Provisional text
OPINION OF ADVOCATE GENERAL
SPIELMANN
delivered on 25 September 2025 (1)
Case C‑474/24
AR,
YT,
DI,
RN
other parties:
Österreichische Datenschutzbehörde,
Nationale Anti-Doping Agentur Austria GmbH (NADA Austria),
Österreichische Anti-Doping Rechtskommission (ÖADR)
(Request for a preliminary ruling from the Bundesverwaltungsgericht (Federal Administrative Court, Austria))
( Reference for a preliminary ruling – Data protection – Regulation (EU) 2016/679 – Articles 2, 5, 6, 9 and 10 – Scope – Concept of ‘data concerning health’ – Concept of ‘personal data relating to criminal convictions and offences’ – Combating doping in sport – Online publication of the name of a person who has infringed anti-doping rules, the duration of the exclusion from sporting events and the reasons for that exclusion – Balancing of competing interests – Proportionality – Articles 77 to 79 – Remedies – Effective judicial protection )
Table of Contents
I.
Introduction
II.
Legal framework
A.
European Union law
B.
Austrian law
III.
The dispute in the main proceedings, the questions referred and the procedure before the Court of Justice
IV.
Analysis
A.
The first question
1.
Strict interpretation of the exception provided for in Article 2(2)(a) of the GDPR
2.
Anti-doping activity does not fall outside the scope of the GDPR …
–
… even though it is a matter for the Member States
–
… and despite the ‘absence’ of any economic characteristics..
3.
Conclusion on the first question
B.
The second question
1.
Broad interpretation of the concept of ‘data concerning health’
2.
Application to the present case
3.
Conclusion on the second question
C.
The fifth question
1.
The ‘criminal’ nature of convictions and offences within the meaning of Article 10 of the GDPR
2.
Analysis of whether anti-doping convictions and offences are ‘criminal’ within the meaning of Article 10 of the GDPR
(a)
Legal classification of the offence under national law
(b)
Nature of the offence
(c)
Degree of severity of the penalty
3.
Conclusion on the fifth question
D.
The sixth question
E.
The third and fourth questions
1.
Proportionality of the publication in question
(a)
Preliminary observations and reminder of principles
(b)
The appropriateness of the publication for attaining the objectives pursued
(c)
The need for publication in the light of the objectives pursued
(d)
Proportionality ‘stricto sensu’, namely balancing the interests at stake
2.
Context of the balancing exercise
3.
Conclusions on the third and fourth questions
F.
The seventh question
1.
Is a complaint to the supervisory authority prior to data processing admissible?
2.
Does a complaint to the supervisory authority become admissible ‘a posteriori’?
3.
Conclusion on the seventh question
V.
Conclusion
Introduction
1.        Sporting regulations are at the interface of a number of sources of law. This is demonstrated by the fact that anti-doping rules are the product of both private and public legislative activity. In particular, the World Anti-Doping Code (‘the Code’), adopted in application of the statutes of the World Anti-Doping Agency (‘WADA’), is a private instrument that the signatory States have undertaken to respect through the United Nations International Convention against Doping in Sport. (2) The regulations, designed to harmonise the anti-doping policies, rules and regulations of sports organisations and public authorities around the world, thus constitutes a very specific transnational sectoral legal system. (3)
2.        The Court has previously been called upon to rule on the compatibility of sports regulations with EU law, in particular from the point of view of the freedom to provide services or competition. (4)
3.        The present case gives the Court of Justice an unprecedented (5) opportunity to consider certain aspects of the anti-doping regulations in the light of the requirements linked to the protection of personal data. It is a question of reconciling, on the one hand, the requirements of ethical sport, which, in the present case, would involve the online publication of the names of athletes who have had sanctions imposed on them for infringements of anti-doping rules and, on the other hand, the protection of the personal data of those athletes, arising from Regulation (EU) 2016/679 (6) (‘the GDPR’).
4.        At a time when the Code is being revised, (7) the scope of the forthcoming judgment could extend beyond European borders.
Legal framework
European Union law
5.        Article 16(1) TFEU states that everyone has the right to the protection of personal data concerning them. Article 16(2) states that ‘the European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.’
6.        Article 165(2) TFEU provides that Union action is to be aimed in particular at ‘developing the European dimension in sport, by promoting fairness and openness in sporting competitions and cooperation between bodies responsible for sports, and by protecting the physical and moral integrity of sportsmen and sportswomen, especially the youngest sportsmen and sportswomen’. To that end, Article 165(4) provides that ‘the Council, on a proposal from the Commission, shall adopt recommendations’.
7.        Recital 35 of the GDPR states that ‘personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for … health care services …; a number, symbol or particular assigned to a natural person to uniquely identify the natural person for health purposes; information derived from the testing or examination of a body part or bodily substance, including from genetic data and biological samples; and any information on, for example, a disease, disability, disease risk, medical history, clinical treatment or the physiological or biomedical state of the data subject independent of its source, for example from a physician or other health professional, a hospital, a medical device or an in vitro diagnostic test.’
8.        Article 2 of the GDPR, entitled ‘Material scope’, states in paragraph 1 that ‘this Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system’. It follows from Article 2(2)(a) of the GDPR that that regulation does not apply to the processing of personal data ‘in the course of an activity which falls outside the scope of Union law’.
9.        Article 4 of the GDPR, entitled ‘Definitions’, provides in point 15 that, for the purposes of that regulation, ‘“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status’.
10.      Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, provides:
‘1.      Personal data shall be:
(a)      processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
…
(c)      adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
…’
11.      Article 6 of that regulation, entitled ‘Lawfulness of processing’, states:
‘1.      Processing shall be lawful only if and to the extent that at least one of the following applies:
…
(c)      processing is necessary for compliance with a legal obligation to which the controller is subject;
…
(e)      processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
…
3.      The basis for the processing referred to in point[s]
(c) and (e) of paragraph 1 shall be laid down by:
(a)      Union law; or
(b)      Member State law to which the controller is subject.
The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point
(e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter
IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
…’
12.      Article 9 of the GDPR, entitled ‘Processing of special categories of personal data’, prohibits, in paragraph 1 thereof, the processing of personal data concerning health, among other things. It follows from Article 9(2)(g) of that regulation that paragraph 1 does not apply if ‘processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.
13.      Article 10 of the GDPR, entitled ‘Processing of personal data relating to criminal convictions and offences’, provides that ‘processing of personal data relating to criminal convictions and offences … shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’
14.      Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’, provides, in paragraph 1 thereof:
‘Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.’
15.      Article 78 of the GDPR, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides in paragraph 1 thereof:
‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’
Austrian law
16.      It follows from Paragraph 5(5) of the Anti-Doping-Bundesgesetz 2021 (2021 Federal Law on Anti-Doping) of 23 December 2020 (BGBl. I, 152/2020; ‘the ADBG’) that the Nationale Anti-Doping Agentur Austria GmbH (National Anti-Doping Agency, Austria; ‘NADA’) is a public utility company with limited liability which acts as an independent anti-doping agency and is responsible for processing personal data.
17.      Pursuant to Paragraph 5(6)(4) of the ADBG, NADA is to inform the Bundes-Sportorganisation (Federal Sports Organisation, Austria), sporting organisations, athletes and other persons, and competition organisers of the following information,
and is to make that information available to the general public free of charge: ‘precautionary measures (such as suspensions) and bans on athletes and other persons which have been brought to [its] attention …, and the lifting of those measures, stating the names of the persons concerned, the duration of the ban and the reasons for the ban, without it being possible to make any inference about
special categories of personal data of the persons concerned, in particular data relating to health. That information may be omitted for particularly vulnerable persons and amateur athletes …’
18.      Paragraph 6(2) of the ADBG provides in particular that NADA is to ensure the security of personal data and special categories of personal data, in accordance with Articles 32 to 34 of the GDPR. That provision states that ‘the need to process the data stems from the effective implementation of the [Code’s] anti-doping rules and the provisions of the present Federal Law, in so far as the persons concerned have contractually undertaken to comply with the Code’. In addition, ‘special categories of personal data, in particular data relating to health, can only be processed in so far as is strictly necessary under the anti-doping provisions of the present Federal Law or of the Code’.
19.      The Österreichische Anti-Doping Rechtskommission (Austrian Anti-Doping Legal Committee; ‘the ÖADR’) is a public committee, independent of government bodies, private individuals and NADA, which, pursuant to Paragraph 7(1) of the ADBG, must ‘conduct disciplinary proceedings for the competent federal sports federation in accordance with the anti-doping rules in force of the competent international sports federation (anti-doping proceedings)’.
20.      Pursuant to Paragraph 21(3) of the ADBG, the ÖADR must, ‘no later than 20 days after the decision has become final, inform the Bundes-Sportorganisation [the federal sports organisation], sporting organisations, athletes, and other persons,
competition organisers and the general public of precautionary measures imposed (for example, suspensions) and decisions taken in anti-doping proceedings, indicating the name of the person concerned, the duration of the suspension and the grounds for the suspension, without it being possible to make any inference about the data concerning the health of the person concerned. That information may be omitted in the case of particularly vulnerable persons, amateur athletes and persons who contributed significantly to the detection of potential infringements of the anti-doping rules by disclosing information or other indications. Any disclosure concerning amateur athletes shall be made on public health grounds where an infringement of the anti-doping rules has been established pursuant to Paragraph 1(2)(3) or Paragraph 1(2)(9) to (11).’
21.      It follows essentially from Paragraph 23(14) of the ADBG that the same obligations are imposed on the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria; ‘the USK’).
The dispute in the main proceedings, the questions referred for a preliminary ruling and the procedure before the Court of Justice
22.      In the context of anti-doping proceedings, the athletes AR, YT, DI and RN (‘the applicants’) were the subject of suspension decisions (for a certain period of time or for life, depending on the case), taken either by the ÖADR, which is competent to conduct anti-doping proceedings, or by the USK, which is competent to review the ÖADR’s decisions.
23.      Under Austrian anti-doping legislation, NADA publishes on its website a list of the names of persons who have been suspended in accordance with a decision of the ÖADR or the USK. For the duration of the suspensions, that list includes the first name and surname of the athlete concerned, the sport practised, the infringement of the anti-doping rules committed, the penalty imposed, and the start and end dates of the penalty. The ÖADR also publishes the same data, along with any prohibited substances involved, in a press release on its own website.
24.      On 14 and 15 October 2021, the applicants asked the ÖADR and NADA to cease displaying their respective names and sporting disciplines. The ÖADR and NADA did not accede to those requests.
25.      On 22 October 2021 the applicants lodged complaints with the Österreichische Datenschutzbehörde (‘the Austrian Data Protection Authority’) in accordance with Article 77(1) of the GDPR, seeking a declaration that there had been an infringement of the right to erasure or restriction of data, and an order requiring the ÖADR and NADA to remove the publication of their names and the sports from the abovementioned websites. They also argued that the case involved a special category of personal data and the processing of personal data relating to criminal convictions and offences, within the meaning of Articles 9 and 10 of the GDPR respectively. They submitted that the undifferentiated publication system provided for in Austrian law is incompatible with Article 6(3) of the GDPR and is neither necessary nor proportionate.
26.      On 26 November 2021, the Austrian Data Protection Authority dismissed the claim as unfounded. As regards YT, in particular, the complaint was rejected on the grounds of lack of interest in bringing proceedings, since the relevant data had not yet been published.
27.      The applicants then brought an action before the Bundesverwaltungsgericht (Federal Administrative Court, Austria), which is the referring court, based on Article 78(1) of the GDPR. In that context, NADA, the first defendant in the main proceedings, submitted that the publication of personal data on its website was necessary in order to comply with a legal obligation to which it was subject and to perform a task carried out in the public interest within the meaning of Article 6(1)(c) and (e) of the GDPR.
28.      The referring court stayed the main proceedings because the USK had made a request for a preliminary ruling in NADA and Others. (8) After the dismissal of that request as inadmissible by judgment of 7 May 2024, (9) the national proceedings before the referring court resumed their course.
29.      In those circumstances, the Bundesverwaltungsgericht (Federal Administrative Court) decided to stay proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1)      Does the processing of personal data relating to individuals by the publication of their name, the sport they practise, the anti-doping rule violation they have committed, the penalty imposed on them and the start and end dates of that penalty, in the form of an entry in a table on the publicly accessible part of the website of [NADA] https://www.nada.at/de/recht/suspendierungen-sperren, and in publicly accessible press releases issued by the [ÖADR] at https://www.oeadr.at, fall within the scope of Union law within the meaning of the first sentence of Article 16(2) TFEU, with the result that [the GDPR] is applicable to the processing of personal data in this way?
If Question
1 is answered in the affirmative:
(2)      Does information that a certain person has committed a specific [anti-]doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute ‘data concerning health’ within the meaning of Article 9 of the GDPR?
(3)      Does the GDPR – in particular in the light of the second subparagraph of Article 6(3) of the GDPR – preclude national legislation which provides for the name of the person affected by the decision of the Austrian Anti-Doping Legal Committee or the [Austrian] Independent Arbitration Committee, the duration of the ban and the reasons for it to be published, but not in such a way as to make it possible to infer data concerning the health of the person concerned? Is it of any significance in this regard that, under that national legislation, such information need not be disclosed to the general public only if the person concerned is a recreational athlete, a minor or a person who has made a significant contribution to the detection of potential anti-doping violations by sharing information or other indications?
(4)      Does the GDPR – in particular in the light of the principles in Article 5(1)(a) and (c) thereof – require that publication be preceded in every case by a balancing of interests between the personal interests of the data subject that will be affected by publication, on the one hand, and the interests of the general public in being informed of the anti-doping violation committed by an athlete, on the other?
(5)      Does [the disclosure of the] information that a certain person has committed a specific [anti-]doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute the processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR?
(6)      If Question
5 is answered in the affirmative:
Must the activities or decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures, in accordance with Article 10 of the GDPR, be subject to judicial review?
(7)      Is a complaint under Article 77 of the GDPR concerning an alleged infringement under Article 17 of the GDPR, in the case where the personal data relating to the data subject had not yet been processed at the time when the complaint was lodged with the supervisory authority and the latter adopted its decision, but was processed in the course of the proceedings before the appeal court, permissible, or does it subsequently become permissible, provided that, at the time when the complaint was lodged, there were already specific indications that an operation involving the processing of personal data by the controller was imminent or would take place in the near future?’
30.      Written observations were submitted by the applicants in the main proceedings, NADA, the Austrian Data Protection Authority, the Commission and the Austrian, Latvian, Netherlands, Polish and Finnish Governments. The applicants in the main proceedings, NADA, the Commission and the Austrian, Latvian and Finnish Governments also presented oral argument at the public hearing, which was held on 13 May 2025.
Analysis
31.      After examining the first question referred for a preliminary ruling on the applicability of the GDPR, I shall analyse the second, fifth and sixth questions, which concern certain specific data, before examining the issue relating to the principle of proportionality (third and fourth questions). Finally, I shall consider the seventh question, which is more procedural in nature.
The first question
32.      By its first question, the referring court asks, in essence, whether or not the implementation of anti-doping legislation constitutes an ‘activity’ which falls within the ‘scope of Union law’ within the meaning of the first sentence of Article 16(2) TFEU.
33.      The answer to that question is significant, since, if it does not, the GDPR would not apply to the dispute in the main proceedings. The GDPR was adopted on the basis of Article 16 TFEU,
and Article 2(2)(a) of that regulation excludes from its scope the processing of personal data carried out in the course of an activity ‘which falls outside the scope of Union law’.
34.      As a preliminary point, and even though it is not mentioned by the referring court, I would like to point out that the exception set out in Article 2(2)(d) of the GDPR provides that that regulation does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties …’. The reason for that exception is that the processing of personal data for such purposes by ‘competent authorities’ is governed by a more specific EU act, namely Directive
(EU) 2016/680, (10) adopted on the same day as the GDPR. It cannot be ruled out, at this stage, that the substantive
criterion for that exception may be met in the present case. The question whether the data processing at issue in the present case is carried out for the purposes referred to in Article 2(2)(d) of the GDPR concerns the subject matter of the fifth question referred for a preliminary ruling (relating to Article 10 of the GDPR), dealing with the criminal nature or otherwise of the convictions and offences which are the subject matter of the data processing at issue. However, the organic test for the exception set out in Article 2(2)(d) of the GDPR has not been addressed: do NADA and the ÖADR constitute ‘competent authorities’ within the meaning of Article 3(7) of Directive
2016/680? If not, the GDPR applies, which will be my working hypothesis for the remainder of the analysis. On the other hand, if they are held to be competent authorities and the substantive criterion is also met, the question of the applicability of Directive
2016/680 instead of the GDPR, would arise,
which is a matter for the national court to ascertain.
35.      Having made that observation, I note that in the present case it is not disputed that the processing of personal data at issue, carried out by the Austrian anti-doping authorities and consisting of the publication on the internet of the names of the athletes concerned, the sporting discipline practised, the infringement of the anti-doping rules committed, the penalty imposed, and the start and end dates of that penalty, corresponds to processing to which the GDPR applies by virtue of Article 2(1) thereof, namely processing of personal data wholly or partly by automated means. (11)
36.      The issue which is more in dispute is whether that processing falls within the scope of the exception provided for in Article 2(2)(a) of the GDPR.
37.      In my analysis, I shall first refer to the principle that the exception provided for in Article 2(2)(a) of the GDPR must be interpreted strictly, and then draw the conclusions applicable for anti-doping activities in the light of the arguments put forward by NADA.
Strict interpretation of the exception provided for in Article 2(2)(a) of the GDPR
38.      According to settled case-law, the exception provided for in Article 2(2)(a) of the GDPR, in so far as it makes the system of protection of personal data laid down by the GDPR inapplicable,
and thus deviates from its objective of protection, must be interpreted strictly. (12)
39.      Indeed, as stated in essence in recitals 6 to 12 of the GDPR, the rapid technological developments, globalisation and the scale of the collection and sharing of personal data require a strong and coherent data protection framework in the European Union, ensuring a high level of protection of the rights and freedoms of natural persons with regard to the processing of such data, equivalent in all Member States, backed by strong enforcement, so as to create the trust that will allow the digital economy to develop across the internal market.
40.      From that perspective, the material scope of the GDPR, set out in Article 2, is therefore necessarily broad and the exceptions it provides for are to be interpreted strictly. The Court of Justice has thus held that Article 2(2)(a) of the GDPR, read in the light of recital 16 thereof, is designed solely to exclude from the scope of that regulation the processing of personal data carried out in the course of an activity which is intended to safeguard national security or an activity which can be classified in the same category.
41.      Activities having the aim of safeguarding national security encompass, in particular, those that are intended to protect essential State functions and the fundamental interests of society. (13)
42.      However, it is not individuals as such who are exempt from the application of the GDPR, but only their relevant activities. (14) The sole fact that an activity is specific to the State or a public authority is not sufficient ground for that exception to be automatically applied to the activity. (15) Nor is it sufficient that the controller concerned has activities connected with national security, since it is only the activity at issue in the context of the relevant processing that is relevant. (16) Nor is it sufficient that, as part of a transfer of data for commercial purposes from a Member State to a third country, the data at issue are liable to be processed, at the time of that transfer or thereafter, by the authorities of the third country concerned for the purposes of public security, defence and State security. (17)
43.      In the present case, as the Austrian Government points out, Paragraph 1(1) of the ADBG provides that ‘because it influences sporting ability, doping is contrary to the principle of fairness in sporting competition and to the true intrinsic value of sport (fair play), and also poses health risks’.
44.      It cannot therefore be maintained that the publication of personal data by NADA and the ÖADR constitutes processing of data in connection with an activity, in this case combating doping, which relates to national security or which could be classified in that category under Article 2(2)(a) of the GDPR.
45.      It must be concluded that the exception based on that provision of the GDPR is not applicable to the data processing at issue in the present case.
46.      NADA’s arguments, based, first, on the fact that anti-doping activity is a matter for the Member States and, second, on the fact that that activity is not economic in nature, are not such as to invalidate that finding, as I shall now seek to demonstrate.
Anti-doping activity does not fall outside the scope of the GDPR …
–       … even though it is a matter for the Member States
47.      First, NADA submits that anti-doping policy is an area which, under the division of competences provided for in EU law, remains a matter for the Member States, notwithstanding the supporting competence provided for in the field of sport by Article 165 TFEU.
48.      However, the fact that the processing of personal data takes place in the course of an activity which falls within the competence of the Member States is not in itself relevant for excluding that processing from the scope of the GDPR on the basis of Article 2(2)(a) thereof, where it does not fall within an activity intended to safeguard national security or an activity which can be classified in the same category. (18)
49.      To exclude from the scope of the GDPR processing carried out in the course of an activity solely on the grounds that the activity falls within the competence of the Member States would, in my view, run counter to the wording, the context and the objectives of that regulation.
50.      When the text of Article 2(2)(a) of the GDPR alludes to the concept of an ‘activity which falls outside the scope of Union law’, it does not refer to a rationale based on competence, but rather a substantive
rationale for defining the scope by the legislature within the GDPR itself, as conferred by
Article 16(2) TFEU. That provision ‘constitute[s] and delegate[s]’ to the Union legislative competence for the protection and free movement of personal data, and to that end defines a specific scope. (19) In addition, in the particular context of the protection of personal data, especially bearing in mind the self-contained nature of the issues linked to the processing of personal data which called for specific suitable legislative intervention, the concept of ‘scope of Union law’ goes beyond the cases of ‘implementing Union law’ within the meaning of Article 51 of the Charter of Fundamental Rights of the European Union (‘the Charter’). (20) Lastly, ‘in many areas falling within the competence of the Member States, Union law continues to have an influence’. (21) That is particularly true of the GDPR, the cross-cutting scope of which is necessarily broad in view of its objectives, as set out in point 39 of the present Opinion.
51.      Thus, although the ‘anti-doping’ activity is not regulated by an act of EU law and is a matter for the Member States, it cannot be inferred from that that the processing carried out in the context of that anti-doping activity does not fall within the ‘scope of Union law’ within the meaning of Article 2(2)(a) of the GDPR, as interpreted by the Court of Justice in the specific context of the GDPR.
52.      Furthermore, since the Treaty of Lisbon, sport has been regarded as a supporting competence of the Union. (22) Article 165(2) TFEU thus provides that: ‘Union action shall be aimed at … developing the European dimension in sport, by promoting fairness and openness in sporting competitions and cooperation between bodies responsible for sports, and by protecting the physical and moral integrity of sportsmen and sportswomen, especially the youngest sportsmen and sportswomen’. That wording refers in particular to anti-doping policies. It is true that such supporting competence does not confer any competence on the Union to legislate in the field of sport. However, although the activity
of the Union is not normative, it still exists and allows the European Union to adopt legal acts with the aim of supporting, coordinating or complementing Member State action, in accordance with Article 6 TFEU. (23) Therefore, the fact that the anti-doping rules are ‘sporting’ in nature does not permit the inference that their implementation constitutes an activity which falls outside the scope of Union law, within the meaning of Article 2(2)(a) of the GDPR.
–       … and despite the ‘absence’ of any economic characteristics
53.      Second, NADA submits that the practice of sport falls within the scope of EU law only in so far as it constitutes an economic activity. The anti-doping rules at issue are, in its view, based on purely sporting considerations, so that the data processing at issue in the present case does not constitute a matter coming under economic activity and therefore does not fall within the scope of EU law.
54.      I am not convinced by that argument, based on the alleged ‘severability’ of the anti-doping rules.
55.      The assertion that ‘the practice of sport comes under Community law only in so far as it constitutes an economic activity within the meaning of Article 2 of the [EC] Treaty’ takes us back to the judgment of 12 December
1974,
Walrave and Koch. (24) Since then, however, the European Union has exercised its data protection competence on the basis of Article 16 TFEU. The Member States thus intended to apply EU law on the protection of personal data, including in non-economic areas, as evidenced by the text, the context and the objectives of the GDPR.
56.      First of all, the text of Article 2(2)(a) of the GDPR determines the material scope of that regulation by referring to the concept of ‘activity’ and not ‘economic activity’ whether or not it falls within the scope of Union law.
57.      Second, the context of the GDPR, and in particular its provisions on the transfer of personal data to third countries or international organisations (Chapter V of the GDPR), confirms that textual approach. If the conditions for such a transfer to take place are not met, derogations in specific situations, provided for in Article 49 of the GDPR, may nevertheless authorise such a transfer. Yet, recital 112 of the GDPR expressly states that the derogations for such special situations ‘should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange … in order to reduce and/or eliminate doping in sport’. As pointed out by the Finnish Government, that recital indicates that the EU legislature did not consider that the processing of personal data in connection with doping control, although it relates to a non-economic activity, fell outside the scope of that regulation.
58.      Lastly, the criterion based on a connection with EU law through an economic activity does not seem to me to be relevant to the objectives of the GDPR either. Indeed, such a criterion would result in having to determine the scope of the GDPR on a case-by-case basis, depending on whether or not the processing of the data in question was linked to particular provisions of EU law or to the freedoms governing the internal market. Such an approach, which varies according to the specific situations in question, could make the limits of the scope of that regulation unsure and uncertain, (25) in breach of that regulation’s essential objective of ensuring consistent and homogeneous application of the rules for the protection of personal data throughout the European Union and removing obstacles to flows of personal data within the European Union.
59.      Moreover, I would add that, at least for professional athletes, we cannot rule out a link between the anti-doping regulations and their professional activity and therefore an economic connection, in particular with the freedoms of movement and the freedom to provide services. (26) The penalties incurred are likely to have significant economic consequences as a result of the athletes’ suspension, sometimes for life. If, in order to determine the scope of the GDPR, it were necessary to rely on the existence of such an economic link, the unsatisfactory result would be that the GDPR could, for example, apply to professional athletes but not to amateur athletes. (27) Such a difference in treatment depending on whether or not the activity is regarded as economic is difficult to reconcile with the GDPR and its objectives of protecting personal data.
Conclusion on the first question
60.      Having regard to all of the foregoing, I propose that the Court of Justice should answer the first question to the effect that the first sentence of Article 16(2) TFEU and Article 2(2)(a) of the GDPR must be interpreted as meaning that the processing of personal data consisting, pursuant to national anti-doping rules, in the publication of the names of the athletes concerned, the sport they practise, the infringement of the anti-doping rules they have committed, the penalty imposed on them and the start and end dates of that penalty, cannot be regarded as part of an ‘activity which falls outside the scope of Union law’ within the meaning of Article 2(2)(a) of the GDPR.
The second question
61.      By its second question, the referring court asks whether the publication of the personal data at issue relates to ‘data concerning health’ within the meaning of Article 9 of the GDPR.
Broad interpretation of the concept of ‘data concerning health’
62.      Question 2 is prompted by the fact that Article 9 of the GDPR provides for a particularly protective legal regime for categories of personal data referred to as ‘sensitive’, which include ‘data concerning health’ (or ‘health data’). Such data, considered to lie at the heart of individual privacy, require a high level of protection, provided at the same time through the protection of privacy, professional secrecy and legislation on personal data protection. (28) Their processing is, therefore, prohibited by Article 9(1) of the GDPR, unless one of the derogations provided for in Article 9(2) applies. That approach is reflected in recital 51 of the GDPR, concerning sensitive data, according to which such specific protection is due to the fact that ‘the context of their processing could create significant risks to the fundamental rights and freedoms’. According to recital 54 of the GDPR, if the data are processed for reasons of public interest,
the aim is to prevent that data being processed ‘for other purposes by third parties such as employers or insurance and banking companies’. (29) The need for data protection has also increased with the computerisation of healthcare structures and the dematerialisation of data carriers and data flows. (30)
63.      I would add that the prohibition on processing health data, laid down in Article 9(1) of the GDPR, is independent of whether or not the information revealed by the data processing is correct, or whether the controller is acting with the aim of obtaining information that falls within one of the special categories referred to in that provision. (31) It must be inferred from this that the objective of the controller, and in particular the fact that the processing is necessary pursuant to a legal obligation or a public interest, while constituting a relevant factor in the possible application of one of the 10 derogations provided for in Article 9(2) of the GDPR, is not a factor that must be taken into account when classifying information as ‘health data’. (32)
64.      Pursuant to Article 4(15) of the GDPR, read in conjunction with recital 35 of that regulation, such data include all personal data related to the physical or mental health of a natural person which reveal (33) information about his or her past, current or future health status.
65.      The Court of Justice has previously held that, having regard to the objective of the GDPR, the concept of ‘data concerning health’ referred to in Article 9(1) of that regulation must be interpreted broadly. (34) According to the contextual and teleological interpretation of Article 4(15) and Article 9 of the GDPR, in order to be classified as such, it is sufficient for the data in question to be capable, even indirectly, of revealing, by means of an intellectual operation involving collation or deduction, information about the health status of the data subject. (35)
66.      In that context, I have the impression that broadly two categories of health data could be distinguished.
67.      On the one hand, data generated in a medical context seem to me to be capable of being regarded,
‘by their very nature’, (36) as ‘objective’ (37) health data. As set out in recital 35 of the GDPR, they relate to information concerning, for example, a physical or mental illness, a disability, disease risk, medical history or clinical treatment. They generally appear in the data subject’s medical record. (38) Similarly, data which, although non-medical, are collected for inclusion in the medical record, such as administrative data intended to be included in that record, are as such covered by recital 35 of the GDPR as ‘health data’. In that regard, the data in question are considered to relate to health and reveal information about the data subject’s health status.
68.      In that context, the concept of ‘disease risk’, mentioned in recital 35 of the GDPR, is certainly of some importance. As is apparent from the work of the Article 29 Working Party, it includes data concerning the potential future health status of a data subject. A ‘scientifically proven or commonly perceived’ risk of disease in the future is thus taken into account, and excessive alcohol consumption, tobacco consumption or drug use are cited as examples. (39)
69.      On the other hand, outside of a medical context, a piece of information may concern health, in particular if the information in question is capable, even indirectly, of revealing information on the past, current or future physical or mental health status of a natural person. (40) It is the ‘grey area’ (41) of the concept of ‘health data’ that raises the question of how far that information’s indirect link with health can lead to it being classified as health data. The determining factor here is whether it is possible, on the basis of the data in question, to draw inferences about the health status of the data subject, whether they relate to a pathological or physiological status, irrespective of the reliability of those inferences. Contextual factors may be taken into account in that respect, (42) as may the link between the information in question and the ability to infer an aspect of a person’s health from it. (43)
70.      For example, the Article 29 Working Party regarded information about an individual’s membership of groups with a health-related objective such as Weight Watchers or Alcoholics Anonymous to be health data. (44) In addition, raw data from a ‘personal measurement’ (such as weight or blood pressure recorded by a smart watch) which would not in itself be health data could, in combination with other information, allow inferences to be made about the health of the data subject. The Article 29 Working Party states in that regard that an assessment must be made on a case-by-case basis: an application that tracks and stores the number of steps taken over a few days and deletes those data after one week might not process ‘health data’. However, an application combining several years’ worth of extensive quantified records of an individual (tracking, for example, sleep and exercise habits, detailed records of diet, weight, body mass index, blood pressure and other vital statistics, and a mood diary) is regarded as processing health data. In that case, not only the conclusions and inferences, but also the raw data, will be considered to be health data. (45)
Application to the present case
71.      In the dispute in the main proceedings, the regulations at issue provide that, in addition to the names of the athletes concerned and the duration of their suspension, the reasons for that suspension are to be disclosed by reference to the category of infringement(s) detected. Where the infringement relates to a prohibited substance or method, that is also to be indicated in the press release published on the ÖADR website. (46)
72.      First of all, it must be borne in mind that infringements of the anti-doping rules that are disclosed to the public are divided into several categories. (47)
73.      Like the Austrian Data Protection Authority, I take the view that only the infringements provided for in categories
2.1 and 2.2 should be examined in the light of the concept of ‘health data’. The other infringements relate to offending conduct which does not, in itself, appear to me
to be likely to reveal, even indirectly, information about the health status of the data subject. For example, information that an athlete has breached his or her whereabouts obligation (category
2.4 infringement) or trafficked in prohibited substances (category
2.7 infringement) does not reveal any information about his or her health status.
74.      Next, it should be noted that the detection of category
2.1 and 2.2 infringements involves anti-doping tests on the athlete concerned and the analysis of samples in order to detect prohibited substances and methods. I would add that the analyses are carried out by accredited professionals (48) and therefore in a quasi-medical or even medical context. The finding of such infringements is therefore linked to ‘information derived from the testing or examination of a body part or bodily substance’ within the meaning of recital 35 of the GDPR. Such information could, therefore, be regarded as health data by nature.
75.      In that regard, it is true that the test is carried out with a view to detecting doping substances taken to improve athletic
performance and that the processing, consisting in the disclosure of the information in question, meets a punitive objective with regard to the athlete concerned and is intended to act as a deterrent. However, it should be borne in mind that the objective pursued is irrelevant to the classification of the data at issue. (49)
76.      Similarly, the fact that doping substances are not medicines does not seem convincing to me. First, the concept of ‘health data’ does not include only medical data for therapeutic purposes. Moreover, some medicinal products are harmful to health if misused. Second, while combating doping is certainly intended to promote fairness and equality among athletes, it is also a health concern. (50) A number of substances or methods are prohibited in particular because of their harmful effects on health, even if that effect varies according to the product, the quantity absorbed or the constitution of the person concerned. (51)
77.      Therefore, in order to classify the information at issue, irrespective of the fact that the objective sought by the athlete is to improve his or her performance, the effects of the absorption of a prohibited substance on the health of that athlete cannot, in my view, be disregarded, whether those effects are present or future.
78.      Lastly, it seems to me that the fact that the name of the prohibited substance detected in the body is published online by the ÖADR is such as to inform the public of the risks which its absorption may entail for the health of the athlete in question.
79.      Admittedly, the mere mention of the name of the prohibited substance present in the body could be considered insufficient, in itself, to reveal information on the health status, or even the future health status, of the athlete concerned. The actual content of the information could, in that respect, be regarded as too succinct and the link with health status too indirect, or even too hypothetical, to constitute ‘health data’ within the meaning of the GDPR. However, it cannot be ruled out that, when combined with other elements, that information may, even indirectly, be capable of revealing, by means of an intellectual operation involving collation or deduction, information about the health status of the data subject, including his or her future health status.
80.      I therefore take the view that the reference to the name of the substance in question (or its category) gives indications which, even if not very detailed, are capable of providing information, albeit indirectly, on the health status of the data subject. In the specific context of the GDPR, such a reference constitutes, in certain circumstances which it is for the referring court to verify, ‘data concerning health’ within the meaning of Article 4(15) and Article 9(1) of the GDPR, read in conjunction with recital 35 of that regulation.
81.      However, I do not consider that that would be the case if the prohibited substance in question (or its category) were not mentioned. In that event, it would be impossible to draw a link between the finding of an
infringement based on the presence of a prohibited substance in the body, on the one hand, and information about the health status of the data subject, on the other, even by means of an ‘intellectual operation involving collation or deduction’. In my view, such a link would then be too indirect for the information disclosed to fall into the category of ‘data concerning health’ under the GDPR.
Conclusion on the second question
82.      I therefore propose that the Court of Justice should rule that Article 9(1) of the GDPR must be interpreted as meaning that disclosing the name of the athlete concerned, the duration of his or her suspension and the grounds for that suspension does not constitute processing of data concerning health, within the meaning of that provision, unless those grounds include the name of the prohibited substance or substances found to be present in the body of the athlete in question, where that indication is capable of revealing, even indirectly, information on the health status, including the future health status, of the athlete concerned, a matter which it is for the referring court to ascertain.
The fifth question
83.      The referring court asks, in essence, whether the publication at issue constitutes processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR. It explains, in that regard, that the penalties in the main proceedings include the revocation of titles and the forfeiture of prize money, and a suspension for a number of years or a lifetime ban from all competitions (national and international). It also states that, pursuant to Paragraph 24(4) of the ADBG, sports organisations may not ‘have recourse’ to persons suspended under anti-doping legislation and therefore may not offer them gainful employment.
84.      Before analysing the nature of the anti-doping convictions and offences in question, I will
address the significance of a criminal classification in the context of Article 10 of the GDPR.
The ‘criminal’ nature of convictions and offences within the meaning of Article 10 of the GDPR
85.      It should be borne in mind that the EU legislature does not prohibit the processing of personal data relating to criminal convictions and offences, but subjects it to enhanced scrutiny, in so far as it may have a significant impact on the lives of the data subjects, in particular in relation to damage to reputation or discrimination in other areas. Such processing may be carried out only ‘under the control of official authority’ or when the legislation authorising such data processing provides for ‘appropriate safeguards for the rights and freedoms of data subjects’. (52) Article 10 of the GDPR reserves such enhanced protection for criminal offences alone, it being understood that the term ‘criminal’ refers to both ‘convictions’ and ‘offences’. (53)
86.      Article 10 of the GDPR may therefore apply to the keeping of registers of criminal convictions and offences by private bodies, (54) for example in the context of combatting money laundering or the activities of forensic laboratories. (55) Another example is the processing of personal data by vehicle hire companies that identify and designate a driver who has infringed road traffic regulations.
87.      In the present case, the question is therefore whether the ‘sports record’ placed online by NADA and the ÖADR constitutes a ‘register’ of criminal convictions and offences falling within the scope of Article 10 of the GDPR and which therefore requires enhanced protection.
Analysis of whether anti-doping convictions and offences are ‘criminal’ within the meaning of Article 10 of the GDPR
88.      According to the case-law of the Court of Justice, the concept of ‘criminal offence’, which is decisive for determining whether Article 10 of the GDPR is applicable to the processing of personal data, requires an autonomous and uniform interpretation throughout the European Union, having regard to the objective pursued by that provision and the context of which it forms part; the classification given by the Member State concerned to those offences is not conclusive in that regard as the classification may vary from one country to another.
89.      The three ‘Engel criteria’ adopted by the Court, (56) namely the legal classification of the offence under national law, the very nature of the offence and the degree of severity of the penalty that the person concerned is liable to incur, are thus relevant when assessing whether an offence is criminal in nature.
90.      Although it is for the referring court to assess, in the light of those criteria, whether the convictions and offences at issue in the main proceedings are criminal in nature within the meaning of Article 10 of the GDPR, the Court of Justice, when giving a preliminary ruling, may nevertheless provide clarification designed to give the national court guidance in its assessment. (57)
91.      I shall therefore examine the offences and convictions at issue in the light of those three criteria.
–       Legal classification of the offence under national law
92.      It is apparent from the request for a preliminary ruling that, under Austrian law, the ÖADR conducts disciplinary proceedings for the relevant sports federation. Similarly, the Austrian Government emphasised at the hearing that the anti-doping regulations are of a sui generis nature in that infringements of the anti-doping rules are breaches of the rules of the sports federations concerned, which the athletes undertake to respect, (58) and not breaches of the law.
93.      The classification of anti-doping offences under national law is therefore not consistent with a ‘criminal’ classification within the meaning of Article 10 of the GDPR.
94.      That said, the scope of the first Engel criterion needs to be put in perspective, since even in the case of offences which are not classified as ‘criminal’ by national law, the intrinsic nature of the offence in question and the degree of severity of the penalties to which it is liable to give rise may nevertheless result in it being criminal in nature. (59) That applies in particular to anti-doping regulations, since the trans-State system put in place involves various international and national stakeholders, (60) and the Member States have incorporated the Code in different ways into their respective legal systems. The implementation of anti-doping regulations therefore necessarily varies from one State to another, depending on the different models of State organisation, although it appears that, in most Member States, NADOs do not have criminal jurisdiction in that regard. (61)
95.      It is therefore necessary to examine the other two Engel criteria.
–       Nature of the offence
96.      The second Engel criterion requires verification of whether the purpose of the penalty for the offence at issue is punitive; the mere fact that it also has a preventive purpose does not mean that it cannot be characterised as a ‘criminal penalty’. The very nature of criminal penalties is that they seek both to punish and to deter unlawful conduct. By contrast, a measure which merely repairs the damage caused by the offence at issue is not criminal in nature. (62)
97.      It is apparent from the request for a preliminary ruling that there are two categories of penalty for anti-doping infringements.
98.      Those are, first, the revocation of titles and forfeiture of prize money, which consists in recovering winnings in order to reallocate them to the athletes who would have been entitled to them if the penalised athlete had not taken part in the competition. Such a penalty appears to be a response to a breach of the ‘rules of the game’ (‘lex sportiva’) and may be regarded as essentially aimed at restoring fair play in competitions, (63) although that does not in any way detract from its punitive nature for the athlete concerned.
99.      The second category involves suspension from taking part in sporting competitions, lasting for a few months or several years, or even, as in the case of one of the applicants in the main proceedings, going as far as a lifetime ban from all competitions. Such a suspension may certainly be seen as a desire to ‘ban’ the offending athlete in order to remove him or her from the community of athletes and, in so doing, to preserve the integrity of that community. However, it is also intended to penalise athletes who have infringed the anti-doping rules with which they had undertaken to comply, and to deter other athletes from doing the same.
100. The primary purpose of those anti-doping penalties, or at least of suspension from competitions, does not therefore appear to be to compensate for the harm suffered by third parties as a result of the offence, but rather to penalise the conduct of the athlete concerned, which is consistent with a criminal conviction. (64) In that respect, anti-doping regulations, even if they do not amount to a body of criminal law, have a punitive purpose. (65)
101. However, ‘criminal’ characterisation under the second Engel criterion could give rise to two kinds of uncertainty.
102. An initial uncertainty arises from the fact that disciplinary proceedings have tended to be dealt with under the civil head of Article 6 ECHR by the Strasbourg Court, (66) except, for example, where deprivation of liberty is involved and the penalty is sufficiently severe. (67)
103. In particular, the Strasbourg Court considers that Article 6 ECHR is applicable in its civil aspect to ‘disputes relating to the withdrawal of the right to exercise a profession’, (68) including in the field of sport. (69)
104. The criminal nature of a ban on the exercise of a profession is therefore far from self-evident.
105. However, it seems to me that it cannot be inferred, ipso facto and absolutely, that a disciplinary penalty resulting in suspension from sporting competitions could never be a criminal matter.
106. Such an approach would appear to be purely formal.
107. It should also be borne in mind that the two aspects of Article 6 ECHR, civil and criminal, are not necessarily mutually exclusive. (70)
108. Lastly, it should be borne in mind that the Strasbourg Court examines the criminal or civil nature of the offence in question in the light of the complaints raised before it and for the purposes of assessing whether the guarantees of a fair trial provided for in Article 6 ECHR apply in their civil (paragraph 1) or criminal (paragraphs 1 to 3) aspects.
109. On the other hand, in the context of Article 10 of the GDPR, the issue relates to the assessment of whether the conviction or offence is criminal for the purposes of determining whether the processing at issue (here, publication) concerns information deserving enhanced protection involving the control of an official authority. In addition, there is nothing to prevent the adoption of a broader interpretation entailing a stronger protection of the rights and freedoms in question. (71) It is in that context of Article 10 of the GDPR that the referring court should assess whether or not the Engel criteria, and in particular the second criterion relating to the nature of the offence, are met.
110. A second uncertainty arises from the fact that anti-doping offences and convictions are directed only at a particular group of persons, namely athletes, in the same way as disciplinary penalties, the purpose of which is generally to ensure that its members comply with rules of conduct specific to the group in question. (72) Such provisions are designed to protect the profession’s honour and reputation and to maintain public trust in it. (73)
111. It is true that such a finding would make it possible to classify the offence as ‘disciplinary’ in the sense that it applies to a certain number of persons covered by a specific set of rules. In that respect, the present case differs from the case which gave rise to the judgment in Latvijas Republikas Saeima, in which penalty points were given for road traffic offences on the basis of a text of general application. (74)
112. However, that does not rule out the classification of the offence as a ‘criminal offence’ within the meaning of Article 10 of the GDPR. If the narrower scope specific to disciplinary regulations were sufficient to prevent the offence from being classified as a ‘criminal’ offence, we would once again be adopting a purely formal approach to the concept. Such an approach is difficult to reconcile with the case-law, which requires, in that regard, that in order to define the nature of the offence the punitive or preventive purpose of the penalty must be sought, as opposed to a purely remedial objective.
113. In the present case, as already mentioned, (75) anti-doping convictions are not intended to make good any damage caused by the offences
in question (or not solely intended to do so, if we include the damage caused to the sporting community), but, on the contrary, they have a punitive purpose which confers on them the status of ‘criminal’ convictions within the meaning of the interpretation of that second criterion by the case-law, irrespective of whether or not the applicable legislation is general in nature. I would also point out that the Court of Arbitration for Sport (Switzerland), an international institution offering arbitration or mediation in the world of sport, itself recognises, where appropriate, the ‘quasi-penal’ nature of anti-doping penalties. (76)
114. In addition, certain anti-doping offences, such as trafficking in prohibited substances, may give rise to penalties under both anti-doping regulations and national criminal law. It is true that the Strasbourg Court has held that the fact that acts liable to lead to a disciplinary penalty also constitute criminal offences is not sufficient for a person liable under disciplinary law to be regarded as having been ‘charged’ with a criminal offence. (77) It seems to me, however, that that could constitute an element to be taken into account in the context of the second Engel criterion.
115. Consequently, despite the reservations expressed, I consider at this stage that it cannot be ruled out that, in view of their punitive or preventive nature, certain anti-doping offences may be regarded as being criminal in nature within the meaning of Article 10 of the GDPR.
–       Degree of severity of the penalty
116. The third Engel criterion must be determined by reference to the maximum penalty provided for in the relevant provisions. (78)
117. The degree of severity varies according to the anti-doping offence committed. For example, the length of the suspension incurred varies according to the anti-doping offences in question. Recidivism and the perpetrator’s intention may also play a role in that respect. (79)
118. It is clear from the request for a preliminary ruling that, in the present case, the penalty may involve ‘a multi-year or life ban from all (national and international) competitions’, which may therefore lead to a permanent prohibition on practising the profession of athlete.
119. It is true that such a ban is not a custodial sentence. However, that is not a decisive element, since ‘the relative lack of seriousness of the penalty at stake cannot deprive an offence of its inherently criminal character’. (80) Furthermore, depending on the duration of the suspension, the professional sports careers of the data subjects are likely to come to an end, particularly given the age of the data subjects and the fact that, in certain sports in particular, careers are relatively short.
120. In addition to that suspension, which may be ‘for life’, there is the practical impossibility of finding employment in the sporting field, in view of the prohibition on association with a person who has been suspended for the entire duration of his or her suspension.
121. As well as the economic and financial consequences for the data subject, there is also the disapproval of society and stigmatisation in both the public and private spheres.
122. It follows, in my view, that such a penalty is of a severity capable of having an effect equivalent to a criminal conviction within the meaning of Article 10 of the GDPR; that is, however, a matter for the referring court to assess in each particular case.
123. Accordingly, I take the view that, in principle, anti-doping offences and convictions should be regarded as falling within the disciplinary sphere, except in cases where the conviction is of such severity as to be regarded as a criminal matter. Such an assessment, which cannot be called into question solely on the basis of the classification under national law, is also consistent with the punitive and preventive purpose of the conviction, which confers a criminal nature on the offence committed. In that context, a lifetime ban on participating in any competition could therefore, in my view, constitute a penalty having an effect equivalent to a criminal penalty, capable of triggering the applicability of Article 10 of the GDPR.
124. Lastly, I would add that I am not convinced by NADA’s argument warning against the implications, for all professional bodies, of applying Article 10 of the GDPR to the processing of data relating to disciplinary offences and convictions. There is no question here of ‘criminalising’ all disciplinary offences and convictions in a general and abstract manner. The foregoing analysis has shown that the assessment must be made in the light of the circumstances of each individual case and with a view to interpreting Article 10 of the GDPR, which, where there is a ‘register’ of convictions and offences falling within its scope, requires enhanced protection. Moreover, the legal basis for the processing of data relating to such offences and convictions classified as ‘criminal’ may also lie in EU or Member State legislation providing for ‘appropriate safeguards’.
Conclusion on the fifth question
125. I consider that the Court of Justice should give the following answer to the fifth question: Article 10 of the GDPR must be interpreted as meaning that it may apply to the processing of personal data relating to convictions or offences under national anti-doping regulations, where, irrespective of the classification of those offences under national law, the convictions which they involve have a punitive purpose and have a degree of severity such that they have an effect equivalent to a criminal penalty, a matter which it is for the referring court to ascertain.
The sixth question
126. If the fifth question is answered in the affirmative, the referring court asks whether the activities or decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures, in accordance with Article 10 of the GDPR, are subject to judicial review.
127. First, I would point out that the authority at issue is the ‘official authority’ within the meaning of Article 10 of the GDPR, which should not be confused with the ‘supervisory authority’, within the meaning of Article 51 of the GDPR. (81) It should also be borne in mind that the processing of personal data relating to criminal convictions and offences is to be carried out only under the control of official authority or when the processing is authorised by EU or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. (82) The answer to that question must therefore be linked to the answers to the third and fourth questions, examined below. (83)
128. Second, it should be noted that the GDPR does not contain a definition of the concept of ‘official authority’ or ‘control of official authority’ within the meaning of Article 10 of that regulation. It is for the Member States to determine which body exercises the control of an ‘official authority’ where personal data is processed within the meaning of Article 10 of the GDPR. As the Commission states, it cannot be ruled out that more than one service may be considered an ‘official authority’, and it is not necessarily the ‘controller’.
129. Third, it is true that the wording of Article 10 of the GDPR does not, as such, provide for judicial review of the activities or decisions of that ‘official authority’. That said, the contextual interpretation of that provision argues in favour of such a review if the data subjects wish to assert their rights. Like a number of interested parties, I take the view that the review of acts relating to the processing of personal data, including where that review follows a decision of an official authority within the meaning of Article 10 of the GDPR, must comply with Article 79(1) of the GDPR, even if the referring court does not refer to that provision in its question. Under that provision, without prejudice to any administrative or extrajudicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 of the GDPR, each data subject has the right to an effective judicial remedy where he or she considers that his or her rights under the GDPR have been infringed as a result of the processing of his or her personal data in breach
of that regulation. Moreover, as the Finnish Government emphasises, the very existence of an effective judicial review designed to ensure compliance with EU law is of the essence of the rule of law.
130. Fourth, such an interpretation is confirmed by the objective pursued by Article 10 of the GDPR, namely to ensure enhanced protection as regards processing which, because of the particular sensitivity of the data at issue, is liable to constitute a particularly serious interference with the fundamental rights to respect for private life and to the protection of personal data. (84) An interpretation of Article 10 of the GDPR that excluded, a priori and generally, the activities or decisions of an official authority within the meaning of that provision from any judicial review would run counter to those purposes.
131. In those circumstances, and in the absence of any further clarification as to the activities or decisions of the official authority in question, I consider that the sixth question should be answered to the effect that Article 10 of the GDPR, read in the light of Article 79(1) of that regulation, must be interpreted as meaning that it must be possible for the activities or decisions of an authority which has been given responsibility under that provision for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures to be subject to judicial review.
The third and fourth questions
132. By the third and fourth questions, which may be considered together, the referring court asks, in essence, first, whether Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR may be interpreted as precluding an obligation, imposed by national law on national anti-doping bodies, to publish the personal data concerned, namely, in particular, the names of athletes sanctioned for an infringement of the anti-doping rules, the duration of the ban imposed and the reasons for it.
133. Second, the court asks whether the GDPR requires a case-by-case balancing of the interests involved by the controller before publication or whether the proportionality test provided for by the legislator is sufficient.
Proportionality of the publication in question
134. In the ADBG, the national legislator provided for the publication of certain data (name of the athlete, duration and reasons for the ban), free of charge, (85) for the attention of the federal sports organisation, sports organisations, athletes, other persons (support personnel), competition organisers and the general public, without it being possible to infer health data. It is also provided that the information to be published may be withheld from the general public only if the data subject is a recreational athlete, particularly vulnerable (a minor) or a person who has made a significant contribution to the detection of potential infringements of the anti-doping rules by sharing information or other indications. Unless I am mistaken, the ADBG makes no explicit provision, in such a case, either regarding the indication of the prohibited substance that may be involved, or publication via the internet.
135. In practice, NADA and the ÖADR implemented that legislation by means of online publication for professional athletes, and in the case of the publication by the ÖADR the prohibited substance in question was mentioned.
–       Preliminary observations and reminder of principles
136. It should be recalled that the objective pursued by the GDPR, as set out in Article 1 and recitals 1 and 10 thereof, is, inter alia, to ensure a high level of protection of the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data, which is enshrined in Article 8(1) of the Charter and Article 16(1) TFEU and is closely linked to the right to respect for private life enshrined in Article 7 of the Charter.
137. In that regard, the fundamental rights to respect for private life and to the protection of personal data, guaranteed in Articles 7 and 8 of the Charter, are not absolute rights. Limitations may therefore be imposed, so long as, in accordance with Article 52(1) of the Charter, they are provided for by law, respect the essence of the fundamental rights and observe the principle of proportionality. (86)
138. In the present case, the publication of the personal data of the athletes concerned is carried out on the basis of a legal obligation imposed on the controllers by national law. (87)
139. Accordingly, that data processing may be regarded as falling within the scope of Article 6(1)(c) of the GDPR, which provides that processing which is necessary for compliance with a legal obligation to which the controller is subject is lawful. Given that combating doping could be regarded as the performance of a task carried out in the public interest, (88) the processing at issue may also fall within the scope of Article 6(1)(e) of the GDPR. However, it is not necessary to decide which of those conditions of lawfulness is applicable in the present case or whether both apply. (89)
140. Article 6(3) of the GDPR
stipulates, with regard to both those situations where processing is lawful, referred to in Article 6(1)(c) and (e) of the GDPR, that such processing must be based on EU law or on the law of the Member State to which the controller is subject, and that that legal basis must meet a public interest objective and be proportionate to the legitimate aim pursued.
141. Similarly, any processing of personal data must, inter alia, comply with the principles set out in Article 5(1) of the GDPR, and in particular the principles of lawfulness and ‘data minimisation’, set out in points
(a) and (c) respectively of that provision. According to the principle of minimisation, personal data are to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, which gives expression to the principle of proportionality. (90)
142. The questions referred by the national court therefore involve ascertaining whether the national legislation, as the legal basis for the processing at issue, satisfies the requirements arising from those provisions, namely that it meets a public interest objective and is proportionate to the legitimate aim pursued.
143. In the present case, in the context of combating doping in sport, which is certainly a public interest objective, sanctions are adopted for infringements of the anti-doping rules. In addition, the disclosure to the general public of the personal data at issue pursues two equally legitimate objectives, which were mentioned by the interested parties and by the Austrian Government at the hearing. One aim is to deter athletes from committing infringements of the anti-doping rules and thus to prevent doping in sport. The other aim is to prevent circumvention of the anti-doping rules by informing all persons likely to sponsor or engage the athlete in question that he or she is suspended. (91)
144. The referring court must therefore determine whether the national legislation providing for the processing in question, as implemented by NADA and the ÖADR, is appropriate for contributing to the attainment of the public interest objectives which it pursues, and whether it is necessary and proportionate to those objectives, the Court of Justice having jurisdiction to provide it with the necessary guidance on interpretation.
–       The appropriateness of the publication for attaining the objectives pursued
145. It seems to me that the publication of the data in question may be regarded without too much difficulty as being appropriate for attaining the two objectives pursued.
146. First, the act of publishing the name of the penalised athlete, together with the reasons for and the duration of his or her suspension, informs the general public that doping does not go unpunished and that it is accompanied not only by sanctions but also by publication of the name of the suspended athlete. That is likely to encourage the public, including athletes, whether professionals or amateurs, to refrain from infringing anti-doping rules, and therefore meets the objective of deterrence and prevention.
147. Second, the publication of the ban also makes it possible to inform persons who might wish to employ the athlete concerned in any capacity whatsoever in connection with sport that he or she is suspended and is not supposed to perform sporting functions. I would add that associating with a suspended athlete also constitutes a breach of anti-doping rules. (92) Such publication may thus help to prevent such infringements from being committed out of ignorance.
148. On the other hand, I do not see how the reference to the prohibited substance in question, which is not expressly provided for by the national law but is published by the ÖADR, makes it possible to attain the objectives pursued. Neither the objective of deterrence nor that of preventing circumvention of the anti-doping rules require the infringement to be described in such detail.
–       The need for publication in the light of the objectives pursued
149. In accordance with recital 39 of the GDPR, verifying the need for the processing at issue in the light of the objectives pursued means verifying whether there are any alternative measures that are less restrictive of the rights to respect for private life and to the protection of personal data guaranteed in Articles 7 and 8 of the Charter, but just as effective in achieving the objective relied on. (93)
150. First, with regard to the objective of deterrence, public disclosure of the names of the athletes concerned does not seem to me to be absolutely necessary in all cases.
151. Admittedly, deterrence is all the more effective if, particularly in the case of a famous athlete, the sanctions are accompanied by disclosure of his or her name. High-level athletes who enjoy a certain level of recognition have a particular responsibility in that respect, and the disclosure of their names may therefore be all the more relevant in the light of the objective pursued.
152. However, in the case of professional athletes not covered by the exceptions provided for by the ADBG, national legislation provides for automatic disclosure of their names, the impact of which becomes unlimited through online publication, (94) regardless of the particular circumstances relating to individual elements (reputation of the athlete, level of competition, repeat infringements, intentional nature, and so forth). In that regard, I take the view that, by their general nature, the national provisions in question are likely to go beyond what is required to prevent doping through deterrence.
153. Second, as regards the objective of preventing circumvention of the ban on associating with a suspended person, that involves knowing which athlete is involved. That makes it necessary to disclose the name of the suspended person. In that regard, it is apparent from the request for a preliminary ruling that, according to Paragraph 1(2)(8) of the ADBG, it may constitute an anti-doping infringement for an athlete to have contact with a member of support staff who is the subject of a prohibition or sanction.
154. That said, the unlimited scope of the publication, linked to it being placed online, seems to me to go beyond what is necessary. (95)
155. That objective of avoiding circumvention of the rules appears to apply essentially in the world of sport (96) and to those responsible for enforcing penalties or in charge of sports bodies or sports associations. A more restricted dissemination of the identity of the athlete in question would appear, in that context, to achieve the objective in an effective way that is less detrimental to the protection of personal data. Moreover, NADA explained at the hearing that, for certain categories of lower-level athletes, information about the suspension may be provided through the federations.
156. As regards economic operators or employers outside the world of sport, a more limited publication would certainly not enable them to know that the athlete in question is suspended and that they are prohibited from associating with him or her. However, if such an uninformed person were accused of associating with a suspended person (an athlete or other person), it seems to me that the rules on the burden of proof would make it possible, in that event, to ascertain whether or not that ‘association’ was conscious and intentional. (97) Conversely, publishing the suspension online, together with the name of the suspended person in question, seems to me to result in placing the onus on everyone to check whether or not the person with whom they are contracting or associating is suspended. That generalised suspicion, brought about by the online publication of the ‘sports record’, seems to me to go beyond the intended objective.
157. I would add that the choice of online publication by NADA and the ÖADR is liable to undermine further the right to privacy, in particular since the information may be accessed throughout the world. (98) That is also the opinion of the Article 29 Working Party, which highlights the risk that data published online may be used for other purposes or be further processed, both more intrusive. (99)
158. In my view, publishing the relevant name, but limited to the relevant bodies and sports federations, accompanied, for example, by pseudonymised publication on the internet, would make it possible to achieve the two objectives pursued in a way that is less prejudicial to the protection of personal data and more consistent with the principle of data minimisation.
159. I would add that the argument put forward by NADA, based on a comparison with the publication of sanctions in the context of other professions, such as lawyers or health professions, fails to convince me. As the Netherlands Government stated in that regard, publication of the names of suspended lawyers or doctors seems necessary because anyone can be a litigant or a patient, whereas, in the context of doping, it is sufficient for the name of the athlete concerned to be known in sporting circles, by the sports federations concerned, save in specific circumstances to be assessed on a case-by-case basis.
160. Consequently, I have serious doubts as to the need
for the processing at issue in the light of the objectives pursued.
–       Proportionality ‘stricto sensu’, namely balancing the interests at stake
161. In assessing the proportionality of the processing concerned, it is necessary to weigh up the various rights, freedoms or interests at stake. An objective of general interest may not be pursued without having regard to the fact that it must be reconciled with the fundamental rights affected, which implies, in the present case, properly balancing the objective of general interest pursued against the rights of the person whose personal data are disclosed. (100)
162. I would add that, in the context of the present analysis, regard should be had to the answers that the Court of Justice gives to the second question referred concerning the existence of health data within the meaning of Article 9 of the GDPR and to the fifth question referred concerning data relating to criminal convictions or offences, falling within the scope of Article 10 of the GDPR. Compliance with the principle of ‘minimisation’ of sensitive data within the meaning of Article 9 of the GDPR does not preclude personal data from being disclosed to the public where that disclosure is necessary and proportionate. (101) That is so even where the data in question are covered by Article 10 of the GDPR, provided that the legislation authorising the disclosure provides for appropriate safeguards for the rights and freedoms of data subjects. (102) That said, as regards data falling within the scope of those two provisions, the interests of the data subjects are of particular importance in balancing the interests involved. (103)
163. In the present case, the processing at issue, which includes the online publication of the identity of the athlete concerned, constitutes a significant interference with the fundamental rights to respect for private life and to the protection of personal data and is liable to provoke the disapproval of society and result in the stigmatisation of the data subject. That is, in any event, the ‘digital pillory’ effect intended.
164. The seriousness of that interference must therefore be weighed against the importance of the objectives pursued by publication.
165. I note that the referring court’s question concerns publication under
the ADBG, as implemented by NADA and the ÖADR, in respect of professional athletes not covered by the exceptions provided for (which concern amateur athletes, vulnerable persons and ‘whistleblowers’). Publication as regards
professional athletes
consists of publication by name, which is unlimited in scope, since it is disseminated to the general public via the internet, sometimes unlimited in duration, in the case of lifetime bans (which concerns one of the applicants in the main proceedings), systematic and automatic, which, under the ADBG, does not involve any individual assessment of the circumstances.
166. With all the caution that this aspect of the proportionality review always requires, (104) I am inclined to think that the combination of those various elements (reference to a name, unlimited scope, systematic and automatic nature of the publication) is liable, in certain circumstances, to result in an interference with the personal data protection rights of the individuals concerned such that it does not meet the requirements of a proper balancing of the different interests involved.
167. For example, in the case of a long suspension, (105) or even a life ban, of a little-known athlete whose professional sporting life came to an end some time ago, the lawful publication of his or her personal data could, over time, be regarded as excessive in relation to the purposes pursued.
168. NADA argues that no distinction should be made according to the seriousness or repeated nature of the infringements committed, on the ground that that is taken into account at the penalty stage and has no bearing on publication, which must take place regardless of the circumstances. I am also unconvinced by that argument. Publication meets objectives which, although they form part of combating doping, are specific and involve a balancing of the interests involved, making it possible to take into account the requirements of the GDPR, which are not considered at the stage of the anti-doping penalty.
169. Accordingly, I take the view that an obligation to publish personal data, such as that resulting from the ADBG and implemented by the ÖADR and NADA, is permissible only in so far as, having regard to the objectives of deterrence and avoidance of circumvention of the anti-doping rules, it remains proportionate, in particular as regards the scope and duration of publication, in the light of the specific circumstances at issue, which it is for the referring court to ascertain.
Context of the balancing exercise
170. The referring court asks whether the GDPR requires the controller to carry out a case-by-case balancing of the interests involved before publication or whether the proportionality test provided for by the legislator is sufficient.
171. In the present case, the legislator envisaged predefined situations irrespective of the circumstances of each individual case, referring to the elements of publication and reserving certain exceptions. In so doing, it has already provided a framework for publication and weighed up the interests of the athletes whose personal data are disclosed against the interests connected with combating doping.
172. I note, however, that, as controllers designated by the national legislature, the national anti-doping bodies at issue (here NADA and the ÖADR) remain, pursuant to Article 5(2) of the GDPR, responsible for implementing the processing and accountable for compliance with the principles of lawfulness and proportionality of that processing, as well as for compliance with the principle of minimisation. They must, moreover, be able to demonstrate that paragraph 1 of Article 5 of that provision has been complied with.
173. They are also required, under Article 24(1) and Article 25(1) of the GDPR, to implement appropriate technical and organisational measures (such as pseudonymisation), both at the time of the determination of the means of processing and at the time of the processing itself. Those measures, which are to be reviewed and updated where necessary, are designed to implement data protection principles in an effective manner and to integrate the necessary safeguards into the processing, in order to meet the requirements of the GDPR and protect the rights of data subjects. (106)
174. I note, moreover, that, in the present case, although the legislature determined the purposes of the processing and, in part, the means of that processing, it was NADA and the ÖADR which, as controllers and the bodies in charge of its implementation, opted for publication via the internet, with the ÖADR also opting for publication of the name of the prohibited substance at issue.
175. In that context, the answer to the question referred appears to me to be linked to the content and degree of precision of the national law applicable to the controller. It seems to me that the fact that the national legislature has provided for the principle of publication does not relieve the controller of its responsibility to comply with the requirements of the GDPR and to protect the rights of data subjects. That may mean that, in the application of national law, it takes account of circumstances specific to the case. (107) Moreover, I note that such a case-by-case balancing exercise is incumbent on it in the present case as regards the publication of data concerning suspended athletes covered by the exceptions mentioned in the ADBG.
176. Accordingly, I take the view that the abovementioned provisions of the GDPR, while not requiring it in every case, may require the controller to carry out a case-by-case balancing of the interests involved when determining, in particular, the means of processing, including prior to publication. In that regard, account could be taken of factors relating to the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of the data subjects, which may vary in probability and severity.
177. Neither the argument that such a margin of discretion on the part of the controller is liable to result in discrimination between athletes in comparable situations, nor the risk of arbitrariness, abuse or even corruption, referred to in particular by the Commission and NADA, can justify dispensing with such a case-by-case balancing, which is intended to process personal data in a manner consistent with the GDPR. Such a balancing exercise may in fact prevent the discrimination which might result from applying identical treatment to different situations.
178. It follows, in my view, that Articles 5 and 6 of the GDPR, read in the light of all the obligations and responsibilities incumbent on the controller, must be interpreted as not precluding a case-by-case balancing of the interests involved by the controller prior to that data processing, or even, in certain circumstances, as requiring such a balancing exercise if it is necessary in order to process personal data in a manner consistent with the GDPR.
Conclusion on the third and fourth questions
179. In the light of the foregoing, I propose that the Court of Justice reply to the third question to the effect that Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of the GDPR must be interpreted as precluding an obligation imposed on national anti-doping bodies to publish personal data, such as the names of athletes sanctioned for an infringement of the anti-doping rules, the duration of the ban imposed and the reasons for it (in particular the name of the prohibited substance) where, given the specific circumstances of the case, the requirement for proportionality is not or is no longer met, in particular as regards the scope and duration of the publication, which it is for the referring court to verify.
180. As regards the fourth question, I propose that the Court of Justice should hold that Articles 5 and 6 of the GDPR, read in the light of all the obligations and responsibilities incumbent on the controller, must be interpreted as requiring the controller to carry out, prior to the processing of data, a case-by-case balancing of the interests involved if that is necessary in order to process personal data in a manner consistent with the GDPR.
The seventh question
181. To understand the seventh question, it is necessary to recall the context in which it is asked. Even before her personal data had been published on the NADA and ÖADR websites, the applicant YT lodged a complaint with the Austrian data protection authority based on Article 17 of the GDPR, which provides for the right to erasure. The latter authority rejected YT’s complaint, as the data in question had not yet been published. Those data were subsequently published in the course of the appeal proceedings against the rejection of her complaint by the Austrian data protection authority.
182. By its seventh question, the referring court asks, first, whether a complaint under Article 77 of the GDPR concerning an alleged infringement of the right to erasure (Article 17 of the GDPR) is admissible even though the personal data relating to the data subject had not yet been processed at the time when the complaint was lodged with the supervisory authority or at the time when that authority took a decision.
183. Second, it questions the admissibility of such a complaint a posteriori if, at the time the complaint was lodged, there were already specific indications that an operation involving the processing of personal data by the controller was imminent or would take place in the near future.
Is a complaint to the supervisory authority prior to data processing admissible?
184. Article 77(1) of the GDPR provides that every data subject has the right to lodge a complaint with a supervisory authority ‘if the data subject considers that the processing of personal data relating to him or her infringes this Regulation’.
185. In accordance with the settled case-law of the Court of Justice, when interpreting that provision, I will consider not only its wording but also its context and the objectives pursued by the legislation of which it forms part. (108)
186. First, the wording of Article 77 of the GDPR does not impose a time limit for lodging a complaint regarding the processing of personal data. In cases where processing has taken place and is subsequently challenged, the sooner the complaint is lodged, the more quickly the authority can carry out checks and the sooner the data subject can be protected. (109) However, the wording of Article 77(1) of the GDPR does not provide for the situation where processing has not yet taken place. I note, in that regard, that that provision uses the word ‘infringes’ in the present tense, which seems to imply that the processing must already have taken place, but that the possibility of future processing is not, as such, excluded. (110)
187. Second, as regards the contextual element, reference should be made to the tasks and powers of the supervisory authorities. In that regard, under Article 57(1)(f) of the GDPR, each supervisory authority is required to handle complaints lodged by any data subject, to investigate, to the extent appropriate, the subject matter of the complaint and to inform the complainant of the progress and the outcome of the investigation within a reasonable period. The supervisory authority must therefore deal with such a complaint ‘with all due diligence’. (111)
188. Moreover, Article 58(1) of the GDPR gives each supervisory authority significant investigative powers for the purpose of handling complaints lodged. Where, following its investigation, such an authority finds an infringement of the provisions of that regulation, it is required to react appropriately in order to remedy the shortcoming found. To that end, Article 58(2) of the GDPR lists the various remedies that the supervisory authority may adopt, and in that regard the authority has a margin of discretion as to the choice of appropriate and necessary means. (112) The powers of the supervisory authority laid down in Article 58(2)(a) of the GDPR include the power to ‘issue warnings’ to a controller that ‘intended’ processing operations are ‘likely’ to infringe provisions of the GDPR, which forms part of an approach that may be described as ‘protective’ of the rights of the data subject. (113)
189. All those requirements and powers of the supervisory authorities are intended to strengthen the complaints procedure in order to make it a mechanism capable of effectively safeguarding the rights and interests of data subjects, or, in other words, ‘a genuine administrative remedy’. (114)
190. As regards the contextual elements, it should also be noted that, as the Commission points out, the controller must fulfil certain obligations, including informing the data subject before processing. (115)
191. It therefore seems to me that a precautionary or preventive approach by the supervisory authorities in handling complaints cannot, a priori, be ruled out in the context of the GDPR.
192. Third, that interpretation is confirmed by the objectives pursued by that regulation. It is apparent in particular from recital 10 thereof that that regulation seeks to ensure a high level of protection for natural persons with regard to the processing of personal data within the European Union. Recital 11 of that regulation states, moreover, that effective protection of such data requires the strengthening of the rights of data subjects.
193. Restricting the duty of supervisory authorities to handle complaints under Article 57(1)(f) of the GDPR by interpreting Article 77(1) of the GDPR as excluding any possibility of lodging a complaint with a supervisory authority ‘with a view to processing’ could be at odds with the objectives of the GDPR, in particular the objective of ensuring a high level of protection of natural persons with regard to the processing of personal data within the European Union.
194. I therefore consider, in the light of all those considerations, that it cannot be ruled out that a complaint made under Article 77 of the GDPR may be admissible, despite the fact that the processing of the data subject’s personal data has not yet taken place at the time the complaint is lodged with the supervisory authority.
195. However, I agree with the Commission and the Austrian Government that the alleged infringement of the GDPR must be appropriate and that the processing concerned, which in the present case is the publication of personal data, cannot be purely hypothetical. (116)
196. In the present case, the Court of Justice has received a request, based on Article 17 of the GDPR, concerning a complaint seeking the erasure of the data at issue, in which the applicant in the proceedings concerned (YT) has stated that the publication of her data was ‘almost certainly imminent’.
197. However, a complaint seeking the erasure of those data (like a request for rectification of the data) presupposes, under the assumption made, that the processing in question, in the present case the publication of the data, has taken place. It would appear to be impossible for the controller to act on such a complaint and to erase data if they have not yet been disclosed, unless the complaint is interpreted as seeking to prevent the publication of the complainant’s data (117) (and not to erase them), a matter which it is for the national court to determine.
198. I would add that such an interpretation does not run counter to the objectives of ensuring a high level of protection of personal data, since other provisions of the GDPR make it possible to respond to requests concerning future processing. As the Austrian Government states, Article 79(1) of the GDPR, concerning the right to an effective judicial remedy, implies the existence, under national law, of procedural actions in the event of a threat of imminent unlawful interference with the rights conferred by the GDPR. That includes the possibility under Austrian law of applying for injunctive relief before the start of processing or even, if processing has started, the possibility of asking the Austrian authority to review the restriction of that processing on the basis of Article 18 of the GDPR.
199. Accordingly, I take the view that it cannot be ruled out that a complaint made on the basis of Article 77 of the GDPR may be admissible, despite the fact that the processing of the data subject’s personal data has not yet taken place at the time the complaint is lodged with the supervisory authority, but is not purely hypothetical. However, in the circumstances of the dispute in the main proceedings, the complaint, based on the right to erasure provided for in Article 17 of the GDPR, is inadmissible since it concerns a processing operation (in the present case the publication of the data subject’s personal data) which, even if imminent, did not exist either at the time when that person lodged his or her complaint with the supervisory authority or at the time when the decision of that supervisory authority was adopted.
Does a complaint to the supervisory authority become admissible ‘a posteriori’?
200. I note that that question concerns the interpretation of Article 77 of the GDPR, relating to the right to lodge a complaint with the supervisory authority. It therefore seems that the referring court is asking whether such a complaint, having been declared inadmissible, could become admissible a posteriori before the supervisory authority if the processing at issue (here the disclosure of the data) takes place while an appeal against the decision of that supervisory authority is pending before the appeal court. It seems to me that, in this respect, it is for the domestic legal system to settle the question whether the appeal court could, or even should in such a situation, refer the matter back to the supervisory authority for reconsideration in the light of new facts, whether it is for the data subject to lodge a fresh complaint or whether the appeal court may itself rule on the situation before it in the light of new factual elements consisting, in the present case, in the publication of the data. In that regard, care should be taken to ensure the effective protection of the rights guaranteed by the GDPR and the consistent and homogeneous application of its provisions.
201. In so far as the question referred by the national court should be understood, as the Austrian Government understood it, as referring to the admissibility of such a complaint before the court hearing the appeal, in such a case it is necessary to examine the consequences of the effects linked to a factual change,
namely
the processing, consisting in the publication of personal data, occurring after the decision of the supervisory authority and while judicial remedy, sought on the basis of Article 78 of the GDPR, is pending against that decision, in the event that, at the time of the complaint, there were specific indications that the processing of personal data by the controller was imminent or would take place in the near future.
202. It should be remembered that, in the context of the GDPR, the EU legislator has offered different remedies to persons claiming that that regulation has been infringed, it being understood that each of those remedies must be capable of being exercised ‘without prejudice’ to the others. (118)
203. Thus, Article 78(1) of the GDPR provides that, without prejudice to any other administrative or non-judicial remedy, any natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. It follows that courts seised of an action against a decision of a supervisory authority should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them. (119) For the judicial review of a decision on a complaint taken by a supervisory authority to be ‘effective’, as required by that provision, it must be a full judicial review. (120) In addition, Article 79(1) of that regulation guarantees each data subject the right to an effective judicial remedy ‘without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77’.
204. It is true that it has previously been held that, by adopting the GDPR, the EU legislature did not intend to bring about an exhaustive harmonisation of the remedies available in respect of infringements of the provisions of the GDPR, provided for in Articles 77 to 79 of that regulation. (121) In particular, where a complaint has been made to a supervisory authority and judicial proceedings have been brought within the same Member State concerning the same instance of processing of personal data, the GDPR does not provide for specific rules.
205. However, although the EU legislature did not intend to achieve exhaustive harmonisation in that regard, it did not wish to exclude the possibility mentioned in the question referred by the national court, that is to say, to admit a posteriori a complaint lodged in circumstances such as those of the dispute in the main proceedings.
206. In the absence of EU rules governing the matter, it is therefore for each Member State, in accordance with the principle of procedural autonomy of the Member States, to lay down the detailed rules of administrative and judicial procedures intended to ensure a high level of protection of rights which individuals derive from EU law. In that context, it is for the national court to ensure the effective protection of the rights guaranteed by the GDPR and the consistent and homogeneous application of that regulation, in addition to the right to an effective remedy before a court or tribunal as referred to in Article 47 of the Charter. (122)
207. Accordingly, it is for the national court to determine, on the basis of the national procedural provisions, how the remedies provided for by the national regulations are to be implemented in each case. In that regard, it must ensure that the practical arrangements for the exercise of the remedies do not disproportionately affect the right to an effective remedy before a court or tribunal. It must also ensure the effective protection of the rights guaranteed by the GDPR, and that those arrangements comply with the principles of effectiveness and equivalence. (123)
208. In the absence of any clarification from the referring court as to the possibilities offered by its national law, it is therefore necessary, in my view, to hold that Article 77(1) of the GDPR, examined in the light of Article 78(1) of that regulation, must be interpreted as not precluding the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by the GDPR, the consistent and homogeneous application of its provisions in addition to the right to an effective remedy before a court or tribunal.
Conclusion on the seventh question
209. In the light of all the foregoing considerations, I propose that the Court of Justice should reply to the seventh question as follows: Article 77 of the GDPR must be interpreted as meaning that a complaint based on Article 17 of that regulation (alleged infringement of the right to erasure) is inadmissible where it concerns the processing by means of publication of the data subject’s personal data which, even if imminent, did not exist either at the time the complaint was lodged by that data subject with the supervisory authority, or at the time when the decision of that authority was adopted, without prejudice, however, to the possible admissibility of a complaint concerning the processing of personal data which is not purely hypothetical and which lends itself to preventive or precautionary action by the supervisory authority.
210. Furthermore, examined in the light of Article 78(1) of the GDPR, Article 77 of the same regulation does not preclude the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by the GDPR, the consistent and homogeneous application of its provisions,
in addition to the right to an effective remedy before a court or tribunal.
Conclusion
211. In the light of the foregoing, I propose that the Court of Justice reply as follows to the questions referred for a preliminary ruling by the Bundesverwaltungsgericht (Federal Administrative Court, Austria):
(1)      The first sentence of Article 16(2) TFEU and Article 2(2)(a) of Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC,
must be interpreted as meaning that
the processing of personal data consisting, pursuant to national anti-doping rules, in the publication of the names of the athletes concerned, the sport they practise, the infringement of the anti-doping rules they have committed, the penalty imposed on them and the start and end dates of that penalty, cannot be regarded as part of an ‘activity which falls outside the scope of Union law’ within the meaning of Article 2(2)(a) of
Regulation 2016/679.
(2)      Article 9(1) of Regulation 2016/679
must be interpreted as meaning that
disclosing the name of the athlete concerned, the duration of his or her suspension and the grounds for that suspension does not constitute processing of data concerning health, within the meaning of that provision,
unless those grounds include the name of the prohibited substance or substances found to be present in the body of the athlete in question, where that indication is capable of revealing, even indirectly, information on the health status, including the future health status, of the athlete concerned, a matter which it is for the referring court to ascertain.
(3)      Article 5(1)(a) and (c) and the second subparagraph of Article 6(3) of Regulation 2016/679
must be interpreted as
precluding an obligation imposed on national anti-doping bodies to publish personal data, such as the names of athletes sanctioned for an infringement of the anti-doping rules, the duration of the ban imposed and the reasons for it (in particular the name of the prohibited substance) where, given the specific circumstances of the case, the requirement for proportionality is not or is no longer met, in particular as regards the scope and duration of the publication, a matter which it is for the referring court to ascertain.
(4)      Articles 5 and 6 of Regulation 2016/679, read in the light of all the obligations and responsibilities incumbent on the controller,
must be interpreted as
requiring the controller to carry out, prior to the processing of data, a case-by-case balancing of the interests involved if that is necessary in order to process personal data in a manner consistent with Regulation 2016/679.
(5)      Article 10 of Regulation 2016/679
must be interpreted as meaning that
it may apply to the processing of personal data relating to convictions or offences under national anti-doping regulations, where, irrespective of the classification of those offences under national law, the convictions which they involve have a punitive purpose and have a degree of severity such that they have an effect equivalent to a criminal penalty, a matter which it is for the referring court to ascertain.
(6)      Article 10 of Regulation 2016/679, read in the light of Article 79(1) of that regulation,
must be interpreted as meaning that
it must be possible for the activities or decisions of an authority which has been given responsibility under that provision for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures to be subject to judicial review.
(7)      Article 77 of Regulation 2016/679
must be interpreted as meaning that:
–        a complaint based on Article 17 of Regulation 2016/679 (alleged infringement of the right to erasure) is inadmissible where it concerns the processing by means of publication of the data subject’s personal data which, even if imminent, did not exist either at the time the complaint was lodged by that data subject with the supervisory authority, or at the time when the decision of that authority was adopted, without prejudice, however, to the possible admissibility of a complaint concerning the processing of personal data which is not purely hypothetical and which lends itself to preventive or precautionary action by the supervisory authority;
–        examined in the light of Article 78(1) of Regulation 2016/679, it does not preclude the admissibility of a complaint previously rejected as inadmissible by the supervisory authority, where the data processing takes place while judicial proceedings relating to the same facts are pending before the court. It is for the domestic legal system to regulate, in compliance with the principles of equivalence and effectiveness, the conditions for such admissibility, both before the supervisory authority and before the courts, so as to ensure the effective protection of the rights guaranteed by Regulation 2016/679, the consistent and homogeneous application of its provisions,
in addition to the right to an effective remedy before a court or tribunal.
1      Original language: French.
2      Signed in Paris on 19 October 2005 and in force since 1 February 2007.
3      See, with regard to the interaction between the different normative layers, Rigaux, F., ‘Les situations juridiques individuelles dans un système de relativité générale: cours général de droit international privé’, Recueil des cours de l’Académie de droit international de La Haye, Vol. 213, 1989, in particular pp. 67-68. See, in particular on anti-doping regulations, Diakité, A., La mise en oeuvre du Code mondial antidopage par les Etats, Bruylant, Brussels, 2023, paragraphs 127 et seq.
4      See, for example, judgments of 12 December 1974, Walrave and Koch, 36/74, EU:C:1974:140, and of 21 December 2023, European Superleague Company, C‑333/21, ‘the judgment in European Superleague Company’, EU:C:2023:1011.
5      The first NADA case was declared inadmissible by judgment of 7 May 2024, NADA and Others, C‑115/22, EU:C:2024:384. See, however, the Opinion of Advocate General Ćapeta in that case, C‑115/22, EU:C:2023:676.
6      Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).
7      Regarding the adoption of a new code, planned for 2027 (see the WADA website, available at the following address: https://www.wada-ama.org/en/what-we-do/world-anti-doping-code/code-review), see Recommendation 1/2025, adopted on 11 February 2025 by the European Data Protection Board (EDPB), published on the EDPB website and available at the following address: https://www.edpb.europa.eu/system/files/2025-02/edpb_recommendations_202501_wada_2027_world_anti-doping_code_en.pdf.
8      Case C‑115/22, OJ 2022 C 207, pp. 15-16.
9      The judgment in NADA and Others, C‑115/22, EU:C:2024:384.
10      Directive of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ 2016 L 119, p. 89).
11      See judgment of 6 November 2003, Lindqvist, C‑101/01, ‘the judgment in Lindqvist’, EU:C:2003:596, paragraphs 25 and 26.
12      See, to that effect, judgments of 22 June 2021, Latvijas Republikas Saeima (Penalty points), C‑439/19, ‘the judgment in Latvijas Republikas Saeima’, EU:C:2021:504, paragraph 62 and the case-law cited; of 20 October 2022, Koalitsia ‘Demokratichna Bulgaria – Obedinenie’,
C‑306/21, EU:C:2022:813, paragraph 35; and of 16 January 2024, Österreichische Datenschutzbehörde, C‑33/22, ‘the judgment in Österreichische Datenschutzbehörde’, EU:C:2024:46, paragraph 37.
13      See the judgment in Latvijas Republikas Saeima, paragraphs 66 and 67. See also, mutatis mutandis, in the context of Directive
2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), judgments of 6 October 2020, La Quadrature du Net and Others, C‑511/18, C‑512/18 and C‑520/18, EU:C:2020:791, paragraph 135, and of 5 April 2022, Commissioner of An Garda Síochána and Others, C‑140/20, EU:C:2022:258, paragraph 61, which refer to ‘activities capable of seriously destabilising the fundamental constitutional, political, economic or social structures of a country and, in particular, of directly threatening society, the population or the State itself, such as terrorist activities’.
14      See the judgment in Österreichische Datenschutzbehörde, paragraph 41, and the Opinion of Advocate General Szpunar in that case, C‑33/22, EU:C:2023:397, point 84.
15      See judgment of 9 July 2020, Land Hessen, C‑272/19, EU:C:2020:535: it concerned the activities of both a political and administrative nature of the Petitions Committee of the Hessischer Landtag (Hessen State Parliament, Germany), which were of a public nature and were activities of that State, since that committee contributed indirectly to parliamentary activity.
16      See the judgment in Österreichische Datenschutzbehörde, paragraph 51.
17      See judgment of 16 July 2020, Facebook Ireland and Schrems, C‑311/18, EU:C:2020:559, paragraph 88.
18      See judgment of 30 April 2025, Inspektorat kam Visshia sadeben savet, C‑313/23, C‑316/23 and C‑332/23, EU:C:2025:303, paragraph 104.
19      As formulated by Advocate General Szpunar in his Opinion in
Österreichische Datenschutzbehörde, C‑33/22, EU:C:2023:397, point 68.
20      See the Opinions of Advocate General Szpunar in Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2020:1054, points 50 to 59, and in Österreichische Datenschutzbehörde, C‑33/22, EU:C:2023:397, point 78.
21      See Lenaerts, K., ‘L’encadrement par le droit de l'Union européenne des compétences des États membres’, in Chemins d’Europe: mélanges en l’honneur de Jean-Paul Jacqué, Dalloz, Paris, 2010, p. 424, paragraph 7. See also Cariat, N. and Dermine, P., ‘La détermination de l’applicabilité du droit de l’Union européenne à une situation particulière’, in Le droit de l’Union européenne et le juge belge / Het recht van de Europese Unie en de Belgische rechter, Bruylant, Brussels, 2015, pp. 85-114; and Azoulai, L., ‘La formule des compétences retenues des États membres devant la Cour de justice de l’Union européenne’, in Objectifs et compétences dans l’Union européenne, Bruylant, Brussels, 2012, pp. 341-368, in particular p. 343.
22      See, in that regard, the judgment in European Superleague Company, paragraph 99, and the judgment of 21 December 2023, Royal Antwerp Football Club, C‑680/21, EU:C:2023:1010, paragraph 67. See also the Opinion of Advocate General Emiliou in RRC Sports, C‑209/23, EU:C:2025:362, points 22 to 28.
23      See the judgment in European Superleague Company, paragraph 99. See, for example, the Resolution of the Council and of the Representatives of the Governments of the Member States meeting within the Council on the European Union Work Plan for Sport (1 July 2024 – 31 December 2027) (OJ/C, 2024/3527).
24      36/74, EU:C:1974:140, paragraph 4. See also the judgment of 15 December 1995, Bosman, C‑415/93, EU:C:1995:463, paragraph 73. For an updated formulation, see judgment of 4 October 2024, FIFA, C‑650/22, EU:C:2024:824, paragraph 75 and the case-law cited.
25      See, mutatis mutandis, judgment of 20 May 2003, Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01, EU:C:2003:294, paragraph 42, and the judgment in Lindqvist, paragraph 40 et seq.
26      See judgment of 18 July 2006, Meca-Medina and Majcen v Commission, C‑519/04 P, ‘the judgment in Meca-Medina and Majcen v Commission’, EU:C:2006:492, paragraph 47. For amateur athletes, EU law can also be applied through citizenship (see judgment of 13 June 2019, TopFit and Biffi, C‑22/18, EU:C:2019:497).
27      Moreover, this concept does not necessarily have the same meaning in all Member States, with the result that, in the event of differences of interpretation, the scope of the GDPR would depend on national law.
28      See, however, on the differences in nature, scope and regimes between the right to respect for private life and the protection of personal data, Tambou, O. ‘Chapter 1. Droit autonome du droit au respect de la vie privée’, in Manuel de droit européen de la protection des données à caractère personnel, Bruylant, Brussels, 2020 (1st ed.), p. 21 et seq. As regards Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950 (‘the ECHR’), see, in particular, the judgment of 5 October 1994, X v Commission, C‑404/92 P, EU:C:1994:361, paragraph 23, and the judgment of the ECtHR of 25 February 1997,
Z v. Finland, CE:ECHR:1997:0225JUD002200993, § 95.
29      The wording refers, for example, to the risk of discrimination. Thus, a
poor state of health is likely to result in discrimination in relation to access to employment, insurance or credit.
30      Although not directly at issue in the present case, data concerning health relating to connected applications and devices may help to define the parameters of the term ‘health data’. For example, there are questions as to whether or not ‘wellbeing data’ or ‘self-measures’ (relating to heart rate, sleep patterns, diet, consumption patterns contained in supermarket cards, and so forth) constitute ‘health data’. For example, the number of daily steps is not in itself health data, but it may become so if those raw data are combined with other data and a conclusion may be drawn from them about a person’s state of health or risk to health (see, to that effect, the annex entitled ‘Health data in apps and devices’ to the letter of the Article 29 Working Party to the Commission’s DG Connect on mHealth, of 5 February 2015, p. 2, available at the following address: https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf).
Among many other publications concerning the Internet of Things (IoT), see Casarosa, F. and Gennari, F., ‘Data sharing in the internet of medical things – Between the data act and the EHDS’, European Journal of Risk Regulation, Cambridge University Press, Cambridge, 2025, pp. 1-23; see also Yaşar, B., ‘I can feel your heartbeat: E-health evidence in criminal investigations’, Shaping Utopia through law:
How the law does (not) provide an answer to societal challenges, Intersentia, Brussels, 2023 (1st ed.), pp. 43-68, in particular p. 57, point 4.2.1.
31      See judgments of 4 October 2024, Schrems (Communication of data to the general public),
C‑446/21, EU:C:2024:834, paragraph 73 and the case-law cited, and of 4 October 2024, Lindenapotheke, C‑21/23, ‘the judgment in Lindenapotheke’, EU:C:2024:846, paragraph 87.
32      See, to that effect, the judgment in Lindenapotheke, paragraph 92. Particularly relevant to the present case are the exemptions set out in Article 9(2)(g) and (i) of the GDPR, which provide that the processing of sensitive data is possible if it is ‘necessary for reasons of substantial public interest’ or ‘for reasons of public interest in the area of public health’, subject to proportionality.
33      Article 6 of the Council of Europe’s ‘Modernised Convention’ for the Protection of Individuals with regard to Automatic Processing of Personal Data (known as ‘Convention
108 +’) of 18 May 2018 also uses the same term and provides, under special categories of data, for ‘personal data for the information they reveal relating to … health …’.
34      See the judgment in Lindqvist, paragraph 50 and the judgment in Lindenapotheke, paragraph 81.
35      See judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C‑184/20, ‘the judgment in Vyriausioji tarnybinės etikos komisija’, EU:C:2022:601, paragraphs 123 to 127, and the judgment in Lindenapotheke, paragraph 83. Such a broad approach to the definition could be due to the desire to ‘counter potential effects of big data technologies that could acquire much knowledge on a person[’s] health by processing data, which merely reveal something about the health status’ (see Verhenneman, G., ‘Chapter III. – Understanding the subject of protection’, in The Patient, Data Protection and Changing Healthcare Models, 1st ed., Intersentia, Brussels, 2021, p. 97 et seq., in particular p. 109).
36      See Maisnier-Broché, L., ‘Fasc. 945: Données de santé à caractère personnel. – Régime général’, JurisClasseur Communication, 2019.
37      See Herveg, J. and Van Gyshesemm, J.-M., ‘Titre 16 – L’impact du Règlement général sur la protection des données dans le secteur de la santé’, in Le règlement général sur la protection des données (RGPD/GDPR), 1st ed., Larcier, Brussels, 2018, p. 722.
38      See, by analogy, the Working Document on the processing of personal data relating to health in electronic health records (EHR) (Article 29 Working Party, 15 February 2007, WP 131, section
II.2), available at the following address: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2007/wp131_en.pdf.
39      See the annex entitled ‘Health data in apps and devices’ to the letter from the Article 29 Working Party to the Commission’s DG Connect on mHealth, of 5 February 2015, p. 2, available at the following address: https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf.
40      See, in particular, Guidelines
03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak, adopted by the EDPB on 21 April 2020, section 3.1, available at the following address: https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202003_healthdatascientificresearchcovid19_en.pdf.
41      Schäfke-Zell, W., ‘Revisiting the definition of health data in the age of digitalized health care’, International Data Privacy Law, Oxford University Press, Oxford, Vol. 12, No 1, 2022, pp. 33-43.
42      See Opinion of Advocate General Szpunar in Lindenapotheke,
C‑21/23, EU:C:2024:354, point 47.
43      See the annex entitled ‘Health data in apps and devices’ to the letter from the Article 29 Working Party to the Commission’s DG Connect on mHealth, of 5 February 2015, p. 2, available at the following address: https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf. See also, on the present question, Verhenneman, G., ‘Chapter III. – Understanding the subject of protection’, in The Patient, Data Protection and Changing Healthcare Models, Intersentia, Brussels, 2021 (1st ed.), p. 97 et seq. It should be noted that even an uncertain link can be taken into account (see Mascret, C., ‘Arrêt “Lindenapotheke”: vers une protection renforcée des données de santé et une ouverture des voies de recours en matière de protection des données (CJUE, 4 octobre 2024, C‑21/23)’, Journal de droit européen, 2025/1, pp. 17-20).
44      See the annex entitled ‘Health data in apps and devices’ to the letter from the Article 29 Working Party to the Commission’s DG Connect on mHealth, of 5 February 2015, p. 2, available at the following address: https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf. See also, on the distinction between consumption habits and addiction, Borges, G., ‘Der Mann mit der Brille und die DSGVO – Der Begriff des Gesundheitsdatums’, Rechtswissenschaft, Vol. 14, No 2, 2023, in particular pp. 172-173.
45      See, in that respect, the annex entitled ‘Health data in apps and devices’ to the letter from the Article 29 Working Party to the Commission’s DG Connect on mHealth, of 5 February 2015, p. 2 and footnote 5, available at the following address: https://ec.europa.eu/justice/article-29/documentation/other-document/files/2015/20150205_letter_art29wp_ec_health_data_after_plenary_annex_en.pdf. Similarly, supermarket shopping habits are not in themselves health data, but may become so if combined and analysed with a view to monitoring conditions such as obesity or diabetes.
46      The provision that disclosure is to be made ‘but not in such a way as to make it possible to infer data concerning the health of the data subject’ is not sufficient to rule out the relevance of the question raised
in the present case. Indeed, it seems to me that that observation refers to cases where a Therapeutic Use Exemption is granted (allowing, under certain conditions, an athlete suffering from a medical condition to use a prohibited substance or a prohibited method, without that information being made public and without the athlete being in breach of the relevant rule) or to details of test results, which are not at issue here.
47      The list of those categories of infringement, numbered 2.1 to 2.11, may be found on the NADA website and in the Code. In summary, the infringements that fall within category 2.1 are the presence of a prohibited substance or its metabolites or markers in an athlete’s sample; 2.2 the use or attempted use by an athlete of a prohibited substance or a prohibited method; 2.3 evading, refusing or failing to submit to sample collection by an athlete; 2.4 whereabouts failures by an athlete; 2.5 tampering or attempted tampering with any part of doping control by an athlete or other person; 2.6 possession of a prohibited substance or a prohibited method by an athlete or athlete support person; 2.7 trafficking or attempted trafficking in any prohibited substance or prohibited method by an athlete or other person; 2.8 administration or attempted administration by an athlete or other person to an athlete in-competition of any prohibited substance or prohibited method, or administration or attempted administration to any athlete out-of-competition of any prohibited substance or any prohibited method that is prohibited out-of-competition; 2.9 complicity or attempted complicity by an athlete or other person; 2.10 prohibited association by an athlete or other person; and 2.11 acts by an athlete or other person to discourage or retaliate against reporting to authorities.
48      Article 6.1 of the Code provides for the use of accredited or approved laboratories.
49      See point 63 of the present Opinion.
50      In addition to Article 165 TFEU and numerous international texts, see ECtHR, 18 January 2018, National Federation of Sportpersons’ Associations and Unions (FNASS) and Others v. France (CE:ECHR:2018:0118JUD004815111, § 165), and the judgment in Meca-Medina and Majcen v Commission, paragraph 43.
51      See, in that regard, Article 4.3 of the Code concerning the criteria for including substances and methods on the prohibited list, which refer in particular to medical or scientific evidence showing that ‘the use of the substance or method represents an actual or potential health risk to the athlete’. See, also, by way of example, the effects on health of substances prohibited in sport listed in ‘Vidal’, an information tool on health products whose database is approved by the French Haute Autorité de Santé (French National Authority for Health; ‘HAS’)
(Les substances interdites dans la pratique sportive – VIDAL, available at the following address: https://www.vidal.fr/sante/sport/sport-medicaments/sport-dopage-substances-interdites/tous-sports.html).
52      See the judgment in Latvijas Republikas Saeima, paragraph 100, and the judgment of 7 March 2024, Endemol Shine Finland, C‑740/22, EU:C:2024:216, paragraph 49. See, by analogy, in the context of Article 8(5) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31), judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773.
53      See the judgment in Latvijas Republikas Saeima, paragraphs 77 to 79, following, in that respect, the Opinion of Advocate General Szpunar in Latvijas Republikas Saeima (Penalty points), C‑439/19, EU:C:2020:1054, points 74 to 78.
54      It should be remembered that the processing of personal data for such purposes by ‘competent authorities’ within the meaning of Directive
2016/680 falls within the scope of that directive as a lex specialis (see point 34 of the present Opinion) and not that of the GDPR, as a lex generalis. However, where the processing is carried out by private bodies (or by competent authorities, but for purposes other than those set out in Directive 2016/680), the GDPR, and in particular Article 10 thereof, may apply.
55      See recital 19 of the GDPR.
56      Criteria so named by reference to the judgment in which they were first set out by the European Court of Human Rights: ECtHR, 8 June 1976, Engel and Others v. the Netherlands, CE:ECHR:1976:0608JUD000510071, § 82. Those criteria were adopted by the Court of Justice in particular in the judgment of 5 June 2012, Bonda, C‑489/10, EU:C:2012:319, paragraph 37 et seq. See also the judgment in Latvijas Republikas Saeima, paragraphs 85 and 87, and the case-law cited.
57      See judgments of 20 March 2018, Menci, C‑524/15, EU:C:2018:197, paragraph 27, and of 14 September 2023, Volkswagen Group Italia and Volkswagen Aktiengesellschaft, C‑27/22, EU:C:2023:663, paragraph 46.
58      By joining sports organisations and taking part in sporting events and competitions, professional athletes undertake (contractually or by giving their consent) not to engage in doping practices.
59      See the judgment in Latvijas Republikas Saeima,
paragraph 88 and the case-law cited.
60      In addition to international and national sports federations, there are the competent bodies designated at national level, including the ‘National Anti-Doping Organisations’ (‘NADOs’), which are the entities designated by each country as the main authorities responsible for anti-doping programmes at national level, listed on the WADA website (see NADO Program, available at the following address: https://www.wada-ama.org/en/nado-program).
61      See Directorate-General for Education, Youth, Sport and Culture (European Commission), van der Sloot, B., Paun, M., Leenes, R., et al., Anti-doping & Data Protection:
An evaluation of the anti-doping laws and practices in the EU Member States in light of the General Data Protection Regulation, Publications Office of the European Union, 2017, in particular p. 58, available at the following address: https://data.europa.eu/doi/10.2766/042641.
62      See the judgment of 20 March 2018, Garlsson Real Estate and Others, C‑537/16, EU:C:2018:193, paragraph 33; the judgment in Latvijas Republikas Saeima, paragraph 89; the judgments of 23 March 2023, Dual Prod, C‑412/21, EU:C:2023:234, paragraph 30; of 4 May 2023, MV – 98, C‑97/21, EU:C:2023:371, paragraph 42, and of 14 September 2023, Vinal, C‑820/21, EU:C:2023:667, paragraph 50.
63      See Diakité, A., ‘Chapitre 2. La mise en œuvre des sanctions applicables aux athlètes à l’épreuve du respect des droits fondamentaux’, in La mise en œuvre du Code mondial antidopage par les États, 1st ed., Bruylant, Brussels, 2023, paragraph 1145; and Rouiller, C., ‘Legal Opinion on whether Article 10.2 (Sanctions on Individuals) of the World Anti-Doping Code is compatible with the Fundamental Principles of Swiss Domestic Law’, 25 October 2005, p. 20 et seq. (available at the following address: https://www.wada-ama.org/sites/default/files/resources/files/Article_10_2_WADC_Swiss_Law.pdf).
64      See, to that effect, the case-law of the ECtHR, which takes into account the objective (whether punitive or compensatory) of the penalty incurred (ECtHR, 23 November 2006, Jussila v. Finland,
CE:ECHR:2006:1123JUD007305301, § 38).
65      See, to that effect, Diakité, A., ‘Chapitre
2. La mise en oeuvre des sanctions applicables aux athlètes à l’épreuve du respect des droits fondamentaux’, in La mise en œuvre du Code mondial antidopage par les États, 1st ed., Bruylant, Brussels, 2023, p. 501 et seq., in particular paragraph 1143.
66      For a summary of the relevant case-law, see ECtHR, 6 November 2018, Ramos Nunes de Carvalho e Sá v. Portugal, CE:ECHR:2018:1106JUD005539113, § 123, and 5 March 2020, Peleki v. Greece, CE:ECHR:2020:0305JUD006929112, § 35. See also, in that regard, the opinion on the World Anti-Doping Code (draft Code 2021) of 26 September 2019 by the former President of the Court of Human Rights, Costa, J.-P., in particular p. 5 et seq., available at the following address: https://www.wada-ama.org/en/resources/legal-opinion-2021-code-judge-jean-paul-costa.
67      The offences against military discipline at issue in Engel, involving committal to a disciplinary unit for a period of a few months, were considered to fall within the criminal head of Article 6 ECHR (ECtHR, 8 June 1976, Engel and Others v. the Netherlands, CE:ECHR:1976:0608JUD000510071, § 85).
68      For the applicability of Article 6 ECHR, under its civil head, to disciplinary proceedings before corporate bodies in which the right to practise a profession is directly at stake, see ECtHR, 22 July 2021, Reczkowicz v. Poland, CE:ECHR:2021:0722JUD004344719, § 183 to § 185 and the case-law cited, concerning judges and lawyers; ECtHR, 23 June 1981, Le Compte, Van Leuven and De Meyere v. Belgium, CE:ECHR:1981:0623JUD000687875, § 41 to § 51, concerning doctors; ECtHR, 27 June 1997, Philis v. Greece (No 2), CE:ECHR:1997:0627JUD001977392, § 45, concerning an engineer, and ECtHR, 5 March 2020, Peleki v. Greece, CE:ECHR:2020:0305JUD006929112, § 39, concerning a notary.
69      See ECtHR, 2 October 2018, Mutu and Pechstein v. Switzerland, CE:ECHR:2018:1002JUD004057510; ECtHR, 3 September 2019, Bakker v. Switzerland, CE:ECHR:2019:0903DEC000719807; ECtHR, 28 January 2020, Ali Rıza and Others v. Turkey, CE:ECHR:2020:0128JUD003022610, § 153 to § 161; ECtHR, 18 May 2021, Sedat Doğan v. Turkey, CE:ECHR:2021:0518JUD004890914, § 20; and ECtHR, 18 May 2021, Naki and AMED Sportif Faaliyetler Kulübü Derneği v. Turkey, CE:ECHR:2021:0518JUD004892416, § 20. See also, very recently, ECtHR, 10 July 2025, Semenya v. Switzerland, CE:ECHR:2025:0710JUD001093421, in particular § 161.
70      See ECtHR, 10 February 1983, Albert and Le Compte v. Belgium, CE:ECHR:1983:0210JUD000729975, § 30 and the case-law cited; ECtHR, 6 November 2018, Ramos Nunes de Carvalho e Sá v. Portugal, CE:ECHR:2018:1106JUD005539113, § 121; and
ECtHR,
1 June 2023, Grosam v. the Czech Republic, CE:ECHR:2023:0601JUD001975013, § 112.
71      See ECtHR, 22 December 2020, Gestur Jónsson and Ragnar Halldór Hall v. Iceland, CE:ECHR:2020:1222JUD006827314, § 93.
72      Conversely, the fact that a rule penalising a specific offence is directed towards all citizens argues in favour of the criminal nature of the penalty (see ECtHR, 21 February 1984, Öztürk v. Germany, CE:ECHR:1984:0221JUD000854479, § 53).
73      See ECtHR, 6 November 2018, Ramos Nunes de Carvalho e Sá v. Portugal, CE:ECHR:2018:1106JUD005539113, § 125.
74      It is also distinguishable from the facts at issue in the judgment of 20 March 2018, Garlsson Real Estate and Others, C‑537/16, EU:C:2018:193, in which the administrative fine for unlawful conduct consisting in market manipulation was based on legislation of general application.
75      See point 100 of the present Opinion.
76      Court of Arbitration for Sport, 9 August 1999, No 98/222, B. / International Triathlon Union (ITU), available at the following address: https://jurisprudence.tas-cas.org/Shared%20Documents/222.pdf. See also, in that respect, Soek, J., The Strict Liability Principle and the Human Rights of the Athlete in Doping Cases, T.M.C. Asser Press, The Hague, 2006, in particular p. 272, which notes that even if the disciplinary anti-doping law applied by sports federations and organisations is not in itself criminal law, it can in certain cases be classified as a ‘punitive system’ in the context of which criminal law principles are intended to apply.
77      See ECtHR, 5 March 2020, Peleki v. Greece, CE:ECHR:2020:0305JUD006929112, § 36 and the case-law cited.
78      See judgment of 4 May 2023, MV – 98, C‑97/21, EU:C:2023:371, paragraph 46, and ECtHR, 9 October 2003, Ezeh and Connors v. the United Kingdom, CE:ECHR:2003:1009JUD003966598, § 120.
79      On the system of penalties, see Article 10 of the Code. See also Soek, J., The Strict Liability Principle and the Human Rights of the Athlete in Doping Cases, T.M.C. Asser Press, The Hague, 2006, in particular p. 195 et seq.
80      See ECtHR, 22 December 2020,
Gestur Jónsson and Ragnar Halldór Hall v. Iceland, CE:ECHR:2020:1222JUD006827314, § 78, concerning errors made by legal professionals at a hearing.
81      In the present case, the supervisory authority within the meaning of that provision is the Austrian data protection authority.
82      For a case in which the question arises as to whether or not national law on conditions for access to criminal records offers sufficient guarantees, see Commission v Hungary (Values of the Union) (C‑769/22, 2023/C 54/19) (OJ 2023 C 54, p. 16), pending at the time of writing, and the Opinion of Advocate General Ćapeta of 5 June 2025 in that case (EU:C:2025:408, in particular points 356 to 359).
83      See points 132 to 180 of the present Opinion.
84      See the judgment in Latvijas Republikas Saeima, paragraphs 74 and 75.
85      See Paragraph 5(6)(4) of the ADBG.
86      See the judgment in Vyriausioji tarnybinės etikos komisija, paragraph 70 and the case-law cited.
87      NADA and the ÖADR are required to publish the information in question in accordance with Paragraph 5(6)(4) and Paragraph 21(3) of the ADBG, respectively.
88      That point is not at issue here, and the existence of a task carried out in the public interest seems to me to be beyond doubt in the light of the general interest pursued by anti-doping regulations (see the judgment in Meca-Medina and Majcen v Commission, paragraph 43).
89      The same processing operation may satisfy several grounds for legitimate processing (see judgment of 3 April 2025, Ministerstvo zdravotnictví (Data concerning the representative of a legal person), C‑710/23, EU:C:2025:231, paragraph 42) and only one of those legitimate grounds is sufficient (see the judgment in Vyriausioji tarnybinės etikos komisija, paragraph 71), and the judgment of 12 September 2024, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV, C‑17/22 and C‑18/22, EU:C:2024:738, paragraph 38).
90      See the judgment in Latvijas Republikas Saeima, paragraph 98 and the case-law cited.
91      Those two aims correspond, moreover, to those referred to by WADA in the context of its dialogue with the Article 29 Working Party and which were included in the Second opinion
4/2009, adopted on 6
April 2009, on the World Anti-Doping Agency (WADA) International Standard for the Protection of Privacy and Personal Information, on related provisions of the WADA Code and on other privacy issues in the context of the fight against doping in sport by WADA and (national) anti-doping organizations (point 3.6 on sanctions) (‘Opinion 4/2009’).
92      According to Paragraph 1(2)(8) of the ADBG, it may constitute an anti-doping offence for an athlete to have contact with an
athlete support person who is the subject of a prohibition or sanction.
93      See, in that respect, the judgment in Latvijas Republikas Saeima, paragraphs 109 and 110.
94      See, in that regard, judgment of 22 November 2022, Luxembourg Business Registers, C‑37/20 and C‑601/20, EU:C:2022:912, paragraph 42.
95      In that regard, see also the reservations of the Article 29 Working Party set out in Opinion
4/2009, point 3.6.1. It is also interesting to note that, although Article 14.2.4 of the Code provided, in its 2009 version, that publication was to be carried out as a minimum by placing the required information on the anti-doping organisation’s website for at least one year, that requirement for publication via the internet nevertheless disappeared in subsequent versions of the Code. I would add that, in Germany, the anti-doping organisation publishes the information in an internal printed medium (see NADA Germany’s website, available at the following address: https://www.nada.de/service/news/newsdetail/veroeffentlichung-von-sanktionsentscheidungen).
96      According to Article 2.10 of the Code and the accompanying commentary in footnote 15, it seems that it is primarily a matter of ensuring that athletes (and other persons) do not work with ‘coaches, trainers, physicians or other athlete support personnel who are ineligible on account of an anti-doping rule
violation or who have been criminally convicted or professionally disciplined in relation to doping. This also prohibits association with any other athlete who is acting as a coach or athlete support person while serving a period of ineligibility.’
97      I would also point out that, according to the Code, in order to establish an
infringement of the prohibition of association with a suspended person, it is the anti-doping organisation which must establish that the athlete or other person knew of the athlete support person’s disqualifying status (Article 2.10.2 of the Code).
98      See the judgment in Vyriausioji tarnybinės etikos komisija (paragraph 102), which takes into account the fact that public disclosure online has the effect of making the personal data at issue freely accessible on the internet to the whole of the general public and, accordingly, to a potentially unlimited number of persons. The Strasbourg Court also has regard to the type of medium used when disclosing personal data, and dissemination on the internet has been deemed particularly risky in that respect (ECtHR, 9 March 2023, L.B. v. Hungary, CE:ECHR:2023:0309JUD003634516, § 121).
99      See Opinion
4/2009 (points 3.6.1 and 3.6.2 on sanctions).
100      See, to that effect, the judgment in Vyriausioji tarnybinės etikos komisija, paragraph 98 and the case-law cited.
101      See Article 9(2)(g) of the GDPR.
102      See judgment of 24 September 2019, GC and Others (De-referencing of sensitive data), C‑136/17, EU:C:2019:773, paragraph 73, and the judgment in Latvijas Republikas Saeima, paragraph 104.
103      The proportionality test takes account in particular of the fact that the data are considered to be sensitive (see judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C‑708/18, EU:C:2019:1064, paragraph 57, and the judgment in Vyriausioji tarnybinės etikos komisija, paragraph 99).
104      See the Opinion of Advocate General Cruz Villalón in Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2013:845, point 149, concerning, in a different legal context, the proportionality of the data retention period.
105      See, in that regard, Dellaux, J., ‘La réglementation de la lutte contre le dopage à l’aune de la jurisprudence de la Cour européenne des droits de l’homme, ou quand la pratique sportive justifie des restrictions importantes au droit au respect de la vie privée’, Revue trimestrielle des droits de l'homme, Anthémis, No 116, 2018, in particular pp. 899-900.
106      See Delforges, A., ‘Titre 8 – Les obligations générales du responsable du traitement et la place du sous-traitant’, in Le règlement général sur la protection des données (RGPD/GDPR), 1st ed., Larcier, Brussels, 2018, pp. 371-406.
107      In that respect, see Opinion
4/2009 (point 3.6 on sanctions), which recommends, for example, taking into account in particular the severity of the infringement of the anti-doping rules, the number of infringements, the level at which the athlete competes and whether the case has already received media attention.
108      See judgments of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság, C‑132/21, ‘the judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság’, EU:C:2023:2, paragraph 32, and of 9 January 2025, Österreichische Datenschutzbehörde (Excessive requests), C‑416/23, EU:C:2025:3, paragraph 24.
109      See, to that effect, Spiecker gen. Döhmann, I. et al., General Data Protection Regulation: Article-by-Article Commentary, Nomos – Beck – Hart, 2023, in particular pp. 1010-1017.
110      Admittedly, as the Republic of Austria and the Republic of Finland point out, paragraph 47 of the judgment in Lindenapotheke states that ‘Chapter
VIII of the GDPR governs, inter alia, the legal remedies enabling the protection of the data subject’s rights where his or her personal data have been the subject of processing that is allegedly contrary to the provisions of that regulation’ (emphasis added). That said, the words ‘inter alia’ lead me to qualify that argument, particularly since the question of the processing that had not yet taken place was in no way at issue in that case.
111      See judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, ‘the judgment in SCHUFA Holding’, EU:C:2023:958, paragraph 56 and the case-law cited.
112      See the judgment in SCHUFA Holding, paragraph 68 and the case-law cited.
113      See
also judgment of 4 September 2025,
Quirin Privatbank, C‑655/23, EU:C:2025:655, paragraphs 43 to 50, concerning the right to prevent the recurrence of unlawful processing of personal data. See also the request for a preliminary ruling from the Oberlandsgericht Wien (Austria) in CRIF (C‑40/25), pending at the time of writing, concerning the possibility of requiring the controller to refrain from any further unlawful transfer of personal data.
114      See the judgment in SCHUFA Holding,
paragraph 58, and the judgment of 26 September 2024, Land Hessen (Obligation to act by the data protection authority),
C‑768/21, EU:C:2024:785, paragraph 35. See also the Opinion of Advocate General Pikamäe in SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:222, point 40.
115      See, in the comparable context of Directive
2016/680, judgment of 4 October 2024, Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile phone), C‑548/21, EU:C:2024:830, paragraphs 69 to 77, where the Court of Justice held that a processing attempt is already data processing.
116      See, to that effect, judgment of 11 July 2024, Meta Platforms Ireland (Representative action), C‑757/22, EU:C:2024:598, paragraph 44. A complaint concerning the obligation to provide information laid down in Article 12 of the GDPR or the right of access laid down in Article 15 of that regulation would, for example, be admissible before the start of data processing (see, to that effect, judgment of 11 July 2024, Meta Platforms Ireland (Representative action), C‑757/22, EU:C:2024:598, paragraph 45.
117      It is conceivable that the complainant could, in such a case, ask the supervisory authority to notify the controller or to order the controller not to publish the personal data, for example on the grounds that the processing is unlawful. If it is unlawful, the data subject could object to that processing,
conducted without any overriding legitimate
reason,
on the basis of Article 17(1)(c) of the GDPR. However, those do not appear to be the circumstances of the present case.
118      See the judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság, paragraph 34. See also Opinion of Advocate General Richard de la Tour in Datenschutzbehörde (Relationship between remedies), C‑414/24, EU:C:2025:656, point 46, concerning the relationship between an administrative complaint and a judicial remedy.
119      See the judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság, paragraph 41.
120      See the judgment in SCHUFA Holding, paragraph 53.
121      See the judgment in
Nemzeti Adatvédelmi és Információszabadság Hatóság, paragraph 37 and the judgment in Lindenapotheke, paragraph 60.
122      See the judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság, paragraphs 45 and 57.
123      See the judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság, paragraphs 46, 48 and 51.