Australian Sports Anti-doping Authority Amendment (Sport Integrity Australia) Bill 2019 [2020] AUPJCHR 5 (5 February 2020)

---

Australian Sports Anti-Doping Authority Amendment (Sport Integrity Australia) Bill 2019^[1]

Purpose	This bill seeks to amend the Australian Sports Anti-Doping Authority Act 2006 to rename the Australian Sports Anti-Doping Authority as 'Sport Integrity Australia'; provide Sport Integrity Australia with a new set of functions; list Sport Integrity Australia as an enforcement body under the Privacy Act 1988; and make consequential amendments to other Acts
Portfolio	Youth and Sport
Introduced	House of Representatives on 17 October 2019
Right	Privacy
Status	Seeking additional information

Exempting Sport Integrity Australia from aspects of the Privacy Act 1988

1.24 The bill seeks to rename the Australian Sports Anti-Doping Authority (ASADA), whose focus is on anti-doping, as Sport Integrity Australia (SIA), and provide SIA with a broader set of responsibilities and functions. Item 24 of the bill would establish that the SIA Chief Executive Officer (CEO) is responsible for coordinating a national approach to Australia's response to matters relating to 'sports integrity', including threats to sports integrity.^[2] 'Threats' to sports integrity are defined to include manipulation of sporting competitions, the use of drugs or doping methods in sport, the abuse of children and other persons in a sporting environment and the failure to protect members of sporting organisations from bullying, intimidation, discrimination or harassment.^[3]

1.25 Furthermore, the bill seeks to amend subsection 6(1) of the Privacy Act to include SIA as an 'enforcement body'.^[4] This would have the effect that:

• SIA would not be required to notify of an eligible data breach under Part IIIC of the Privacy Act, where the CEO believes on reasonable grounds that notifying the breach would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, the enforcement body;^[5]

• SIA would not be required to obtain an individuals' consent to collect sensitive information, where the collection of that information is reasonably necessary for, or directly related to, one or more of SIA's functions or activities;^[6]

• another Australian Privacy Principle (APP) entity would be able to disclose information to SIA,^[7] including a person's government identifier,^[8] where that entity reasonably believes that the use or disclosure of the information is reasonably necessary for one or more of SIA’s enforcement related activities;

• SIA would not be required to obtain a person's consent to disclose their personal information to an overseas recipient, where that recipient is a body that performs functions, or exercises powers, that are similar to those performed or exercised by an enforcement body; ^[9] and

• SIA would not be required to give a person access to their personal information where to do so would be likely to prejudice one or more enforcement related activities conducted by SIA.^[10]

Preliminary international human rights legal advice

Right to privacy

1.26 The proposed inclusion of SIA as an enforcement body for the purposes of the Privacy Act, which would enable SIA to use and disclose personal information, engages the right to privacy.^[11] The right to privacy encompasses respect for informational privacy, including the right to respect for private information and private life, particularly in relation to the storing, use, and sharing of personal information.^[12] The right may be subject to permissible limitations which are prescribed by law and are not arbitrary. In order for a limitation not to be arbitrary, it must pursue a legitimate objective, be rationally connected to that objective, and be a proportionate means of achieving that objective.^[13]

1.27 The statement of compatibility acknowledges that the proposed inclusion of SIA as an enforcement body engages the right to privacy.^[14] It argues that this amendment is not arbitrary because it is 'sufficiently precise', noting that the exemptions only apply where the use or disclosure of information is reasonably necessary for SIA's enforcement related activities.^[15] However, the statement of compatibility does not go on to explain the objective behind providing this exemption from the Privacy Act.

1.28 In relation to the proportionality of the measures, the statement of compatibility notes that SIA would otherwise remain subject to the requirements of the Privacy Act and Australian Privacy Principles.^[16] It also argues that it is proportionate for SIA to be listed an enforcement body because, while formal allegations put forward by the body would not result in civil penalties or criminal charges, it would still have specific investigative powers in relation to threats to sports integrity, and the results of such investigations would be used to pursue cases of anti-doping rule violations, including before the National Sports Tribunal.^[17] It also highlights that the current secrecy provisions within the ASADA Act, which will remain in place, act as a protection to ensure that information cannot be inappropriately disclosed.^[18]

1.29 However, it remains unclear what enforcement related activity is likely to be carried out by the proposed SIA, particularly noting that it appears that the functions of SIA would be expanded beyond anti-doping, to include matters that threaten 'sports integrity', including suspected cases of child abuse and bullying, intimidation, discrimination or harassment.^[19] The statement of compatibility does not explain what are the likely 'enforcement related activity' that this exemption would apply to.

1.30 No information has been provided as to why each exemption from the Privacy Act is required or proportionate. For example, it is unclear what safeguards would operate in relation to the sharing of personal information with overseas entities, and what steps SIA would be required to take to ensure that personal information being shared in such a way would be protected. It is unclear why it is necessary and proportionate to give a blanket exemption from the need to obtain an individuals' consent to collect sensitive information where it is reasonably necessary or related to SIA's broad range of functions or activities. Furthermore, the extent of the proposed exemption from notifying eligible data breaches where the CEO believes this would likely prejudice enforcement related activities is unclear. For example, it is not clear if notification would be required once an enforcement related activity had ended. Similarly, it is unclear whether, once an enforcement related activity had ended, an individual would be able to require or otherwise request access to personal information being held by the SIA.

1.31 In summary, the bill seeks to expand the functions currently being exercised by the Australian Sports Anti-Doping Authority. In exercising these broader functions, the newly named Sport Integrity Australia would also be given the status of an 'enforcement body' for the purposes of the Privacy Act 1988, thereby enlivening a number of powers in relation to the gathering, sharing and control over access to personal information. These proposed measures engage and may limit the right to privacy.

1.32 More information is required in order to assess the compatibility of this measure with the right to privacy, in particular:

• the legitimate objective that the measure seeks to address (including any reasoning or evidence that establishes that the objective addresses a substantial and pressing concern);

• the type of information it is anticipated that SIA would obtain and/or share in addressing threats to 'sports integrity' (including what investigations are likely to be conducted by SIA in relation to the abuse of children and any bullying, intimidation, discrimination or harassment in a sporting environment);

• whether there are any other, less rights restrictive, methods to achieve the stated objective;

• whether an eligible data breach would be required to be notified once any prejudice to an enforcement related activity has ceased; and

• what safeguards would protect the privacy of personal information which SIA could share (including with overseas entities).

Committee view

1.33 The committee notes that the bill seeks to expand the functions currently being exercised by the Australian Sports Anti-Doping Authority. In exercising these broader functions, the newly named Sport Integrity Australia would also be given the status of an 'enforcement body' for the purposes of the Privacy Act 1988, thereby enlivening a number of powers in relation to the gathering, sharing and control over access to personal information. The committee notes the legal advice that these measures engage and may limit the right to privacy. In order to assess whether these measures constitute a proportionate limitation on the right to privacy, the committee seeks the minister's advice as to the matters set out at paragraph [1.32].

---

[1] This entry can be cited as: Parliamentary Joint Committee on Human Rights, Australian Sports Anti-Doping Authority Amendment (Sport Integrity Australia) Bill 2019, Report 1 of 2020; [2020] AUPJCHR 5.

[2] Schedule 1, item 11 of the bill. 'Sports integrity' being defined to mean the manifestation of the ethics and values that promote community confidence in sport.

[3] Schedule 1, item 12.

[4] Schedule 2, item 23.

[5] Privacy Act 1988, section 26WN. 'Enforcement related activity' is defined in subsection 5(1) of the Privacy Act 1988 to mean: the prevention, detection, investigation, prosecution or punishment of criminal offences, or breaches of a law imposing a penalty or sanction; the conduct of surveillance activities, intelligence gathering activities or monitoring activities; the conduct of protective or custodial activities; the enforcement of laws relating to the confiscation of the proceeds of crime; the protection of public revenue; the prevention, detection, investigation or remedying of misconduct of a serious nature, or other conduct prescribed by the regulations; or the preparation for, or conduct of, proceedings before any court or tribunal, or the implementation of court/tribunal orders.

[6] Australian Privacy Principle (APP) 3.4(d)(ii).

[7] APP 6.2(e).

[8] APP 9.2(e).

[9] APP 8.2(f).

[10] APP 12.3(i).

[11] International Covenant on Civil and Political Rights (ICCPR), article 17.

[12] See, UN Human Rights Committee, General Comment No. 16: Article 17 (1988) [10]; and General Comment No. 34 (Freedom of opinion and expression) (2011) [18].

[13] See, for example, Leyla Sahin v Turkey, European Court of Human Rights (Grand Chamber) Application No. 44774/98 (2005); Al-Adsani v United Kingdom, European Court of Human Rights (Grand Chamber) Application No. 35763/97 (2001) [53] - [55]; Manoussakis and Others v Greece, European Court of Human Rights, Application No. 18748/91 (1996) [36] - [53]. See also the reasoning applied by the High Court of Australia with respect to the proportionality test in Lange v Australian Broadcasting Corporation [1997] HCA 25.

[14] Statement of compatibility, pp. 4-5.

[15] Statement of compatibility, p. 4.

[16] Statement of compatibility, p. 4.

[17] Statement of compatibility, pp. 4-5.

[18] Statement of compatibility, p. 5.

[19] Noting that, depending on the kinds of enforcement activities which may be undertaken, and the manner in which this takes place in practice, these measures may promote the rights of the child (see, Convention on the Rights of the Child).