The Finnish data protection authority issued a warning and injunction to the Finnish Centre for Ethics in Sports (SUEK) for publishing information related to a doping sanction against an athlete after the competition ban period had already ended, as well as data concerning an ongoing investigation.

Facts and context

The Finnish data protection authority published a decision against the Finnish Centre for Ethics in Sports (SUEK), including the issuance of a warning, for breaches related to the publication of personal data of an athlete.

The case originated from a complaint by an athlete and a report from a third party regarding SUEK's publication practices, notably following a decision by the disciplinary commission for anti-doping matters in January 2021.

Reasons for the decision

The authority identified two distinct breaches related to two successive publications:

• Obligation of lawfulness, fairness and proportionality: The authority considered that publishing information about the athlete's sanction on the very day the ban period ended was a disproportionate measure. Although SUEK is generally authorized to publish such sanctions under anti-doping regulations, a case-by-case assessment is necessary. In this case, as the substance did not enhance performance and the voluntary three-and-a-half-month ban had already ended, the publication no longer served a preventive purpose and excessively infringed on the athlete's right to privacy, as clarified by the Court of Justice of the European Union in its ruling C-474/24.
• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority found that SUEK had no valid legal basis to publish, in March 2021, personal data related to the ongoing investigation into a possible violation of the voluntary ban by the athlete. The publication obligation under anti-doping regulations applies only to final decisions and sanctions, not to ongoing investigations.

Authority's decision

Consequently, the authority issued a warning to the Finnish Centre for Ethics in Sports (SUEK).

Furthermore, the authority ordered the organization to bring its personal data processing operations into compliance with data protection legislation.

Lessons learned

This decision reminds that:

• Publishing a disciplinary sanction, even if provided for by sectoral regulation, must be subject to a case-by-case proportionality analysis, taking into account the impact on the individual's privacy.
• Publishing an athlete's name on a sanctions list after the ban period has expired is, in principle, a disproportionate measure relative to the intended objective.
• The existence of a legal basis for publishing finalized sanctions does not extend to publishing information about ongoing investigations, which requires its own legal basis.
• Information relating to an anti-doping rule violation does not automatically constitute health data, unless it allows conclusions to be drawn about the person's health status (for example, in case of use for medical reasons).