Court of Justice of the European Union: The identity of athletes sanctioned for doping may be published, but not automatically
The Court of Justice of the European Union has ruled that Member States may, in principle, allow the public disclosure of the names of professional athletes who have violated anti-doping rules, together with the duration of the ban and the reasons for the sanction. Such publication may serve to protect the fairness of competitions, deter doping and ensure the effective enforcement of bans. However, the judgment of 14 July 2026 in Case C-474/24, NADA Austria and Others, rejects automatic publication without an individual assessment. The competent authority must balance the public interest against the athlete's rights and limit both the scope of the data and the period during which they remain available. Athletes must be allowed to lodge a preventive complaint with the data protection authority when there are concrete indications that publication is imminent.
Dispute involving four professional athletes in Austria
The case arose from proceedings against four professional athletes whose identities are protected in the court documents by the initials AR, YT, DI and RN. The Austrian Anti-Doping Legal Commission, known as ÖADR, and the Austrian Independent Arbitration Commission, USK, banned them from participating in national and international competitions because of anti-doping rule violations. According to the press release issued by the Court of Justice of the European Union, the sanctions were imposed for a limited period or for life, depending on the individual case. Austrian legislation provided for such decisions to be published on the website of the national anti-doping agency NADA Austria, together with the athlete's full name, sporting discipline, a description of the violation, the sanction imposed and its start and end dates. ÖADR also published on its own website the name of the prohibited substance associated with the violation.
The athletes challenged the publication of their names and sporting disciplines before the Austrian Federal Administrative Court. They argued, among other things, that the published information could constitute health data, the processing of which is subject to stricter rules under the GDPR, as well as data relating to criminal convictions and offences. They particularly objected to an indiscriminate model in which data are published on the basis of a general rule, without sufficient scope for assessing the circumstances of each athlete. Before bringing the matter before the court, their requests to NADA Austria and ÖADR had been unsuccessful, while the Austrian data protection authority rejected the complaints of three athletes as unfounded. The complaint of the fourth athlete was dismissed because her data had not yet been published at that time, raising the additional question of whether protection may be sought before the data processing itself takes place.
The GDPR also applies to anti-doping publications
The Court of Justice of the European Union confirmed that the GDPR applies to the publication of information on anti-doping sanctions on publicly accessible websites. Such processing does not fall outside the scope of EU law merely because it is connected with sport or with a national doping control system. Publishing a person's identity, the reasons for the sanction and the duration of the ban constitutes the processing of personal data and must therefore have an appropriate legal basis and comply with the fundamental principles of lawfulness, fairness, transparency, data minimisation and storage limitation. In practice, this means that the existence of national legislation is not sufficient in itself if the way in which it is applied results in a disproportionate interference with privacy.
At the same time, the Court accepted that the fight against doping is an objective of general interest. In its reasoning, it referred to the preservation of fair, honest and objective sporting competition, equal opportunities among athletes, the protection of health and respect for ethical values in sport. Public disclosure may help deter rule violations, prevent doping and ensure the effectiveness of imposed bans. It may also inform individuals and organisations whose interests are directly connected to an athlete's status, such as current or potential employers, clubs, competition organisers and sponsors. Nevertheless, the existence of a legitimate objective does not remove the need to verify whether the specific publication is necessary and proportionate.
When doping information becomes health data
One of the key questions was whether information that an athlete had violated an anti-doping rule should automatically be regarded as health data. The Court answered that such information does not, in itself and as a general rule, constitute health data. A different conclusion is possible where the publication contains the name or category of a prohibited substance or method and where that information, combined with other available data, makes it possible to draw direct or indirect conclusions about the person's past, present or future physical or mental health. The assessment therefore depends not only on the title of the publication or the formal classification of the data, but also on what the combination of the published elements can actually reveal to the public.
That distinction has practical consequences. Standardised tables and press releases must be assessed according to their content and context, while the competent authority should determine whether the same objective can be achieved with fewer details. This is particularly important where naming the substance or method, together with other publicly available information, would unnecessarily reveal treatment, a diagnosis or another sensitive health-related circumstance.
An anti-doping sanction is not a criminal conviction
The Court also rejected the argument that information concerning an anti-doping rule violation and the resulting sporting ban must automatically be regarded as personal data relating to criminal convictions and offences. According to the judgment, such violations and sanctions are directed at a specific group of persons, namely athletes, and are intended to ensure compliance with rules of conduct specific to that group. In terms of their function, they are comparable to disciplinary sanctions within a professional or organised system, rather than necessarily to criminal-law convictions imposed by the state. Consequently, the special regime under Article 10 of the GDPR for data relating to criminal convictions and offences does not apply merely because the information concerns anti-doping matters.
Anti-doping information nevertheless remains personal data protected by the GDPR, and its public availability may affect an athlete's reputation, professional opportunities and private life. The permissibility of the sanction must therefore be distinguished from the permissibility of the way in which it is presented to the public. Even after a final decision has been adopted, the content, reach and duration of an online publication require a separate assessment.
No automatic publication without an individual balancing of interests
The central message of the judgment is that the entity responsible for publication must, before publication takes place, have the ability to balance the competing interests on an individual basis. On one side is the public interest in a credible and effective anti-doping system, while on the other are the athlete's rights to privacy, the protection of personal data and proportionate treatment. The assessment must not be merely a formal confirmation of a predetermined outcome. It should take into account the nature of the violation, the severity and duration of the sanction, the athlete's professional status, their level of public recognition, age and vulnerability, the content of the data intended for publication and the actual need for the information to be made available to an unlimited number of people.
The Court stated that elite athletes who enjoy a certain reputation bear a particular responsibility, which may strengthen the public interest in transparency. Nevertheless, public prominence does not remove the right to data protection or justify every level of disclosure. A distinction must be made between prominent professionals, athletes with a limited public role and persons in particularly sensitive circumstances. Austrian rules already provided for exceptions for recreational athletes, particularly vulnerable persons and whistleblowers, but the judgment requires a genuine possibility of assessing each individual case.
The duration of publication becomes a key issue
The Court devoted particular attention to the period during which the data remain available online. According to the official summary of the judgment, publication identifying an individual by name for longer than the anti-doping sanction itself is not proportionate, given the seriousness of the interference with the right to private life and the protection of personal data. That finding is important because online publication is not comparable to a one-off notice issued to a limited group. Information can be indexed by search engines, copied to other websites and remain associated with a person's name for years, even after the ban has expired and the athlete has once again become eligible to compete.
The competent authorities will therefore have to establish in advance time limits, removal procedures and methods for verifying whether the information has ceased to be publicly available once it is no longer necessary. It is not sufficient to publish a list of sanctioned persons and leave it permanently on a website without periodic review. Proportionality may require the removal of names once the ban expires, restrictions on archival access or a different technical solution preventing a temporary sporting sanction from becoming a permanent digital label. The judgment does not prescribe a single technical model for the entire European Union, but it sets a clear boundary: the duration of publication must be linked to the purpose for which the data were published.
An athlete may act even before the data are published
An important part of the decision concerns the athlete's right to approach the competent data protection authority before publication actually takes place. The Court concluded that a preventive complaint must be possible where there are concrete indications that processing is inevitable or will occur in the near future. This rejects the approach under which a person would have to wait until their data had already become public and potential harm had occurred before seeking protection. A merely abstract or hypothetical concern is not sufficient, but a final decision, an announcement of publication or an established practice of the competent authority may indicate an imminent risk.
Such protection is important because the subsequent removal of information cannot always reverse the effects of its initial publication online. The competent authority must therefore be able to examine the planned processing, while the athlete must have an effective means of challenging its lawfulness and proportionality before potential harm occurs.
Consequences for anti-doping bodies and sports federations in the EU
The decision does not prohibit public lists of sanctioned professional athletes, but it changes the way in which such lists must be designed. Before publication, anti-doping organisations will have to assess the necessity, content, reach and duration of the availability of the data. The procedure may include internal criteria, a reasoned decision, an opportunity for the athlete to present special circumstances and a clear channel for approaching the data protection authority. A distinction must be made between information necessary to enforce the ban within sport and data that must be available to the general public.
Member States and sports organisations will therefore have to review rules providing for mandatory publication without exception. A provision that does not allow the balancing of interests or automatically retains data after the ban has expired would be difficult to reconcile with the standard established by the Court. National courts dealing with similar disputes will have to apply the same interpretation of EU law, while taking into account the facts of each individual case.
The broader relationship between the judgment and the rules of the World Anti-Doping Agency
The WADA World Anti-Doping Code is the foundational document harmonising the anti-doping rules of sports organisations and public authorities at global level. The Code in force during 2026 contains rules on the public disclosure of final anti-doping decisions, with special regimes for certain categories of athletes and other persons. In February 2026, WADA published the final version of the 2027 Code, which will enter into force on 1 January 2027. However, international sporting standards in the Member States of the European Union must be implemented in accordance with EU law, including the GDPR and the fundamental rights guaranteed by the EU Charter.
The judgment does not abolish the global transparency model, but requires its implementation in the European Union to be proportionate. Sports organisations must be able to explain why publication of an identity is necessary, why particular data are being published and how long they will remain available. In that context, the GDPR is not an absolute obstacle to the public disclosure of sanctions, but it requires a balance with the protection of privacy.
The final decision in the Austrian dispute rests with the national court
In preliminary ruling proceedings, the Court of Justice of the European Union does not directly decide the outcome of the dispute between the four athletes and the Austrian authorities. Its role is to interpret EU law, while the Austrian Federal Administrative Court must now apply that interpretation to the specific cases. The national court will have to determine whether the Austrian system allows for a genuine individual balancing of interests, whether the published or planned data were necessary and whether the period during which they were available was proportionate. At the same time, the judgment provides binding guidance to other courts in the European Union when comparable questions arise before them.
The case also has a longer procedural history. In May 2024, the Court of Justice of the European Union dismissed an earlier request for a preliminary ruling in Case C-115/22 because the Austrian USK did not satisfy the requirement of independence necessary to qualify as a court or tribunal entitled to refer questions under EU law. The questions were subsequently brought before the Court through the Austrian Federal Administrative Court. In his opinion of September 2025, Advocate General Dean Spielmann warned that the automatic publication of the name of every professional athlete was contrary to the principle of proportionality and proposed a stricter individual assessment. In its final judgment, the Grand Chamber accepted that public disclosure may be permissible, but maintained the key requirement that the interests must be balanced before publication and that disproportionately permanent online exposure must be avoided.
The decision establishes a middle ground between complete anonymity and the automatic public labelling of every sanctioned athlete. Transparency remains possible when it protects the integrity of sport, but it cannot be justified solely by a general rule. The decisive question will be whether the disclosure of the identity, in its specific scope and duration, is necessary for the objective being pursued. Athletes gain stronger procedural protection, while anti-doping bodies bear greater responsibility for data whose effects may outlast the ban itself.
Sources:
- Court of Justice of the European Union – press release on the judgment in Case C-474/24, NADA Austria and Others (link)
- EUR-Lex – full text of the Grand Chamber judgment of 14 July 2026 in Case C-474/24 (link)
- Court of Justice of the European Union – Opinion of Advocate General Dean Spielmann of September 2025 (link)
- EUR-Lex – official text of the General Data Protection Regulation, Regulation (EU) 2016/679 (link)
- World Anti-Doping Agency – World Anti-Doping Code in force during 2026 (link)
- World Anti-Doping Agency – information on the Code and International Standards entering into force on 1 January 2027 (link)