A promise that information will remain anonymous is not a promise to destroy all information relating to identity.
Well, yeah, actually, it kinda is. That's what anonymous means.
There are protocols that could allow for retesting without the testing or collecting parties needing to know anything about the identity of the party being tested. The simplest one I can think of off the top of my head: randomly issue a sheet of identically numbered labels to each participating player, without tracking which player gets which labels, and have each player apply one of their labels to each test sample. Obviously, there might need to be additional protocols in place to prevent correlation of labels with players after the fact, but the point is that it's a solved problem, and one that the medical testing community has dealt with before.
I'm not saying the players should sue for the breach of confidentiality; there's really nothing that can be done about that. But there was never any serious attempt made at anonymity, despite promises that the data would be both anonymous AND confidential, and that should be a concern.