Suomen urheilun eettinen keskus SUEK ry – Complaint Upheld (Finland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Finnish anti-doping organization, SUEK, faced complaints about how it handled an athlete's doping case. The ruling reminds organizations to be careful when sharing personal information, especially sensitive health data.
What happened
SUEK published information about an athlete's doping violation and suspension without proper legal grounds.
Who was affected
The athlete involved in the doping case was directly affected by the publication of their personal information.
What the authority found
The Finnish Data Protection Authority reprimanded SUEK for not ensuring GDPR compliance in their processing of the athlete's data.
Why this matters
This ruling emphasizes the need for organizations to have a valid legal basis before sharing sensitive personal information. It serves as a warning for similar organizations to review their data handling practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 26 August 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An athlete (the data subject) gave a doping sample containing a low concentration of a banned substance in August 2020. The national anti-doping organisation (the controller) issued a decision confirming that the athlete had committed an anti-doping rule violation in January 2021. Following this, the athlete took a voluntary suspension from their sport. The data subject contested the GDPR compliance of two separate processing operations. On the one hand, the controller published information about the data subject’s suspension and the banned substance found in their system on a public suspension list maintained on its website for one month in January 2021. In addition, it also published information about an ongoing investigation into whether the data subject had violated the voluntary suspension by participating in certain training sessions during it. The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of Article 4(15) GDPR had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474/24 - NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR.CJE
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Suomen urheilun eettinen keskus SUEK ry in FI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Suomen urheilun eettinen keskus SUEK ry - Finland (2026). Retrieved from cookiefines.eu
Last updated: