Opinion of the Advocate General — ECLI:EU:C:2025:733
Date: 2025-09-25
Language of the case: German

Summary C-474/24 – 1 
Case C-474/24 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
4 July 2024 
Referring court: 
Bundesverwaltungsgericht (Austria) 
Date of the decision to refer: 
28 June 2024 
Applicants: 
AR 
YT 
DI 
RN 
Other parties to the proceedings: 
Nationale Anti-Doping Agentur Austria GmbH (NADA Austria) 
Österreichische Anti-Doping Rechtskommission (ÖADR) 
  
Subject matter of the main proceedings 
Appeal to the Bundesverwaltungsgericht (Federal Administrative Court, Austria) 
against a decision of the Austrian data protection authority rejecting data 
protection complaints 
Nature and subject matter of the request for a preliminary ruling 
Preliminary ruling under Article 267 TFEU on the interpretation of EU law – 
Protection of personal data 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
2  
Questions referred for a preliminary ruling 
1. Does the processing of personal data relating to individuals by the 
publication of their name, the sport they practise, the anti-doping rule violation 
they have committed, the penalty imposed on them and the start and end dates of 
that penalty, in the form of an entry in a table on the publicly accessible part of the 
website of the Nationale Anti-Doping Agentur Austria GmbH (National Anti-
Doping Agency Austria GmbH) (NADA Austria), 
https://www.nada.at/de/recht/suspendierungen-sperren, and in publicly accessible 
press releases issued by the Austrian Anti-Doping Rechtskommission (Anti-
Doping Legal Committee) (ÖADR) at https://www.oeadr.at, fall within the scope 
of Union law within the meaning of the first sentence of Article 16(2) TFEU, with 
the result that Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27 April 2016 on the protection of natural persons with regard to the 
processing of personal data and on the free movement of such data, and repealing 
Directive 95/46/EC (General Data Protection Regulation – GDPR) is applicable to 
the processing of personal data in this way? 
If Question 1 is answered in the affirmative: 
2. Does information that a certain person has committed a specific [anti-
]doping violation, as a result of which that person has been banned from taking 
part in (national and international) competitions, constitute ‘data concerning 
health’ within the meaning of Article 9 of the GDPR? 
3. Does the GDPR – in particular in the light of the second subparagraph of 
Article 6(3) of the GDPR – preclude national legislation which provides for the 
name of the person affected by the decision of the Austrian Anti-Doping Legal 
Committee or the [Austrian] Independent Arbitration Committee, the duration of 
the ban and the reasons for it to be published, but not in such a way as to make it 
possible to infer data concerning the health of the person concerned? Is it of any 
significance in this regard that, under that national legislation, such information 
need not be disclosed to the general public only if the person concerned is a 
recreational athlete, a minor or a person who has made a significant contribution 
to the detection of potential anti-doping violations by sharing information or other 
indications? 
4. Does the GDPR – in particular in the light of the principles in Article 5(1)(a) 
and (c) thereof – require that publication be preceded in every case by a balancing 
of interests between the personal interests of the data subject that will be affected 
by publication, on the one hand, and the interests of the general public in being 
informed of the anti-doping violation committed by an athlete, on the other? 
5. Does information that a certain person has committed a specific [anti-
]doping violation, as a result of which that person has been banned from taking 
part in (national and international) competitions, constitute the processing of 
NADA AUSTRIA AND OTHERS 
 
3 
personal data relating to criminal convictions and offences within the meaning of 
Article 10 of the GDPR? 
6. If Question 5 is answered in the affirmative: 
Must the activities or decisions of an authority which has been given 
responsibility for exercising control over the processing of personal data relating 
to criminal convictions and offences or related security measures, in accordance 
with Article 10 of the GDPR, be subject to judicial review? 
7. Is a complaint under Article 77 of the GDPR concerning an alleged 
infringement under Article 17 of the GDPR, in the case where the personal data 
relating to the data subject had not yet been processed at the time when the 
complaint was lodged with the supervisory authority and the latter adopted its 
decision, but was processed in the course of the proceedings before the appeal 
court, permissible, or does it subsequently become permissible, provided that, at 
the time when the complaint was lodged, there were already specific indications 
that an operation involving the processing of personal data by the controller was 
imminent or would take place in the near future? 
Provisions of national law relied on 
Bundesgesetz zur Verhinderung von Doping im Sport (Anti-Doping-Bundesgesetz 
2021) (Federal Law on the Prevention of Doping in Sport (2021 Federal Law on 
Anti-Doping Law), ‘the ADBG’: 
‘Independent Dope-Testing Body 
Paragraph 5(1) – (4) … 
(5) In order to perform the tasks of the Independent Dope-Testing Body, a not-
for-profit limited liability company bearing the name ‘Nationale Anti Doping 
Agentur Austria GmbH’ (National Anti-Doping Agency Austria GmbH), 
abbreviated to ‘NADA’, shall be established. The Federal Government shall hold 
more than half of the share capital of that company. Save as otherwise provided 
for in this federal law, that company shall be governed by the provisions of the 
GmbH-Gesetz (Law on Limited Liability Companies), RGBl. No 58/1906. 
Responsibility for administering the Federal Government’s shares in that company 
shall lie with the Federal Minister for Arts, Culture, the Civil Service and Sport. 
The Federal Government shall pay an annual subsidy in the amount of at least 
EUR 2 million to cover the administrative costs connected with that company and 
to enable it to perform its tasks. NADA Austria shall process personal data in its 
capacity as controller within the meaning of Article 4(7) of the GDPR. 
(6) Further to Paragraph 3, the Independent Dope-Testing Body shall inform the 
BSO (Austrian Federal Sports Organisation), sports organisations, athletes, other 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
4  
persons and competition organisers of the following, and make this information 
available to the general public free of charge: 
1. the bodies entitled to order dope tests; 
2. the criteria for inclusion in the National Testing Pool (Paragraph 9); 
3. reimbursement of the costs of the dope-testing procedure; 
4. without prejudice to the provisions of Paragraphs 21(3) and 23(14), the 
security measures (for example, suspensions) and bans imposed on athletes 
and other persons of which the Independent Dop-Testing Body has been 
made aware and the lifting thereof, including the names of the persons 
concerned, the duration of the ban and the reasons for it, but not in such a 
way as to make it possible to infer special categories of personal data 
relating to the persons concerned, in particular data concerning their health. 
In the case of vulnerable persons and recreational athletes, this information 
need not be disclosed. In the case of recreational athletes, disclosure shall be 
mandatory on public health grounds where an anti-doping violation pursuant 
to Paragraph 1(2), points 3 and 9 to 11, hereof has been established. 
5. what data, in particular what personal data and special categories of personal 
data, are processed in the course of anti-doping activities or a dope-testing 
procedure, and for what purpose. 
(7) As regards the finding [of failures to comply with testing and reporting 
obligations] referred to in subparagraph 1, point 3, hereof, the person concerned in 
each case may, within four weeks of being notified [of any such finding], request 
a review thereof by the Independent Arbitration Committee. 
Provisions on data protection 
Paragraph 6(1) The Independent Dope-Testing Body shall be empowered, in 
its capacity as controller pursuant to Article 4(7) of the GDPR, to process personal 
data, in so far as this is necessary for the performance of its tasks under this 
federal law and for the purposes of implementing this federal law, in particular in 
the context of the tasks of the Independent Austrian Anti-Doping Legal 
Committee and the Independent Arbitration Committee. In so far as at least one of 
the cases listed in Article 9(2) of the GDPR is present, that empowerment shall 
also apply to special categories of personal data pursuant to Article 9(1) of the 
GDPR, in particular data concerning health in the context of proceedings for a 
violation of anti-doping rules, and, in so far as one of the cases listed in 
Article 6(1) of the GDPR is present, to the processing of personal data relating to 
criminal convictions and offences pursuant to Article 10 of the GDPR. In order to 
perform its tasks under this federal law and for the purposes of implementing this 
federal law, the Independent Dope-Testing Body may use processors pursuant to 
Article 4(7) read in conjunction with Article 28 of the GDPR, who, in each case, 
NADA AUSTRIA AND OTHERS 
 
5 
shall in particular comply with the data protection obligations laid down in 
Article 28(3)(a) to (h) of the GDPR. 
(2) In accordance with Articles 32 to 34 of the GDPR, the Independent Dope- 
Testing Body shall in particular ensure the security of personal data and special 
categories of personal data. The need for data processing arises from the effective 
implementation of the anti-doping rules of the WADC (World Anti-Doping Code) 
and the provisions of this federal law, provided that the persons concerned have 
made a contractual commitment to comply with the WADC. Special categories of 
personal data, in particular data concerning health, may be processed only if this is 
absolutely necessary on the basis of the anti-doping provisions of this federal law 
or the WADC. 
(3) The Independent Dope-Testing Body shall be authorised, in particular in the 
context of the tasks of the Independent Austrian Anti-Doping Legal Committee 
and the Independent Arbitration Committee, and without prejudice to the 
provision contained in Paragraph 30(1) hereof, to process personal data in 
implementation of this federal law at the reasoned request, which must be 
documented, of a competent authority pursuant to Paragraph 36(2), point 7, of the 
Datenschutzgesetz (Law on Data Protection) – DSG, BGBl. I No 165/1999, or 
another authority, if necessary, where those personal data constitute an essential 
prerequisite for the performance of the relevant tasks entrusted by law, and the 
processing is provided for at federal or regional level. As soon as the act of 
informing the data subject in accordance with Articles 12 to 14 of the GDPR 
ceases to run counter or to be capable of running counter to the purpose of the 
request, the requesting authority shall communicate this fact to the Independent 
Dope-Testing Body. The data subject shall then be informed of the request in an 
evidencable manner by the Independent Dope-Testing Body. The data subject 
shall be entitled to submit comments, which must be documented, to the 
Independent Dope-Testing Body. From the time when a request is received to the 
time when the data subject is informed of it, Articles 12 to 22 of the GDPR shall 
be restricted to the extent that those rights are likely to render impossible or 
seriously impair the realisation of the purposes of the request and that restriction is 
necessary for and proportionate to the fulfilment of the purposes of the request. 
(4) The Independent Dope Testing-Body shall, if necessary, be empowered, in 
particular within the framework of the tasks of the Independent Austrian Anti-
Doping Legal Committee and the Independent Arbitration Committee, to forward 
the results of dope-testing analyses, circumstances raising a reasoned suspicion, 
which must be documented in writing, of a violation of the anti-doping rules, in 
particular decisions in anti-doping proceedings and medical exemptions which 
have been granted (Paragraph 12), to the national anti-doping organisation 
competent in each case, the international sports federation competent in each case 
and WADA (Word Anti-Doping Agency), to the extent that this is provided for in 
the WADC. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
6  
(5) The Independent Dope-Testing Body shall, if necessary, be empowered, in 
particular within the framework of the tasks of the Independent Austrian Anti-
Doping Legal Committee and the Independent Arbitration Committee, to forward 
to WADA, at WADA’s reasoned request, which must be documented, personal 
data and special categories of personal data, in particular data concerning health, 
having formed the basis of a medical exemption which has been granted, in so far 
as this is provided for in the WADC. 
(6) If a data subject exercises his or her rights under the GDPR against the 
Independent Dope-Testing Body in its capacity as controller lacking competence, 
the latter shall refer the data subject to the competent controller. If a data subject 
asserts a right restricted under subparagraphs 7 to 12, he or she shall be alerted to 
that restriction and the competent data protection officer shall be made aware of it. 
(7) So far as concerns the processing and transfer of personal data and special 
categories of data, the obligations to provide information which are laid down in 
Articles 12 to 14 of the GDPR shall be limited to the extent that those obligations 
are likely to render impossible or seriously impair the realisation of the effective 
implementation of the anti-doping provisions of this federal law or of the WADC. 
(8) So far as concerns the processing and transfer of personal data and special 
categories of data, the right of access provided for in Article 15 of the GDPR shall 
be limited to the extent that that right is likely to render impossible or seriously 
impair the realisation of the effective implementation of the anti-doping 
provisions of this federal law or of the WADC. 
(9) As regards inaccurate or incomplete personal data or special categories of 
personal data, the principle of accuracy laid down in Article 5(1)(d) of the GDPR 
and the right to rectification provided for in Article 16 of the GDPR shall be 
limited to the extent that rectification is precluded by the force of res judicata or 
time-barring, or where the data subject has or has had the opportunity to clarify 
the accuracy [of such data] through reasonable legal channels. If the data subject 
can demonstrate that such personal data or special categories of personal data 
significantly infringe his or her rights, he or she may submit a statement to this 
effect, which must not alter the content [of the data] and must be documented. 
(10) The right to erasure provided for in Article 17 of the GDPR shall be limited 
to the extent that the law lays down an obligation to retain such data or provides 
for such data to be archived. At the request of a data subject, his or her personal 
data or special categories of his or her personal data shall be stored without 
processing for the remaining duration of the retention obligation, if the data 
subject can demonstrate that the processing of his or her personal data or special 
categories of his or her personal data significantly infringes his or her rights and 
no further processing is envisaged for the remaining duration of the retention 
obligation. 
NADA AUSTRIA AND OTHERS 
 
7 
(11) The right to restriction of processing provided for in Article 18 of the GDPR 
shall be limited for the duration of a review of the accuracy of the personal data or 
special categories of personal data relating to the data subject where this has been 
disputed by him or her, and for the period during which the data subject has 
exercised his or her right to object and it has not yet been established whether the 
legitimate grounds of the controller override those of the data subject. 
(12) So far as concerns the processing of personal data and special categories of 
personal data, the right to object provided for in Article 21 of the GDPR shall be 
limited for the period of any retention obligation or archiving laid down by law, 
unless the data subject can demonstrate grounds [for objection] arising from his or 
her particular situation which override the objectives of the restriction of the right 
to object. The competent data protection officer shall be made aware of the 
conduct and result of such a balancing of considerations. 
(13) Data processed or transmitted for the purposes of prosecution, preventing 
participation in sporting competitions or coaching, safeguarding or archiving 
documentation and effectively implementing the provisions of this federal law and 
of the WADC, in particular personal data and special categories of personal data, 
shall be stored by the Independent Dope-Testing Body for ten years as from the 
last occasion on which they were processed or transmitted. 
(14) The Independent Dope-Testing Body shall undertake to have data security 
audits carried out by an external IT service provider at least every three years. 
Independent Austrian Anti-Doping Legal Committee (ÖADR) 
Paragraph 7. (1) The Independent Austrian Anti-Doping Legal Committee is 
a committee independent of State bodies, private individuals and the Independent 
Dope-Testing Body. Members of the ÖADR must not have been involved in the 
investigation of an athlete or in the decision as to whether to submit a request to 
test an athlete or another person, on the one hand, or in the review of the ÖADR’s 
decision by the Independent Arbitration Committee in accordance with 
Paragraph 8, on the other. It shall conduct disciplinary proceedings on behalf of 
the federal sports federation competent in each case, in accordance with the anti-
doping provisions of the competent international sports federation (anti-doping 
proceedings). 
(2) – (7) … 
Paragraph 6 shall apply mutatis mutandis. 
Independent Arbitration Committee (USK) 
Paragraph 8. (1) The Independent Arbitration Committee (USK) is a 
committee independent of State bodies, private individuals and the Independent 
Dope-Testing Body. Members of the USK must not have been involved in the 
investigation of an athlete or another person, or in the decision as to whether to 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
8  
submit a request to test an athlete or another person, on the one hand, or in the 
decision, under their review, of the ÖADR itself, on the other. Without prejudice 
to the provisions of Paragraph 23(10), points 1 and 2, it shall be responsible for 
reviewing the decisions of the ÖADR in anti-doping proceedings before the 
Independent Dope-Testing Body. 
(2) – (5) … 
(6) Paragraph 6 shall apply mutatis mutandis. 
Other procedural provisions 
Paragraph 21. (1) In its decision, the ÖADR shall also determine the costs 
pursuant to Paragraph 10. The parties, as defined in Paragraph 20(2), and the 
federal sports federation competent in each case, may request a review of this 
determination of costs by the USK within four weeks of being notified of the 
ÖADR’s decision, unless the costs in question have been imposed on the person 
concerned by way of recovery [of costs resulting from failure to comply with 
testing or reporting obligations], in accordance with Paragraph 10(4). 
(2) The chairperson shall disclose those costs and the calculation thereof to the 
parties at the end of the proceedings. 
(3) The ÖADR shall, no later than 20 days after the decision has become final, 
inform the BSO, sporting organisations, athletes, other persons and competition 
organisers, as well as the general public, of any security measures imposed (for 
example, suspensions) and decisions taken in anti-doping proceedings, specifying 
the name of the person concerned in each case, the duration of the ban and the 
reasons for it, but not in such a way as to make it possible to infer data concerning 
the health of the person concerned in each case. In the case of vulnerable persons, 
recreational athletes and persons who have made a significant contribution to the 
detection of potential anti-doping violations by sharing information or other 
indications, such information need not be disclosed. In the case of athletes, 
disclosure shall be mandatory on public health grounds where an anti-doping 
violation as defined in Paragraph 1(2), points 3 and 9 to 11, has been established. 
(4) The ÖADR shall decide on an anti-doping rule violation and on the 
imposition of a security or disciplinary measure in accordance with the anti-
doping rules of the competent international sports federation. Those rules are also 
to be applied in particular to vulnerable persons and recreational athletes, or to 
violations involving substances having the potential for abuse as defined in 
Paragraph 2, point 28. In order to qualify for a reduction of the disciplinary 
measure relating to substances having the potential for abuse, the athlete must 
prove, at his or her own expense, that he or she has availed himself or herself of 
appropriate support services at a facility recognised by the Independent Dope-
Testing Body 
NADA AUSTRIA AND OTHERS 
 
9 
(5) Any notification given to an athlete or another person under this section 
shall be simultaneously transmitted by the Independent Dope-Testing Body to the 
relevant anti-doping organisation, to the relevant federal sports federation, to the 
international sports federation and to WADA, and entered without undue delay in 
the reporting system defined in Paragraph 2, point 20. 
Proceedings before the Independent Arbitration Committee 
Paragraph 23. (1) Parties as defined in Paragraph 20(2) may request a review 
by the USK of decisions given under Paragraph 20 within four weeks of being 
notified thereof. Such decisions shall be reviewed by the USK for legality and, if 
found to be unlawful, may be annulled without substitution or amended in any 
way. A request for review shall not have suspensive effect on a decision given 
under Paragraph 20, unless the USK determines that it shall. 
(2) – (13) … 
(14) The USK shall inform the BSO, sports organisations, athletes, other persons 
and competition organisers as well as the general public of its decisions, 
specifying the name of the person concerned, the duration of the ban and the 
reasons for it, but not in such a way as to make it possible to infer data concerning 
the health of the person concerned. In the case of vulnerable persons, recreational 
athletes and persons who have made a significant contribution to the detection of 
potential anti-doping violations by sharing information or other indications, such 
information need not be disclosed. In the case of athletes, disclosure shall be 
mandatory on public health grounds where an anti-doping violation as defined in 
Paragraph 1(2), points 3 and 9 to 11, has been established’. 
General Law on Administrative Procedure (AVG), Paragraph 57 
Federal Law on the Constitution, Article 130 
Provisions of European Union law relied on 
Treaty on the Functioning of the European Union (TFEU), Articles 16 and 165 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EG (General Data Protection Regulation) (‘the GDPR’), Article 2, 
Article 4(15) and Articles 5, 6, 9, 10 and 17 
Succinct presentation of the facts and procedure in the main proceedings 
1 The Austrian Anti-Doping Legal Committee (‘the ÖADR’) is an independent 
committee established under Paragraph 7 of the Anti-Doping Bundesgesetz 2021 
(2021 Federal Law on Anti-Doping) (‘the ADBG’). It is responsible for 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
10  
conducting disciplinary proceedings on behalf of the federal sports federation 
competent in each case in accordance with the applicable anti-doping rules of the 
competent international sports federation. The Independent Arbitration Committee 
(‘the USK’) reviews the decisions of the ÖADR in accordance with Paragraph 8 
of the ADBG. 
2 Pursuant to Paragraph 5(5) of the ADBG, the National Anti-Doping Agency 
Austria GmbH (‘NADA Austria’) is a not-for-profit limited liability company 
established to perform the tasks of the Independent Dope-Testing Body. On its 
website https://www.nada.at/de/recht/suspendierungen-sperren, it publishes a list 
of suspensions and bans. 
3 The applicants are athletes each of whom has been banned for a certain period of 
time or for life in accordance with a decision of the ÖADR or the USK. 
4 The aforementioned list includes (for the duration of the ban), inter alia, those 
persons (athletes or former athletes) who have been banned in accordance with a 
decision of the ÖADR or the USK. The details published are the first name and 
surname of the athlete concerned, the sport practised, the anti-doping rule 
violation committed, the penalty imposed and the start and end dates of the 
penalty. The list currently comprises 19 athletes – including the applicants – from 
eight sports. 
5 Under the heading ‘Pressemitteilungen’ (Press Releases) on its website 
https://www.oeadr.at, the ÖADR also publishes a list, starting from 2013. Each 
entry, which lasts for the duration of the ban, includes the first name and surname 
of the banned athlete, the sport practised, the type of violation, the penalty 
imposed, the start and end dates of the penalty, a summary of the decision by 
NADA Austria or the USK and a reference to the banned substance. There are 
currently 13 press releases relating to banned athletes – including three of the 
applicants – available for download on the aforementioned website. In the case of 
one of the applicants, there is no press release available for download on the 
aforementioned website (despite the fact that the ban is currently still in place). 
6 The applicants asked NADA Austria and the ÖADR to cease making their names 
and sports available for download on the internet, in particular on the 
aforementioned websites, within eight days. 
7 NADA Austria and the ÖADR failed to comply with that request. 
8 Subsequently, on 22 October 2021, the applicants lodged complaints for 
infringement of data protection (data protection complaints), in accordance with 
Article 77(1) of the GDPR, with the Austrian data protection authority (the 
defendant authority before the Federal Administrative Court). In those complaints, 
they sought a declaration that, by publishing their names and sports, NADA 
Austria and the ÖADR had infringed the law, in particular the right to erasure or 
restriction of processing under the GDPR and the Federal Law on the Protection 
of Natural Persons with regard to the Processing of Personal Data (the Law on 
NADA AUSTRIA AND OTHERS 
 
11 
Data Protection – DSG), and an order requiring NADA Austria and the ÖADR to 
remove the publication of their names and sports from the aforementioned 
websites. They further asked that authority to prohibit the continuation of the data 
processing on the ground that this posed a significant direct threat to interests in 
the maintenance of confidentiality that were worthy of protection (imminent 
danger), by way of a decision pursuant to Paragraph 22(4) of the DSG read in 
conjunction with Paragraph 57(1) of the Allgemeines 
Verwaltungsverfahrensgesetz (General Law on Administrative Procedure) (AVG), 
without hearing NADA Austria and the ÖADR. 
9 By the contested decision, the data protection authority dismissed the complaints 
and the request for the adoption of a decision pursuant to Paragraph 22(4) of the 
DSG read in conjunction with Paragraph 57(1) of the AVG, as unfounded. 
10 Against the contested decision, the applicants brought before the Federal 
Administrative Court, within the prescribed time limit, an action under 
Article 130(1), point 1, of the Bundes-Verfassungsgesetz (Federal Law on the 
Constitution) (‘party appeal’ [to the Federal Administrative Court]), which is a 
judicial remedy for the purposes of Article 78(1) of the GDPR. The data 
protection authority did not avail itself of the possibility of a preliminary decision 
on the appeal and referred the matter to the Federal Administrative Court for a 
decision. 
11 By order of 21 December 2021, the USK submitted a request for a preliminary 
ruling to the Court of Justice (Case C-115/22). 
12 By order of 22 June 2022, the Federal Administrative Court stayed the 
proceedings pending before it until such time as the Court of Justice gave a 
preliminary ruling on the questions referred in Case C-115/22. 
13 By judgment of 7 May 2024 in Case C-115/22, the Court of Justice held that the 
request for a preliminary ruling submitted by the USK by order of 21 December 
2021 was inadmissible, since the USK cannot be classified as a ‘court or tribunal’ 
within the meaning of Article 267 TFEU. 
14 The proceedings before the Federal Administrative Court in the appeal cases at 
issue here were resumed. 
The essential arguments of the parties in the main proceedings 
15 In the administrative proceedings before the data protection authority, the 
applicants argued that the entries on the websites entailed significant 
disadvantages for job applications, a pillorying effect and stigmatisation. What is 
more, the published data constitute a special category of personal data pursuant to 
Article 9 of the GDPR, more precisely, the processing of personal data relating to 
criminal convictions and offences pursuant to Article 10 of the GDPR. The 
undifferentiated configuration of the right to publish provided for in 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
12  
Paragraph 21(3) and Paragraph 23(14) of the ADBG infringes Article 6(3) of the 
GDPR. The proactive provision of information to the general public is neither 
appropriate nor necessary and certainly not proportionate, not least because no 
deletion period has been laid down. The purpose of the anti-doping strategy can 
also be served by more lenient means, such as, for example, publication in the 
print version of the sports federation’s news, publication in the sports federation’s 
internal database or publication without disclosure of the identity of the person 
concerned. 
16 The data protection authority justified the decision dismissing the data protection 
complaints on the ground that none of the letters from the applicants to NADA 
Austria and the ÖADR can be classified as a request for erasure pursuant to 
Article 17 of the GDPR. However, even if the letters could be regarded as requests 
for erasure, this would not change the outcome, since the ADBG – in particular in 
Paragraph 5(6) and Paragraph 21(3) – expressly provides for the publication 
complained of here. The requested erasure is therefore precluded by 
Article 17(3)(b) of the GDPR. 
With regard to the applicant in the case of whom no press release was available 
for download on the aforementioned website, the data protection authority stated 
that that the data relating to that person have not yet been published. However, a 
complaint concerning breaches which have either not yet manifested themselves 
or the occurrence of which is no more than a future possibility cannot be 
successful because there are no grounds on which to lodge it. 
17 In the proceedings before the Federal Administrative Court, the applicants added 
that the ÖADR had imposed on the applicant not (yet) entered on the 
aforementioned lists a four-year ban lasting until 30 May 2025 for violation of a 
(specified) anti-doping rule. The letters from the applicants to NADA Austria and 
the ÖADR are to be classified as requests for erasure pursuant to Article 17 of the 
GDPR. 
18 NADA Austria submits before the Federal Administrative Court that, in the course 
of performing its duties as an Independent Dope-Testing Body in accordance with 
the provisions of Paragraph 5(6), point 4, of the ADBG, it must, free of charge, 
inform, inter alia, the BSO, sports federations, athletes, other persons, competition 
organisers and the general public of the security measures (for example, 
suspensions) and bans imposed on athletes and other persons of which it has been 
made aware and of the lifting thereof, specifying the names of the persons 
concerned, the duration of the ban and the reasons for it, but not in such a way as 
to make it possible to infer special categories of data relating to the persons 
concerned, in particular data concerning their health. 
When publishing the information in question on its website, it complies with the 
principles governing the processing of personal data established in Article 5 of the 
GDPR, inasmuch it publishes only the categories of data provided for in 
Paragraph 5(6), point 4, of the ADBG for the duration of the existence of the 
NADA AUSTRIA AND OTHERS 
 
13 
disciplinary measures laid down in the ADBG. Furthermore, the processing of 
personal data in the context of the ADBG is intended to implement the 
international legal obligation laid down in the International Convention against 
Doping in Sport adopted by UNESCO and is therefore in the public interest. The 
publication of personal data in the list of suspensions and bans is therefore 
necessary, in accordance with Article 6(1)(c) of the GDPR, for compliance with a 
legal obligation to which NADA Austria is subject, and, in accordance with 
Article 6(1)(e) of the GDPR, for the performance of tasks in the public interest. 
NADA Austria’s interest in the publication of personal data in the list of 
suspensions and bans lies in informing promoters and domestic and foreign 
competition organisers about suspensions and bans. Furthermore, athletes and 
other persons must be informed about the banning or penalising of coaches. 
Finally, it is important that the general public too be informed free of charge about 
security measures such as suspensions and bans, and that the transparency of anti-
doping measures be guaranteed, on the basis of a statutory order pursuant to 
Paragraph 5(6), point 4, of the ADBG. In accordance with Article 17(3)(b) of the 
GDPR, read in conjunction with Paragraph 1(1) and Paragraph 5(6), point 4, of 
the ADBG, therefore, NADA Austria is under no obligation to erase personal data 
relating to the applicants. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
19 First question 
In the present case, the applicants consider that their right to erasure under 
Paragraph 17 of the GDPR has been infringed by the publication of their personal 
data on the aforementioned websites. 
In accordance with Article 2(1) of the GDPR, that regulation applies to the 
processing of personal data wholly or partly by automated means and to the 
processing other than by automated means of personal data which form part of a 
filing system or are intended to form part of a filing system. 
As Advocate General Ćapeta states in her Opinion of 14 September 2023 in Case 
C-115/22, the online publication of personal data constitutes ‘processing’, 
‘personal data’ are used in the data processing at issue and the routing of the 
personal data via a server when they are uploaded to NADA’s website constitutes 
processing by ‘automated means’. 
However, the Advocate General goes on to say that the processing of personal 
data for the purpose of implementing a Member State’s anti-doping legislation is 
not an activity which, as EU law currently stands, falls within the scope of that 
law, since the European Union does not have competence to regulate sport, and 
the GDPR is not therefore applicable to the present case. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
14  
The Austrian data protection authority, on the other hand, considered the 
provisions of the GDPR to be applicable in the present case, and the applicants too 
assume that the GDPR is applicable. 
The question, therefore, in the opinion of the Federal Administrative Court, is 
whether the processing of personal data concerned comes under the first sentence 
of Article 16(2) TFEU and thus, in the light of Article 2(2)(a) of the GDPR, falls 
within the scope ratione materiae of the GDPR as defined in Article 2(1) of the 
GDPR. 
20 Second question 
The national provisions contained in Paragraph 5(6), point 4, and Paragraph 21(3) 
of the ADBG impose an obligation in principle on NADA Austria and the ÖADR 
to inform the general public of their decisions, specifying the names of the persons 
concerned, the duration of the ban and the reasons for it, but not in such a way as 
to make it possible to infer data concerning the health of the person concerned. In 
accordance with Paragraph 21(3) of the ADBG, exceptions apply to vulnerable 
persons, recreational athletes and persons who have made a significant 
contribution to the detection of potential anti-doping violations. 
In the light of the provisions of the GDPR, the question arises, in the opinion of 
the Federal Constitutional Court, as to whether the publication of information that 
a certain person has committed an anti-doping rule violation (as a result of which 
that person has been banned) is in itself an item of ‘data concerning health’ within 
the meaning of Article 9 read in conjunction with Article 4(15) of the GDPR. 
In the view of the Federal Administrative Court, it is particularly relevant in this 
regard that the publication of an anti-doping violation which has been committed 
in a press release issued by the ÖADR – as in the appeal proceedings in the 
present case, too – includes information on what substance an athlete possessed or 
took for the purposes of enhancing his or her performance. 
In the aforementioned Opinion in Case C-115/22, the Advocate General states 
that, according to the definition contained in Article 4(15) of the GDPR, ‘data 
concerning health’ must allow inferences to be drawn as to the data subject’s 
health status, which is not the case here, since the finding that a person has 
consumed or possessed certain prohibited substances says nothing (specific) about 
his or her physical or mental state of health. 
Some legal commentators, however, argue that the term ‘data concerning health’ 
also includes descriptions/information on the taking of substances having effects 
on health, such as, for example, alcohol, drugs and medicines (see Weichert in 
Kühling/Bucher, DSGVO, Article 9, paragraph 39). In the judgment of 
6 November 2003, Lindqvist (C-101/01, EU:C:2003:596, paragraph 50), the Court 
of Justice, too, held that the expression ‘data concerning health’ must be given a 
wide interpretation. Consequently, the answer to this question does not seem 
obvious to the Federal Administrative Court. 
NADA AUSTRIA AND OTHERS 
 
15 
An answer to this question from the Court of Justice is important to the Federal 
Administrative Court in so far as, if it were in the affirmative, the provisions of 
Article 9 of the GDPR would apply and the national legislation would provide 
only for an anonymised publication of the decision [to impose a suspension or a 
ban] (‘not … such … as to make it possible to infer data concerning the health of 
the person concerned’). 
21 Third and fourth questions 
In the present cases, it falls to the Federal Administrative Court to assess whether 
the disclosure to the general public of personal data relating to athletes, together 
with their anti-doping rule violations and the bans imposed on them, by the 
publication of that information on a publicly accessible website, is compatible 
with the requirements of lawfulness and data minimisation laid down in 
Article 5(1)(a) and (c) and Article 6(3) of the GDPR. 
The question in this case is whether the disclosure to the general public stipulated 
in the ADBG is required or justified under EU law and whether, in the light of the 
national provisions contained in Paragraphs 5(6), point 4, and 21(3) of the ADBG, 
it is in keeping with the GDPR. 
The issue (as set out in the previously cited Opinion of Advocate General Ćapeta 
[see point 129]) is whether the GDPR requires the data controller to review 
proportionality in each individual case prior to the disclosure of personal data to 
the general public or whether the proportionality of publishing such data can be 
decided in advance by a provision of general law. If the former is the case, that is 
to say if an individualised proportionality assessment is necessary, the ADBG 
would, according to the Advocate General in her Opinion, infringe the GDPR, 
because the ADBG does not allow for such an individualised level of review. If 
the review of proportionality may, in principle, be provided for in the abstract by 
national law, in which case the data controller would automatically be obliged to 
publish the data in question, the question arises, in the view of the Advocate 
General, as to whether the ADBG satisfies the proportionality requirement 
imposed by Article 6(3) of the GDPR. The Advocate General is also uncertain 
whether, if the automatic disclosure to the general public of information relating 
to a decision establishing a doping violation is proportionate to the legitimate 
aim(s) which the law is trying to achieve, it is necessary to place that information 
on the publicly accessible website of an anti-doping organisation. 
22 Fifth question 
In the judgment of 22 June 2021, Latvijas Republikas Saeima (Penalty points) 
(C-439/19, EU:C:2021:504, paragraphs 73 to 94), the Court of Justice emphasises 
that the concept of ‘criminal convictions and offences’ in Article 10 of the GDPR 
is to be interpreted autonomously. Even in the case of offences which are not 
classified as ‘criminal’ by national law, their character as such may arise from the 
nature of the offence and the degree of severity of the penalty to which the person 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-474/24 
 
16  
concerned is liable (see to this effect the judgment of 20 March 2018, Garlsson 
Real Estate and Others, C-537/16, EU:C:2018:193, paragraphs 28 and 32). 
The ADBG states that, where an athlete (belonging to a particular sports 
federation structure or taking part in competitions organised by sports federations) 
is subject to the anti-doping rules adopted by the international sports federations, 
the penalties laid down there are legally binding. In the case at issue, those 
penalties include the stripping of titles and prize money and a multi-year ban from 
all (national and international) competitions. The consequences of that ban are 
ultimately a (temporary) prohibition on pursuing activities in sport, even and 
especially if these are income-generating. In accordance with Paragraph 24(4) of 
the ADBG, sports organisations may not ‘use’ persons banned under anti-doping 
law, and, consequently, certainly may not employ them for consideration. 
Against that background, the Federal Administrative Court is faced with the 
question as to whether the public disclosure of the names of the applicants, the 
anti-doping rule violations committed by them and the penalties imposed on them 
constitutes the processing of ‘personal data relating to criminal convictions and 
offences’ within the meaning of Article 10 of the GDPR. The answer to that 
question is relevant in so far as, if it is affirmative, the processing must, according 
to the wording of Article 10 of the GDPR, either be carried out under the control 
of ‘official’ authority or be authorised by Union or Member State law providing 
for appropriate safeguards for the rights and freedoms of data subjects. According 
to the conclusions of the Advocate General (in the aforementioned Opinion), a 
finding that a data processing operation falls within the scope of Article 10 of the 
GDPR requires that the interests of the data subject be given more weight in a 
balancing exercise on disclosure. 
Sixth question 
In the aforementioned Opinion, the Advocate General also stated that it would 
appear from Paragraph 5(6) and Paragraph 6(1) to (5) of the ADBG that the 
Austrian legislature empowered NADA Austria to take on the role of ‘official 
authority’ in order to, inter alia, control the processing by the USK of personal 
data falling within the scope of Article 10 of the GDPR (point 123). She also 
stated that, under the ADBG, decisions of the USK cannot be challenged before 
the Austrian courts. Against that background, the Federal Administrative Court is 
faced with the question as to whether the activities or decisions of an authority 
which has been made responsible for exercising control over the processing of 
personal data relating to criminal convictions and offences or related security 
measures in accordance with Article 10 of the GDPR must be subject to judicial 
review. 
Seventh question 
Even before her personal data were published on the aforementioned websites, 
one of the applicants asked NADA Austria and the ÖADR to cease making her 
NADA AUSTRIA AND OTHERS 
 
17 
name and sport available for download on the internet, in particular on those 
websites, within eight days, and, after NADA Austria and the ÖADR had failed to 
comply with that request, lodged a data protection complaint, since, in her 
opinion, publication was imminent. 
The background to the seventh question is that the data protection authority has 
already dismissed the complaint lodged by the second applicant on the ground 
that, at the time when the complaint was lodged and the data protection authority 
adopted its decision, the data relating to the second complainant had not yet been 
published on the aforementioned websites. 
However, those data have since been published. 
The Federal Administrative Court is faced with the question as to whether a 
complaint under Article 77 of the GDPR concerning an alleged infringement 
under Article 17 GDPR, in the case where the personal data relating to the data 
subject had not yet been processed at the time when the complaint was lodged 
with the supervisory authority and the latter adopted its decision, but was 
processed in the course of the proceedings before the appeal court, is permissible 
or subsequently becomes permissible, provided that, at the time when the 
complaint was lodged, there were already specific indications that an operation 
involving the processing of personal data by the controller was imminent or would 
take place in the near future. 
The foregoing is the subject of different views in legal literature. However (so far 
as the Federal Administrative Court is aware), the case-law of the Court of Justice 
does not as yet offer an answer to that question. 
23 Since the application and interpretation of EU law does not appear to be so 
obvious as to leave no room for reasonable doubt (see judgments of 6 October 
1982, Cilfit and Others, 283/81, EU:C:1982:335, and of 6 October 2021, 
Consorzio Italian Management and Catania Multiservizi, C-561/19, 
EU:C:2021:799, paragraph 39 et seq.), a request for a preliminary ruling on the 
questions set out at the start of this order is submitted under Article 267 TFEU.