Rules for this sort of thing come from two sources: institutions and publishers; there is no central body for research ethics, though there can be national and international organizations that choose to publish guidelines. There may also be country-specific laws (or at other levels of government), but ordinarily in my experience these are mostly administered at the institution level where the institution guidelines meet or exceed any legal standards, so an individual investigator can just comply with their institution and they'll be covered.
Most journals publishing in a (bio)medical area have some official statement that authors must provide assurance that some standard for research subjects protection is met. It's really up to the journal what their standard is and what they will publish. In some jurisdictions they may be subject to legal limitations but I am not familiar with these.
It seems like the relevant legal issues here would concern what police are and are not allowed to do with biological evidence and under what circumstances those samples can be released to third parties and what those third parties can do with it. I'm not trained in law and certainly not French law and I don't really think Academia.SE is the place to discuss either.
What I can speak to, though, is what sort of procedures would typically be followed in an academic research context in the US, where I work. All of that comes down to the IRB decides, but I can make a couple comments about how they'd go about those decisions:
Consent is not required for every study. In particular, consent is usually obtained to collect data. The most strict research subjects protection occurs when data collection impacts the subjects directly - for example, where a medication is given as part of the trial. In this case, there is no risk to the subjects in collecting the data: the samples are already collected for another purpose, which was not research-related. It's common in medical fields to do retrospective analyses from, say, patient health records. No informed consent is collected in these cases.
Even when data collection is not a risk, IRBs are still concerned with protecting research subjects. The primary concern is that release of data itself may somehow harm those subjects, whether through breach of their privacy or financial risks. Often these are mitigated by anonymizing the study, though IRBs will take care to ensure that data are truly anonymized, which in some cases may not be possible and may require further action like an unusual step to obtain consent. However, as far as I know IRBs are mostly/only concerned with individual harm. I don't believe IRBs typically consider institutional harm, such as to a sport, athletic organization, country, or hospital. To the contrary, a lot of data that are harmful or embarrassing to institutions are considered to have a lot of public value. Examples might be data that show evidence of racial or sex discrimination.
In this particular case, it seems that the study is missing a declaration that the work was reviewed by an appropriate ethical research authority. This seems to be against the journal's own policy, though the details of that policy are not made explicit. An IRB may have restricted how the data could be obtained or described, or they may not. I don't see a blatant violation here, though it does seem to me that the authors had a clear editorial intent to raise a controversy, as they could have easily published their main scientific findings without tying it explicitly to cycling.
