Until now, anyone in Austria who has been banned for an anti-doping rule violation could find their name online in just a few clicks – along with their sport, the length of the ban, and the reasons for it. Is that still transparency, or is it already a digital pillory? In its judgment of July 14, 2026 (Case C-474/24, NADA Austria and Others), the Grand Chamber of the Court of Justice of the European Union (CJEU) answered that question. The result is a middle ground: naming athletes publicly remains possible, but no longer without conditions.
What the Case Was About – the Austrian Proceedings
The case was brought by four athletes (anonymized in the judgment as AR, YT, DI, and RN) who had been banned for anti-doping rule violations – some for a fixed term, some for life – by the Austrian Anti-Doping Legal Commission (ÖADR) or by the Independent Arbitration Commission (USK), which reviews the ÖADR's decisions. Under the Austrian Federal Anti-Doping Act (ADBG), the National Anti-Doping Agency Austria (NADA) publishes these bans as a list on its website: first and last name, sport, the violation committed, the sanction, and the start and end dates of the ban. The ÖADR publishes the same information in its “Press Releases” section and also names the prohibited substance involved, if any. The law provides exceptions only for recreational athletes, particularly vulnerable persons, and whistleblowers. After the athletes unsuccessfully requested the deletion of their names in October 2021, they filed a complaint with the Austrian Data Protection Authority under Art. 77 GDPR, invoking their right to erasure (Art. 17 GDPR). They argued that the information constituted health data (Art. 9 GDPR) and data relating to criminal offenses (Art. 10 GDPR), and challenged the across-the-board publication rule as disproportionate. The Data Protection Authority rejected the complaints of three of the athletes as unfounded; it dismissed the complaint of the fourth athlete (YT) for lack of a legitimate interest in bringing the action, because her data had not yet been published. The athletes appealed this decision to the Federal Administrative Court, which referred seven questions to the CJEU.
An interesting aside: This was already the second attempt. In its judgment of May 7, 2024 (C-115/22), the Court had declared an earlier request for a preliminary ruling from the USK inadmissible, because the USK was not a “court or tribunal” within the meaning of Art. 267 TFEU. This time, the referral came from a genuine court – the Federal Administrative Court – and the CJEU ruled on the merits.
Data Protection Rules Apply – Even in the Fight Against Doping
First, the Court made clear that the GDPR does apply to these publications. The exemption for activities falling outside the scope of EU law (Art. 2 para. 2 lit. a GDPR) must be interpreted narrowly and covers only national security or comparable areas. Neither the fact that the fight against doping falls within the competence of the Member States nor the allegedly non-economic nature of sport changes anything in this respect.
No Health Data – At Least Not Per Se
The Court's answer on Art. 9 GDPR is particularly interesting. The mere information that a person has committed an anti-doping rule violation and has been banned as a result does not, in principle, fall under the concept of “data concerning health”. The situation is different, however, where – as in the ÖADR's practice – the name or category of the prohibited substance or method is disclosed and, combined with other information, conclusions can be drawn about the person's past, present, or future state of health, even if only indirectly through association or inference. The CJEU cites the example of a substance taken because of a particular health condition without a therapeutic use exemption having been requested. Whether health data is involved in the specific case is now for the referring court to determine – and if so, the strict requirements of Art. 9 para. 2 GDPR (such as lit. g) would also have to be met.
The Court's answer on Art. 10 GDPR is just as clear – one of the relatively rare occasions on which it has addressed that provision's scope. Data concerning violations of national anti-doping rules and the sanctions imposed for them is not data relating to “criminal convictions and offences.” The term “offence” is an autonomous concept of EU law and must be understood in a strictly criminal-law sense. Unlike the traffic penalty points in Latvijas Republikas Saeima, which applied to all citizens, anti-doping rules are addressed only to a specific group – athletes – and therefore operate much like disciplinary sanctions. Consistently, the Court did not need to answer the follow-up question (judicial oversight under Art. 10 GDPR).
Publication, Yes – But With Case-by-Case Assessment and a Sense of Proportion
The core of the judgment concerns proportionality (Art. 5 para. 1 lit. a and lit. c and Art. 6 para. 3 GDPR). In principle, the GDPR does not preclude the Austrian rules: doping pursues an objective in the public interest (see also Art. 165 TFEU); publication is appropriate because it deters, prevents doping, and ensures that sanctions are effective; and it is necessary because an anonymized publication, or one limited to a narrow circle of recipients, would not achieve that objective as effectively. For professional athletes, a key point is precisely to inform indirectly affected parties such as employers and sponsors. The decisive point, however, is the limitation: the legislature's abstract balancing is not always sufficient. The CJEU does not require an individual assessment in every single case – but it does where the categories predefined in the law cannot, on their own, ensure that publication is proportionate in the specific case. In such situations, the responsible body must take the circumstances of the individual case into account and carry out an individual balancing of interests before publishing. The relevant factors are the seriousness of the violation and the person's standing – top athletes with a certain level of public profile bear a special responsibility. The Court places particular emphasis on the duration of publication. Naming an athlete publicly beyond the period during which the sanction is in effect is disproportionate. Even during the ban, publication may become disproportionate – for example, if the athlete has long since reached an age at which they could no longer practice the sport anyway. At the same time, the Court stresses how serious the interference is: such online publication can provoke social disapproval and lead to stigmatization, is accessible to a potentially unlimited number of people, and – once posted online – can live on elsewhere even after the original has been deleted.
Preventive Legal Protection: Complaints Before Publication
Finally, the CJEU strengthens preventive legal protection. A complaint under Art. 77 GDPR seeking to prevent an impending online publication is admissible as soon as, at the time it is filed, there are concrete indications that publication is imminent or will take place in the near future – even if the data has not yet been processed at all, as long as the processing is not purely hypothetical. The complaint filed by YT, whose four-year ban had already been confirmed, was therefore not inadmissible for lack of a legitimate interest; it was admissible as a preventive complaint.
Conclusion
The CJEU lets Member States keep their “doping pillory” – but only with a built-in safety net. Publishing the names of banned professional athletes online is, in principle, compatible with the GDPR, but it must not be a purely automatic process: Where the statutory categories cannot guarantee proportionality, an individual balancing of interests must be possible; publication must not outlast the sanction; and affected individuals must be able to turn to the supervisory authority even before publication. Beyond sport, the judgment carries a lesson for any legally mandated publication of personal data: Even a statutory duty to publish does not release the controller from the principle of proportionality – and wherever standardized rules cannot ensure fairness in the individual case, a concrete balancing of interests remains mandatory.
No comments