Suomen urheilun eettinen keskus SUEK ry – Complaint Upheld (Finland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish anti-doping organization was reprimanded for publishing information about an athlete's doping violation without proper legal grounds. The authority found that the organization did not follow rules about fairness and transparency in handling personal data. This ruling serves as a reminder for organizations to ensure they have a solid legal basis for sharing sensitive information.
What happened
The Finnish anti-doping organization published details about an athlete's doping violation on its website without proper justification.
Who was affected
The athlete who was subject to the doping violation and subsequent public disclosure was affected.
What the authority found
The Finnish Data Protection Authority reprimanded the organization for not complying with GDPR principles regarding the processing of personal data.
Why this matters
This case stresses the need for organizations to have clear legal grounds before making sensitive information public, especially regarding athletes.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
An athlete (the data subject) gave a doping sample containing a low concentration of a banned substance in August 2020. The national anti-doping organisation (the controller) issued a decision confirming that the athlete had committed an anti-doping rule violation in January 2021. Following this, the athlete took a voluntary suspension from their sport. The data subject contested the GDPR compliance of two separate processing operations. On the one hand, the controller published information about the data subject’s suspension and the banned substance found in their system on a public suspension list maintained on its website for one month in January 2021. In addition, it also published information about an ongoing investigation into whether the data subject had violated the voluntary suspension by participating in certain training sessions during it. The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of Article 4(15) GDPR had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474/24 - NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR.CJE
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Suomen urheilun eettinen keskus SUEK ry in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Suomen urheilun eettinen keskus SUEK ry - Finland (2026). Retrieved from cookiefines.eu
Last updated: