no legal impediment to publication and therefore under the protection of the Fundamental on Freedom of Expression, there are, however, very limited possibilities of intervening pursuant to the Data Protection Regulation. In our view, the Swedish Sports Confederation should, however, consider a new system under which the relevant data can be made available to those who have a legitimate interest in it. We have not concluded that it would be either necessary or proportionate to limit the right of individuals to object to the processing of personal data in the proposed act. have we found reasons to make any other exemptions from the rights of the data subject under the Data Protection Regulation. The maximum period during which personal data may be retained in anti-doping work in sport for various purposes is set out in an international standard belonging to the World Anti-Doping Code. In our assessment, the act should not contain any detailed regulations restricting the maximum retention period decided by and followed in other countries. However, we propose the insertion into the act of a general provision stating that personal data may not be processed for a longer period than is necessary in view of the purpose of the processing. The purpose of the proposed provision is to counter routine retention. The international standard does not contain any provisions about how long personal data may be processed in intelligence work. However, the processing of personal data in this work is particularly sensitive in terms of privacy. We are therefore proposing a provision stating that personal data may not be processed in intelligence work for a longer period than three years after the end of the calendar year when the data was processed for the first time. If any new data reading the same person’s link to doping activities is processed before the end of that period, the personal data already held about the person may continue to be processed as long as any of the data may be processed. We have analysed whether the act should contain additional provisions intended to secure the fundamental rights and interests of individuals in anti-doping work in sport. Possible safeguards of this kind are discussed in chapter 11. Here we propose a provision stating that access to personal data shall be limited to what each individual person needs to enable them to carry out their duties. We also propose that the Swedish Sports Confederation and other bodies that are established in and perform anti-doping work on behalf of a signatory to the World Anti-Doping Code shall appoint a data protection officer for their processing of personal data in anti-doping work. In our view, there is no need to amend the secrecy legislation. We have, however, concluded that there is reason for the Swedish Sports Confederation to review Chapter 13, Section 8 of the Statutes of the Swedish Sports Confederation. Our proposals mean stronger protection for the personal privacy of individuals in anti-doping work in sport. The proposals can also have positive impacts on action to combat doping-related crime. In our assessment, the proposals will mean that some training and information are needed. However, they are not assessed as leading to cost increases for the public institutions. The new act is proposed to enter into force on 1 2020. Proposed act on data protection in anti-doping work in sport Purpose of the act The purpose of this act is to make it possible for personal data to be processed in anti-doping work in sport in an appropriate way and to protect natural persons from interference with their personal privacy in this processing. Anti-doping work in sport In this act anti-doping work in sport means anti-doping work performed on account of the World Anti-Doping Code or the international standards that supplement the Code. Scope of the Act This act shall be applied when personal data is processed in antidoping work in sport performed by 1.the Swedish Sports Confederation and associations and federations affiliated to the Swedish Sports Confederation, 2.other associations and federations in affiliated to an international sports federation that is a signatory to the World Anti- Doping Code, and 3.signatories to the World Anti-Doping Code other than the Swedish Sports Confederation, if the personal data are processed in . and above what follows from Section 3, this act shall be applied when personal data are processed in anti-doping work in sport performed on behalf of a signatory to the World Anti-Doping Code by 1.a body that is established in , and 2.a body that is not established in , if the personal data are processed in . This Act only applies to the processing of personal data if it is or partly automated or if the personal data forms part of or is intended to form part of a structured set of data which are accessible for searching or compilation according to specific criteria. Relationship to other legislation This act supplements Regulation (EU) 2016/679 of Parliament and of the Council of on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Protection Regulation), called the EU’s Data Protection Regulation in this act. When personal data are processed under this act, the Act containing provisions supplementing the EU’s Data Protection Regulation (2018:218) and regulations issued in connection with that Act are applicable, unless otherwise indicated in this Act. This Act does not apply when personal data are processed at the Doping laboratory of pursuant to the Act (2008:355). Control of personal data Each body stated in Sections 3 and 4 is the controller for the processing of personal data performed by that body in anti-doping work in sport. Personal data may be processed in anti-doping work in sport when necessary in order to 1.handle applications for therapeutic use exemptions, 2.plan, coordinate and administer whereabouts information, 3.plan, coordinate and handle doping controls, 4.handle cases concerning anti-doping rule violations, and 5.gather, process, analyse and share information regarding possible violations of the World Anti-Doping Code. Only the Swedish Sports Confederation may process personal data according to the first paragraph, point 5. However, other bodies to which this act is applicable may process personal data when necessary to provide information that the Swedish Sports Confederation needs in its activities under the first paragraph, point 5. Personal data processed under Section 10 may also be processed when necessary to provide information needed in law enforcement activities in the Swedish Authority, the Swedish Prosecution Authority or the Swedish Customs. No personal data stated in Article 9(1) of the EU’s Data Protection Regulation (sensitive personal data) other than personal data concerning health, genetic data or biometric data for the purpose of uniquely identifying a natural person may be processed pursuant to Article 9(2)(g) of the Data Protection Regulation. Data relating to criminal offences Personal data stated in Article 10 of the EU’s Data Protection Regulation may only be processed for the purposes specified in Section 10, first paragraph, points 4 and 5. Access to personal data Access to personal data shall be limited to what each individual person needs in order to perform their duties. The Swedish Sports Confederation and other bodies that are established in and perform anti-doping work on behalf of a signatory to the World Anti-Doping Code shall appoint a data protection officer for their processing of personal data in anti-doping work in sport. Personal data may not be processed for a longer period than is necessary in view of the purpose of the processing. Personal data processed for purposes specified in Section 10, first paragraph, point 5 may not be processed for a longer period than three years after the end of the calendar year when the data was processed for the first time. If any new data reading the same person’s link to doping activities is processed before the end of that period, the personal data already held about the person may continue to be processed as long as any of the data may be processed. 1.1Förslag till lag om dataskydd i idrottens antidopningsarbete Härigenom föreskrivs följande. 1 § Syftet med denna lag är att möjliggöra att personuppgifter kan behandlas inom idrottens antidopningsarbete på ett ändamålsenligt sätt och att skydda fysiska personer mot att deras personliga integritet kränks vid sådan behandling. 2 § Med idrottens antidopningsarbete avses i denna lag sådant antidopningsarbete som utförs på grund av världsantidopningskoden (World Anti-Doping Code) eller de internationella standarder som kompletterar koden. 3 § Denna lag ska tillämpas då personuppgifter behandlas i idrottens antidopningsarbete som utförs av 1.Sveriges Riksidrottsförbund samt föreningar och förbund som är anknutna till , 2.andra föreningar och förbund i som är anknutna till ett internationellt specialidrottsförbund som är signatär av världsantidopningskoden, samt 3.annan signatär av världsantidopningskoden än , om personuppgifterna behandlas i . 4 § Utöver vad som följer av 3 § ska denna lag tillämpas då personuppgifter behandlas i idrottens antidopningsarbete som utförs på uppdrag av en signatär av världsantidopningskoden av 1.organ som är etablerat i , samt 2.organ som inte är etablerat i , om personuppgifterna behandlas i . 5 § Denna lag gäller endast om behandlingen av personuppgifter är helt eller delvis automatiserad eller om personuppgifterna ingår i eller är avsedda att ingå i en strukturerad samling av personuppgifter som är tillgänglig för sökning eller sammanställning enligt särskilda kriterier. Förhållandet till annan reglering 6 § Denna lag kompletterar och rådets förordning (EU) 2016/679 av om skydd för fysiska personer med avseende på behandling av personuppgifter och om det fria flödet av sådana uppgifter och om upphävande av direktiv /46/EG (allmän dataskyddsförordning), i lagen benämnd EU:s dataskyddsförordning. 7 § Vid behandling av personuppgifter enligt denna lag gäller lagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning och föreskrifter som har meddelats i anslutning till den lagen, om inte annat följer av denna lag. 8 § Denna lag gäller inte då personuppgifter behandlas hos Dopinglaboratoriet vid med stöd av patientdatalagen (2008:355). 9 § Varje organ som anges i 3 och 4 §§ är personuppgiftsansvarig för den behandling av personuppgifter som organet utför i idrottens antidopningsarbete. 10 § Personuppgifter får behandlas i idrottens antidopningsarbete om det är nödvändigt för att 1.handlägga ansökningar om medicinsk dispens, 2.planera, koordinera och administrera vistelserapporteringar, 3.planera, koordinera och handlägga dopningskontroller, 4.handlägga ärenden om dopningsförseelser, och 5.inhämta, bearbeta, analysera och delge information som gäller möjliga förseelser mot världsantidopningskoden. Endast får behandla personuppgifter enligt första stycket 5. Andra organ som denna lag är tillämplig på får dock behandla personuppgifter om det är nödvändigt för att tillhandahålla information som behöver i sin verksamhet enligt första stycket 5. 11 § Personuppgifter som behandlas enligt 10 § får även behandlas om det är nödvändigt för att tillhandahålla information som behövs i brottsbekämpande verksamhet hos , eller . 12 § Inga andra personuppgifter som avses i artikel 9.1 i EU:s dataskyddsförordning (känsliga personuppgifter) än sådana som rör hälsa, genetiska uppgifter eller biometriska uppgifter för att entydigt identifiera en fysisk person får behandlas med stöd av artikel i samma förordning. 13 § Personuppgifter som avses i artikel 10 i EU:s dataskyddsförordning får behandlas endast för de ändamål som anges i 10 § första stycket 4 och 5. 14 § Tillgången till personuppgifter ska begränsas till vad var och en behöver för att kunna fullgöra sina arbetsuppgifter. 15 § samt andra organ som är etablerade i och utför antidopningsarbete på uppdrag av en signatär av världsantidopningskoden ska utse dataskyddsombud för sin behandling av personuppgifter i idrottens antidopningsarbete.