The Court of Justice of the European Union ruled that the online publication of the names of professional athletes who violated anti-doping rules can be compatible with Union law, provided that a balancing of interests is possible before publication and that the principle of proportionality is respected.

Facts and Context

The Court of Justice of the European Union (CJEU) issued a judgment, reported by the Maltese authority on 22 July 2026, clarifying the conditions for compatibility with the GDPR of the online publication of personal data of professional athletes who violated anti-doping rules.

The case originated from a preliminary ruling request submitted by the Austrian Federal Administrative Court, seized by four athletes contesting the systematic publication of their sanctions on the websites of the Austrian Legal Committee for Anti-Doping (ÖADR) and the Austrian Anti-Doping Agency (NADA Austria), as required by Austrian legislation.

Reasons for the Decision

The Court analyzed the compatibility of the Austrian publication practice with the principles of the GDPR, focusing on the classification of the data and the conditions of lawfulness of the processing.

• Classification of health data (Article 9 of the GDPR): The Court considered that the published information (name, first name, discipline, violation, sanction, and dates) does not, in principle, constitute health data. However, it may become health data if the publication mentions the name or category of the prohibited substance or method, and this reference, combined with other information, is likely to reveal, even indirectly, through an "intellectual operation of cross-referencing or deduction," information about the past, present, or future health status of the person.
• Classification of data relating to offenses (Article 10 of the GDPR): The athletes argued that the published information fell under the category of data relating to criminal convictions and offenses, whose processing is restricted. The Court framed the lawfulness of the publication by respecting the general principles of the GDPR rather than by a principle-based prohibition.
• Conditions of lawfulness and proportionality of processing (Article 5 of the GDPR): The Court held that national legislation may provide for such publication but must imperatively comply with the GDPR. This implies that the entity responsible for the publication must be able to carry out a balancing of interests before any dissemination. Moreover, the publication must respect the principle of proportionality, particularly regarding its duration. Finally, any concerned athlete must have a preventive remedy, such as the possibility to refer to the competent data protection authority when concrete indications suggest that a publication concerning them is imminent.

Authority's Decision

Consequently, the Court ruled that Member States may provide for the publication of such data, but national legislation must comply with the GDPR, notably by ensuring a case-by-case assessment and respect for the principle of proportionality, and by prohibiting any indiscriminate and automatic publication system.

Lessons

This decision clarifies that:

• The classification of information as "health data" depends on its capacity to reveal health status information by deduction, not solely on its explicit nature.
• A national legal basis authorizing the publication of data relating to offenses does not exempt the controller from carrying out a case-by-case balancing of interests before dissemination.
• The principle of proportionality opposes systematic and indiscriminate publication; an individual analysis is required for each case.
• The duration of online publication is an essential element in assessing proportionality and must be strictly justified and limited.
• Data subjects must have an effective and preventive remedy allowing them to challenge an imminent publication before the supervisory authority.