Publication of Athletes’ Doping Details May Breach GDPR

In a matter referred for a preliminary ruling to the Court of Justice of the European Union (CJEU) by the Federal Administrative Court, Austria, the opinion shared by Advocate General Spielmann addresses a relevant question – how to balance, on the one hand, the requirements of ethical sport, such as the online publication of the names of athletes who have been sanctioned for infringements of anti-doping rules, and, on the other hand, the protection of the personal data of those athletes, arising from Regulation (EU) 2016/679 (GDPR). The outcome of the case could have serious implications for the treatment of personal data in the publication of disciplinary sanctions in sport.

Background:

The Austrian National Anti-Doping Agency (NADA) planned to publish a list of four athletes suspended for doping violations by the Austrian Anti-Doping Legal Committee (ÖADR), as required under Austrian anti-doping law. The list, intended for publication on NADA’s website, was to include details such as the sport, the anti-doping rule violation, and the penalty imposed.

The athletes asked the ÖADR and NADA to refrain from publishing their details, and when their request was denied, they filed a complaint with the Austrian Data Protection Authority. They alleged a breach of their right to erasure or restriction of data and sought an order directing the ÖADR and NADA to remove the publication. The athletes contended that the indiscriminate publication system under Austrian law was incompatible with Article 6(3) of the GDPR.

After the Authority dismissed their complaint as unfounded, the athletes appealed to the Federal Administrative Court of Austria, which subsequently referred the matter to the Court of Justice of the European Union (CJEU) for a preliminary ruling.

Opinion shared by Advocate-General Spielmann:

• The anti-doping activity carried out by national bodies falls within the “scope of Union law” for the purposes of Article 2(2)(a) GDPR and Article 16(2) TFEU — thus the GDPR applies.
• Article 9(1) of the GDPR must be interpreted as meaning that disclosing the impugned details does not constitute processing of data concerning health, unless that indication is capable of revealing, even indirectly, information on the health status, including the future health status, of the athlete concerned, a matter which it is for the referring court to ascertain.
• Article 10 of the GDPR may apply to personal data processed under national anti-doping rules if the offences, though not classified as criminal under national law, are punitive and serious enough to be equivalent to criminal penalties. It is for the national court to decide whether this is the case.
• Article 10 of the GDPR, read with Article 79(1), means that the actions or decisions of any authority responsible for overseeing the processing of personal data related to criminal convictions or offences must be open to judicial review.
• Articles 5(1)(a) and (c) and 6(3) of the GDPR mean that national anti-doping bodies cannot be required to publish athletes’ personal data—such as their names, bans, or the substances involved—if doing so is not or is no longer proportionate in scope or duration. The national court must assess this. Additionally, under Articles 5 and 6, data controllers must balance the relevant interests on a case-by-case basis before processing data to ensure compliance with the GDPR.
• Article 77 of the GDPR provides that a complaint under Article 17 (right to erasure) is inadmissible if it concerns personal data that has not yet been published at the time the complaint was filed or decided. However, a complaint may be admissible if the data processing is not purely hypothetical and allows the supervisory authority to take preventive action. It also means that a complaint previously rejected as inadmissible can become admissible if the data processing occurs while related court proceedings are still ongoing. National law must set the rules for such admissibility in line with the principles of fairness, effectiveness, and the right to judicial remedy under the GDPR.

The opinion is not binding and is contrary to the Advocate General Ćapeta’s opinion from two years ago, which held that the publication of anti-doping decisions falls outside the scope of the GDPR. In that matter, the CJEU had dismissed USK’s request for a preliminary ruling on the grounds that it did not qualify as a ‘court’ within the meaning of Article 267 of the TFEU.