Case C-474/24, NADA Austria and Others: Request for a preliminary ruling from the Bundesverwaltungsgericht (Austria) lodged on 4 July 2024 – AR and Others
Date: 2024-07-04
Institutions: Court of Justice
Subjects: Austria, Internet site, data protection, data sharing, data-processing law, judicial review, national competent authority, performance drugs, personal data, professional sport








C_202405407EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2024/5407


16.9.2024






Request for a preliminary ruling from the Bundesverwaltungsgericht (Austria) lodged on 4 July 2024 – AR and Others


(Case C-474/24, NADA Austria and Others)

(C/2024/5407)
Language of the case: German

Referring court

Bundesverwaltungsgericht

Parties to the main proceedings


Applicants: AR, YT, DI, RN

Defendant authority: Österreichische Datenschutzbehörde

Other parties: Nationale Anti-Doping Agentur Austria GmbH (NADA Austria), Österreichische Anti-Doping Rechtskommission (ÖADR)

Questions referred









1.


Does the processing of personal data relating to individuals by the publication of their name, the sport they practise, the anti-doping rule violation they have committed, the penalty imposed on them and the start and end dates of that penalty, in the form of an entry in a table on the publicly accessible part of the website of the Nationale Anti-Doping Agentur Austria GmbH (National Anti-Doping Agency Austria GmbH) (NADA Austria), https://www.nada.at/de/recht/suspendierungen-sperren, and in publicly accessible press releases issued by the Austrian Anti-Doping Rechtskommission (Anti-Doping Legal Committee) (ÖADR) at https://www.oeadr.at, fall within the scope of Union law within the meaning of the first sentence of Article 16(2) TFEU, with the result that Regulation (EU) 2016/679 (1) … is applicable to the processing of personal data in this way?
If Question 1 is answered in the affirmative:












2.


Does information that a certain person has committed a specific [anti-]doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute ‘data concerning health’ within the meaning of Article 9 of the GDPR?












3.


Does the GDPR – in particular in the light of the second subparagraph of Article 6(3) of the GDPR – preclude national legislation which provides for the name of the person affected by the decision of the Austrian Anti-Doping Legal Committee or the [Austrian] Independent Arbitration Committee, the duration of the ban and the reasons for it to be published, but not in such a way as to make it possible to infer data concerning the health of the person concerned? Is it of any significance in this regard that, under that national legislation, such information need not be disclosed to the general public only if the person concerned is a recreational athlete, a minor or a person who has made a significant contribution to the detection of potential anti-doping violations by sharing information or other indications?












4.


Does the GDPR – in particular in the light of the principles in Article 5(1)(a) and (c) thereof – require that publication be preceded in every case by a balancing of interests between the personal interests of the data subject that will be affected by publication, on the one hand, and the interests of the general public in being informed of the anti-doping violation committed by an athlete, on the other?












5.


Does information that a certain person has committed a specific [anti-]doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute the processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR?
If Question 5 is answered in the affirmative:












6.


Must the activities or decisions of an authority which has been given responsibility for exercising control over the processing of personal data relating to criminal convictions and offences or related security measures, in accordance with Article 10 of the GDPR, be subject to judicial review?












7.


Is a complaint under Article 77 of the GDPR concerning an alleged infringement under Article 17 of the GDPR, in the case where the personal data relating to the data subject had not yet been processed at the time when the complaint was lodged with the supervisory authority and the latter adopted its decision, but was processed in the course of the proceedings before the appeal court, permissible, or does it subsequently become permissible, provided that, at the time when the complaint was lodged, there were already specific indications that an operation involving the processing of personal data by the controller was imminent or would take place in the near future?






(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).


ELI: http://data.europa.eu/eli/C/2024/5407/oj
ISSN 1977-091X (electronic edition)