PIPEDA Report of Findings #2018-006: Breach of the World Anti-Doping database
The Office of the Privacy Commissioner of Canada (OPC) initiated an investigation into the World Anti-Doping Agency (WADA) following a 2016 data breach of its Anti-Doping Administration and Management System (ADAMS) by the "Fancy Bear" hacking group. The breach led to the public disclosure of highly sensitive personal and health information of 127 athletes, with 11,837 athletes' data potentially accessible. The OPC examined whether WADA had sufficient security safeguards under PIPEDA Principles 4.1.4, 4.7, 4.7.1, 4.7.2, and 4.7.3. The investigation found WADA's safeguards to be insufficient, particularly concerning access controls, monitoring, policies, and encryption, given the sensitivity of the data and the sophisticated nature of the attack. WADA agreed to implement most of the OPC's recommendations, including developing a comprehensive information security framework, strengthening access controls, and employing encryption at rest. The OPC accepted WADA's proposal for optional two-factor authentication for athletes, provided WADA actively promotes its use. Consequently, the matter was concluded as well-founded and conditionally resolved, with the OPC entering into a compliance agreement to monitor WADA's implementation.
- 1Whether WADA's security safeguards were appropriate to the sensitivity of the personal information in ADAMS, as required by PIPEDA Principles 4.7, 4.7.1, 4.7.2, and 4.7.3.
- 2Whether WADA had implemented adequate policies and practices to give effect to PIPEDA principles, including procedures for protecting personal information, staff training, and policy documentation, under Principle 4.1.4.
- 3Whether WADA's access controls, including password management, multi-factor authentication, and oversight of administrative accounts granted to Anti-Doping Organizations (ADOs), were sufficiently robust.
- 4Whether WADA's monitoring and logging capabilities were adequate to detect and respond to security anomalies and intrusions.
- 5Whether WADA had a proper incident response plan and a documented risk-management framework.
- 6Whether WADA employed encryption for data at rest in the ADAMS database.
- 7Whether WADA provided sufficient security awareness training to its staff and ADAMS stakeholders.
- Security safeguards: Safeguards found insufficient
- Access controls: Access controls found insufficient
- Monitoring and policies: Monitoring and policies found insufficient
- Encryption: Encryption found insufficient
- Remedial actions: WADA agreed to implement recommendations
- Two-factor authentication: Optional 2FA accepted with promotion condition
- Overall complaint outcome: Complaint well-founded and conditionally resolved
Well-founded and conditionally resolved
WADA's security safeguards were found to be insufficient for the highly sensitive personal information it held, particularly regarding access controls, monitoring, policies, and encryption. However, WADA committed to implementing most of the OPC's recommendations, leading to a conditional resolution.
The OPC recommended WADA develop a comprehensive Information Security framework, implement stronger access controls (mandatory 2FA for non-athletes, mandatory password changes, better ADO oversight), employ encryption at rest, ensure proper application security and monitoring, and provide a third-party report on implementation.
- Principle 4.1.4 PIPEDA
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- Principle 4.7.2 PIPEDA
- Principle 4.7.3 PIPEDA
- s.11(2) PIPEDA
- s.17.1(1) PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro