Suomen urheilun eettinen keskus SUEK ry – Complaint Upheld (Finland, 2026)

An athlete (the data subject) gave a doping sample containing a low concentration of a banned substance in August 2020. The national anti-doping organisation (the controller) issued a decision confirming that the athlete had committed an anti-doping rule violation in January 2021. Following this, the athlete took a voluntary suspension from their sport. The data subject contested the GDPR compliance of two separate processing operations. On the one hand, the controller published information about the data subject’s suspension and the banned substance found in their system on a public suspension list maintained on its website for one month in January 2021. In addition, it also published information about an ongoing investigation into whether the data subject had violated the voluntary suspension by participating in certain training sessions during it. The DPA received two complaints on the publication of this information, filed in December 2020 and May 2021 respectively. The complaints were handled jointly. The parties disagreed on if the GDPR was applicable to the processing operations in question, whether there was a legal basis for the processing, and whether health data within the meaning of Article 4(15) GDPR had been processed. Furthermore, the DPA investigated potential violations of the principles of lawfulness, fairness, transparency, and data minimisation. The DPA issued the controller a reprimand and ordered it to bring its processing activities into compliance with the GDPR regarding the publication practices for the public list of suspended athletes and the legal basis for the processing of personal data. First, the DPA dismissed the controller's argument according to which the GDPR did not apply to the processing at issue. The DPA relied on the CJEU’s decision in the case C-474/24 - NADA Austria and Others, where the court explicitly held that the processing of personal data contained in anti-doping infringement falls within the scope of the GDPR.CJEU in C-474/24 – NADA Austria and Others, paragraph 54. Second, the DPA held that information about the suspension and the banned substance found in the athlete’s system did not constitute health data within the meaning of Article 4(15) GDPR: it was not possible to draw conclusions about the data subject’s health status based on the published information alone. Third, the DPA held that the controller could not base the processing on Article 6(1)(a) or Article 6(1)(e) GDPR. According to the controller, the data subject gives their consent to the processing when they commit to complying with the Finnish Anti-Doping Code in connection with their membership in a sports federation. However, the DPA concluded that there was a clear imbalance between the data subject and the controller, as the refusal to consent to doping testing and related disciplinary proceedings could result in negative professional, financial, and social consequences for the data subject. The consent could not be considered freely given and was therefore invalid. Furthermore, the controller could not rely on public interest under Article 6(1)(e) GDPR since the basis for the processing was not provided for in national legislation as required by Article 6(3)(b) GDPR. The DPA pointed out that obligations laid down in international anti-doping treaties are only binding on the Finnish government, not the controller. The DPA also came to the conclusion that the controller could rely on a contract within the meaning of Article 6(1)(b) GDPR as a legal basis for publishing personal information on a public list of suspended athletes. However, the controller had no legal basis for publishing personal data related to the ongoing investigation against the data subject. Finally, the DPA held that the controller had infringed Articles 5(1)(a) and (c) GDPR. The DPA referred to the case C-474/24 and pointed out that the principles of lawfulness, fairness, transparency and data minimisation are an expression of the principle of proportionality according to the CJEU.CJEU in C-474/24 – NADA Austria and Others, paragraph 77. The DPA weighed the infringement on the data subject’s right to privacy resulting from the publication of personal data that had a legal basis under Article 6(1)(b) GDPR against the importance of the objective pursued by the publication. As the information had been published after the athlete’s voluntary suspension had ended and the substance had entered their system due to a contaminated supplement, the DPA held that the processing had been a disproportionately severe measure.